5-improve-encrypted-storage (#6)

Added the use of DEK's for encryption of secrets. Both the KEK's and DEK's are stored in a way that you can have multiple key of which one is active. But the others are still available for decrypting. This allows for implementing key rotation.

Co-authored-by: eelke <eelke@eelkeklein.nl>
Co-authored-by: Eelke76 <31384324+Eelke76@users.noreply.github.com>
Reviewed-on: #6

IdentityShroud.TestUtils/Asserts/JsonObjectAssert.cs

@@ -1,6 +1,5 @@
 using System.Text.Json.Nodes;
 using System.Text.RegularExpressions;
-using Xunit;
 
 namespace IdentityShroud.TestUtils.Asserts;
 

IdentityShroud.TestUtils/Asserts/ResultAssert.cs

@@ -1,5 +1,4 @@
 using FluentResults;
-using Xunit;
 
 namespace IdentityShroud.Core.Tests;
 

IdentityShroud.TestUtils/IdentityShroud.TestUtils.csproj

@@ -10,6 +10,7 @@
     <ItemGroup>
       <PackageReference Include="FluentResults" Version="4.0.0" />
       <PackageReference Include="xunit.v3.assert" Version="3.2.2" />
+      <PackageReference Include="NSubstitute" Version="5.3.0" />
     </ItemGroup>
 
     <ItemGroup>
@@ -21,10 +22,4 @@
         <Using Include="NSubstitute"/>
     </ItemGroup>
 
-    <ItemGroup>
-      <Reference Include="NSubstitute">
-        <HintPath>..\..\..\.nuget\packages\nsubstitute\5.3.0\lib\net6.0\NSubstitute.dll</HintPath>
-      </Reference>
-    </ItemGroup>
-
 </Project>

IdentityShroud.TestUtils/Substitutes/EncryptionServiceSubstitute.cs

@@ -1,18 +0,0 @@
-using IdentityShroud.Core.Contracts;
-
-namespace IdentityShroud.TestUtils.Substitutes;
-
-public static class EncryptionServiceSubstitute
-{
-    public static IEncryptionService CreatePassthrough()
-    {
-        var encryptionService = Substitute.For<IEncryptionService>();
-        encryptionService
-            .Encrypt(Arg.Any<byte[]>())
-            .Returns(x => x.ArgAt<byte[]>(0));
-        encryptionService
-            .Decrypt(Arg.Any<byte[]>())
-            .Returns(x => x.ArgAt<byte[]>(0));
-        return encryptionService;
-    }
-}

IdentityShroud.TestUtils/Substitutes/NullDataEncryptionService.cs

@@ -0,0 +1,18 @@
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Security;
+
+namespace IdentityShroud.TestUtils.Substitutes;
+
+public class NullDataEncryptionService : IDataEncryptionService
+{
+    public DekId KeyId { get; } = DekId.NewId(); 
+    public EncryptedValue Encrypt(ReadOnlySpan<byte> plain)
+    {
+        return new(KeyId, plain.ToArray());
+    }
+
+    public byte[] Decrypt(EncryptedValue input)
+    {
+        return input.Value;
+    }
+}

IdentityShroud.TestUtils/Substitutes/NullDekEncryptionService.cs

@@ -0,0 +1,18 @@
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Security;
+
+namespace IdentityShroud.TestUtils.Substitutes;
+
+public class NullDekEncryptionService : IDekEncryptionService
+{
+    public KekId KeyId { get; } = KekId.NewId(); 
+    public EncryptedDek Encrypt(ReadOnlySpan<byte> plain)
+    {
+        return new(KeyId, plain.ToArray());
+    }
+
+    public byte[] Decrypt(EncryptedDek input)
+    {
+        return input.Value;
+    }
+}