IdentityShroud.Api.Tests/Apis/ClientApiTests.cs

@@ -0,0 +1,179 @@
+using System.Net;
+using System.Net.Http.Json;
+using IdentityShroud.Core;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Tests.Fixtures;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace IdentityShroud.Api.Tests.Apis;
+
+public class ClientApiTests : IClassFixture<ApplicationFactory>
+{
+    private readonly ApplicationFactory _factory;
+
+    public ClientApiTests(ApplicationFactory factory)
+    {
+        _factory = factory;
+
+        using var scope = _factory.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<Db>();
+        if (!db.Database.EnsureCreated())
+        {
+            db.Database.ExecuteSqlRaw("TRUNCATE realm CASCADE;");
+        }
+    }
+
+    [Theory]
+    [InlineData(null, false, "ClientId")]
+    [InlineData("", false, "ClientId")]
+    [InlineData("my-client", true, "")]
+    public async Task Create_Validation(string? clientId, bool succeeds, string fieldName)
+    {
+        // setup
+        Realm realm = await CreateRealmAsync("test-realm", "Test Realm");
+
+        var client = _factory.CreateClient();
+
+        // act
+        var response = await client.PostAsync(
+            $"/api/v1/realms/{realm.Id}/clients",
+            JsonContent.Create(new { ClientId = clientId }),
+            TestContext.Current.CancellationToken);
+
+#if DEBUG
+        string contents = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+#endif
+
+        if (succeeds)
+        {
+            Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+        }
+        else
+        {
+            Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+            var problemDetails =
+                await response.Content.ReadFromJsonAsync<ValidationProblemDetails>(
+                    TestContext.Current.CancellationToken);
+
+            Assert.Contains(problemDetails!.Errors, e => e.Key == fieldName);
+        }
+    }
+
+    [Fact]
+    public async Task Create_Success_ReturnsCreatedWithLocation()
+    {
+        // setup
+        Realm realm = await CreateRealmAsync("create-realm", "Create Realm");
+
+        var client = _factory.CreateClient();
+
+        // act
+        var response = await client.PostAsync(
+            $"/api/v1/realms/{realm.Id}/clients",
+            JsonContent.Create(new { ClientId = "new-client", Name = "New Client" }),
+            TestContext.Current.CancellationToken);
+
+#if DEBUG
+        string contents = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+#endif
+
+        // verify
+        Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+
+        var body = await response.Content.ReadFromJsonAsync<ClientCreateReponse>(
+            TestContext.Current.CancellationToken);
+
+        Assert.NotNull(body);
+        Assert.Equal("new-client", body.ClientId);
+        Assert.True(body.Id > 0);
+    }
+
+    [Fact]
+    public async Task Create_UnknownRealm_ReturnsNotFound()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsync(
+            $"/api/v1/realms/{Guid.NewGuid()}/clients",
+            JsonContent.Create(new { ClientId = "some-client" }),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Get_Success()
+    {
+        // setup
+        Realm realm = await CreateRealmAsync("get-realm", "Get Realm");
+        Client dbClient = await CreateClientAsync(realm, "get-client", "Get Client");
+
+        var httpClient = _factory.CreateClient();
+
+        // act
+        var response = await httpClient.GetAsync(
+            $"/api/v1/realms/{realm.Id}/clients/{dbClient.Id}",
+            TestContext.Current.CancellationToken);
+
+#if DEBUG
+        string contents = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+#endif
+
+        // verify
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var body = await response.Content.ReadFromJsonAsync<ClientRepresentation>(
+            TestContext.Current.CancellationToken);
+
+        Assert.NotNull(body);
+        Assert.Equal(dbClient.Id, body.Id);
+        Assert.Equal("get-client", body.ClientId);
+        Assert.Equal("Get Client", body.Name);
+        Assert.Equal(realm.Id, body.RealmId);
+    }
+
+    [Fact]
+    public async Task Get_UnknownClient_ReturnsNotFound()
+    {
+        // setup
+        Realm realm = await CreateRealmAsync("notfound-realm", "NotFound Realm");
+
+        var httpClient = _factory.CreateClient();
+
+        // act
+        var response = await httpClient.GetAsync(
+            $"/api/v1/realms/{realm.Id}/clients/99999",
+            TestContext.Current.CancellationToken);
+
+        // verify
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    private async Task<Realm> CreateRealmAsync(string slug, string name)
+    {
+        using var scope = _factory.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<Db>();
+        var realm = new Realm { Slug = slug, Name = name };
+        db.Realms.Add(realm);
+        await db.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return realm;
+    }
+
+    private async Task<Client> CreateClientAsync(Realm realm, string clientId, string? name = null)
+    {
+        using var scope = _factory.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<Db>();
+        var client = new Client
+        {
+            RealmId = realm.Id,
+            ClientId = clientId,
+            Name = name,
+            CreatedAt = DateTime.UtcNow,
+        };
+        db.Clients.Add(client);
+        await db.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return client;
+    }
+}

IdentityShroud.Api.Tests/Apis/RealmApisTests.cs

@@ -44,7 +44,9 @@ public class RealmApisTests : IClassFixture<ApplicationFactory>
         var client = _factory.CreateClient();
 
         Guid? inputId = id is null ? (Guid?)null : new Guid(id);
-        var response = await client.PostAsync("/realms", JsonContent.Create(new
+        
+        // act
+        var response = await client.PostAsync("/api/v1/realms", JsonContent.Create(new
             {
                 Id = inputId,
                 Slug = slug,
@@ -88,16 +90,21 @@ public class RealmApisTests : IClassFixture<ApplicationFactory>
 
         // act
         var client = _factory.CreateClient();
-        var response = await client.GetAsync("/realms/foo/.well-known/openid-configuration",
+        var response = await client.GetAsync("auth/realms/foo/.well-known/openid-configuration",
             TestContext.Current.CancellationToken);
 
         // verify
+#if DEBUG
+        string contents = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+#endif
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);        
+        
         var result = await response.Content.ReadFromJsonAsync<JsonObject>(TestContext.Current.CancellationToken);
         Assert.NotNull(result);
-        JsonObjectAssert.Equal("http://localhost/realms/foo/openid-connect/auth", result, "authorization_endpoint");
-        JsonObjectAssert.Equal("http://localhost/realms/foo", result, "issuer");
-        JsonObjectAssert.Equal("http://localhost/realms/foo/openid-connect/token", result, "token_endpoint");
-        JsonObjectAssert.Equal("http://localhost/realms/foo/openid-connect/jwks", result, "jwks_uri");
+        JsonObjectAssert.Equal("http://localhost/auth/realms/foo/openid-connect/auth", result, "authorization_endpoint");
+        JsonObjectAssert.Equal("http://localhost/auth/realms/foo", result, "issuer");
+        JsonObjectAssert.Equal("http://localhost/auth/realms/foo/openid-connect/token", result, "token_endpoint");
+        JsonObjectAssert.Equal("http://localhost/auth/realms/foo/openid-connect/jwks", result, "jwks_uri");
     }
 
     [Theory]
@@ -123,29 +130,28 @@ public class RealmApisTests : IClassFixture<ApplicationFactory>
         using var rsa = RSA.Create(2048);
         RSAParameters parameters = rsa.ExportParameters(includePrivateParameters: false);
 
-        Key key = new()
-        {
-            Id = Guid.NewGuid(),
-            CreatedAt = DateTime.UtcNow,
-        };
-        key.SetPrivateKey(encryptionService, rsa.ExportPkcs8PrivateKey());
+        RealmKey realmKey = new(
+            Guid.NewGuid(),
+            "RSA",
+            encryptionService.Encrypt(rsa.ExportPkcs8PrivateKey()),
+            DateTime.UtcNow);
 
         await ScopedContextAsync(async db =>
         {
-            db.Realms.Add(new Realm() { Slug = "foo", Name = "Foo", Keys = [ key ]});
+            db.Realms.Add(new Realm() { Slug = "foo", Name = "Foo", Keys = [ realmKey ]});
             await db.SaveChangesAsync(TestContext.Current.CancellationToken);
         });
         
         // act
         var client = _factory.CreateClient();
-        var response = await client.GetAsync("/realms/foo/openid-connect/jwks",
+        var response = await client.GetAsync("/auth/realms/foo/openid-connect/jwks",
             TestContext.Current.CancellationToken);
         
         Assert.Equal(HttpStatusCode.OK, response.StatusCode);
         JsonObject? payload = await response.Content.ReadFromJsonAsync<JsonObject>(TestContext.Current.CancellationToken);
 
         Assert.NotNull(payload);
-        JsonObjectAssert.Equal(key.Id.ToString(), payload, "keys[0].kid"); 
+        JsonObjectAssert.Equal(realmKey.Id.ToString(), payload, "keys[0].kid"); 
         JsonObjectAssert.Equal(WebEncoders.Base64UrlEncode(parameters.Modulus!), payload, "keys[0].n"); 
         JsonObjectAssert.Equal(WebEncoders.Base64UrlEncode(parameters.Exponent!), payload, "keys[0].e"); 
     }

IdentityShroud.Api.Tests/Fixtures/ApplicationFactory.cs

@@ -1,11 +1,6 @@
-using IdentityShroud.Core.Services;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
-using Microsoft.EntityFrameworkCore.Infrastructure;
 using Microsoft.Extensions.Configuration;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.VisualStudio.TestPlatform.TestHost;
-using Npgsql;
 using Testcontainers.PostgreSql;
 
 namespace IdentityShroud.Core.Tests.Fixtures;

IdentityShroud.Api.Tests/Mappers/KeyMapperTests.cs

@@ -1,41 +0,0 @@
-using System.Security.Cryptography;
-using IdentityShroud.Api.Mappers;
-using IdentityShroud.Core.Contracts;
-using IdentityShroud.Core.Messages;
-using IdentityShroud.Core.Model;
-using IdentityShroud.TestUtils.Substitutes;
-using Microsoft.AspNetCore.WebUtilities;
-
-namespace IdentityShroud.Api.Tests.Mappers;
-
-public class KeyMapperTests
-{
-    private readonly IEncryptionService _encryptionService = EncryptionServiceSubstitute.CreatePassthrough();
-
-    [Fact]
-    public void Test()
-    {
-        // Setup
-        using RSA rsa = RSA.Create(2048);
-
-        RSAParameters parameters = rsa.ExportParameters(includePrivateParameters: false);
-        
-        Key key = new()
-        {
-            Id = new("60bb79cf-4bac-4521-87f2-ac87cc15541f"),
-            CreatedAt = DateTime.UtcNow,
-            Priority = 10,
-        };
-        key.SetPrivateKey(_encryptionService, rsa.ExportPkcs8PrivateKey());
-
-        // Act
-        KeyMapper mapper = new(_encryptionService);
-        JsonWebKey jwk = mapper.KeyToJsonWebKey(key);
-
-        Assert.Equal("RSA", jwk.KeyType);
-        Assert.Equal(key.Id.ToString(), jwk.KeyId);
-        Assert.Equal("sig", jwk.Use);
-        Assert.Equal(parameters.Exponent, WebEncoders.Base64UrlDecode(jwk.Exponent));
-        Assert.Equal(parameters.Modulus, WebEncoders.Base64UrlDecode(jwk.Modulus));
-    }
-}

IdentityShroud.Api.Tests/Mappers/KeyServiceTests.cs

@@ -0,0 +1,43 @@
+using System.Buffers.Text;
+using System.Security.Cryptography;
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Security.Keys;
+using IdentityShroud.Core.Services;
+using IdentityShroud.TestUtils.Substitutes;
+
+namespace IdentityShroud.Api.Tests.Mappers;
+
+public class KeyServiceTests
+{
+    private readonly IEncryptionService _encryptionService = EncryptionServiceSubstitute.CreatePassthrough();
+    //private readonly IKeyProviderFactory _keyProviderFactory = Substitute.For<IKeyProviderFactory>();
+
+    [Fact]
+    public void Test()
+    {
+        // Setup
+        using RSA rsa = RSA.Create(2048);
+
+        RSAParameters parameters = rsa.ExportParameters(includePrivateParameters: false);
+        
+        RealmKey realmKey = new(
+            new("60bb79cf-4bac-4521-87f2-ac87cc15541f"),
+            "RSA",
+            rsa.ExportPkcs8PrivateKey(),
+            DateTime.UtcNow)
+        {
+            Priority = 10,
+        };
+        
+        // Act
+        KeyService sut = new(_encryptionService, new KeyProviderFactory(), new ClockService());
+        var jwk = sut.CreateJsonWebKey(realmKey);
+
+        Assert.Equal("RSA", jwk.KeyType);
+        Assert.Equal(realmKey.Id.ToString(), jwk.KeyId);
+        Assert.Equal("sig", jwk.Use);
+        Assert.Equal(parameters.Exponent, Base64Url.DecodeFromChars(jwk.Exponent));
+        Assert.Equal(parameters.Modulus, Base64Url.DecodeFromChars(jwk.Modulus));
+    }
+}

IdentityShroud.Api/Apis/ClientApi.cs

@@ -0,0 +1,73 @@
+using FluentResults;
+using IdentityShroud.Api.Mappers;
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+using Microsoft.AspNetCore.Http.HttpResults;
+using Microsoft.AspNetCore.Mvc;
+
+namespace IdentityShroud.Api;
+
+
+
+public record ClientCreateReponse(int Id, string ClientId);
+
+/// <summary>
+/// The part of the api below realms/{slug}/clients
+/// </summary>
+public static class ClientApi
+{
+    public const string ClientGetRouteName = "ClientGet";
+    
+    public static void MapEndpoints(this IEndpointRouteBuilder erp)
+    {
+        RouteGroupBuilder clientsGroup = erp.MapGroup("clients");        
+        
+        clientsGroup.MapPost("", ClientCreate)
+            .Validate<ClientCreateRequest>() 
+            .WithName("ClientCreate")
+            .Produces(StatusCodes.Status201Created);
+        
+        var clientIdGroup = clientsGroup.MapGroup("{clientId}")
+            .AddEndpointFilter<ClientIdValidationFilter>();
+            
+        clientIdGroup.MapGet("", ClientGet)
+            .WithName(ClientGetRouteName);
+    }
+
+    private static Ok<ClientRepresentation> ClientGet(
+        Guid realmId,
+        int clientId,
+        HttpContext context)
+    {
+        Client client = (Client)context.Items["ClientEntity"]!;
+        return TypedResults.Ok(new ClientMapper().ToDto(client));
+    }
+
+    private static async Task<Results<CreatedAtRoute<ClientCreateReponse>, InternalServerError>>
+        ClientCreate(
+            Guid realmId,
+            ClientCreateRequest request, 
+            [FromServices] IClientService service,
+            HttpContext context,
+            CancellationToken cancellationToken)
+    {
+        Realm realm = context.GetValidatedRealm();
+        Result<Client> result = await service.Create(realm.Id, request, cancellationToken);
+
+        if (result.IsFailed)
+        {
+            throw new NotImplementedException();
+        }
+
+        Client client = result.Value;
+
+        return TypedResults.CreatedAtRoute(
+            new ClientCreateReponse(client.Id, client.ClientId),
+            ClientGetRouteName, 
+            new RouteValueDictionary()
+            {
+                ["realmId"] = realm.Id,
+                ["clientId"] = client.Id, 
+            });
+    }
+}

IdentityShroud.Api/Apis/DTO/JsonWebKey.cs

@@ -1,41 +0,0 @@
-using System.Text.Json.Serialization;
-
-namespace IdentityShroud.Core.Messages;
-
-// https://www.rfc-editor.org/rfc/rfc7517.html
-
-
-public class JsonWebKey
-{
-    [JsonPropertyName("kty")]
-    public string KeyType { get; set; } = "RSA";
-    
-    // Common values sig(nature) enc(ryption)
-    [JsonPropertyName("use")]
-    public string? Use { get; set; } = "sig"; // "sig" for signature, "enc" for encryption
-    
-    // Per standard this field is optional, commented out for now as it seems not 
-    // have any good use in an identity server. Anyone validating tokens should use
-    // the algorithm specified in the header of the token.
-    // [JsonPropertyName("alg")]
-    // public string? Algorithm { get; set; } = "RS256";
-    
-    [JsonPropertyName("kid")]
-    public required string KeyId { get; set; }
-    
-    // RSA Public Key Components
-    [JsonPropertyName("n")]
-    public required string Modulus { get; set; }
-    
-    [JsonPropertyName("e")]
-    public required string Exponent { get; set; }
-    
-    // Optional fields
-    [JsonPropertyName("x5c")]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    public List<string>? X509CertificateChain { get; set; }
-    
-    [JsonPropertyName("x5t")]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    public string? X509CertificateThumbprint { get; set; }    
-}

IdentityShroud.Api/Apis/Dto/ClientRepresentation.cs

@@ -0,0 +1,16 @@
+namespace IdentityShroud.Api;
+
+public record ClientRepresentation
+{
+    public int Id { get; set; }
+    public Guid RealmId { get; set; }
+    public required string ClientId { get; set; }
+    public string? Name { get; set; }
+    public string? Description { get; set; }
+    
+    public string? SignatureAlgorithm { get; set; }
+    
+    public bool AllowClientCredentialsFlow { get; set; } = false;
+    
+    public required DateTime CreatedAt { get; set; }
+}

IdentityShroud.Api/Apis/EndpointRouteBuilderExtensions.cs

@@ -0,0 +1,15 @@
+namespace IdentityShroud.Api;
+
+public static class EndpointRouteBuilderExtensions
+{
+    public static RouteHandlerBuilder Validate<TDto>(this RouteHandlerBuilder builder) where TDto : class
+        => builder.AddEndpointFilter<ValidateFilter<TDto>>();
+    
+    public static void MapApis(this IEndpointRouteBuilder erp)
+    {
+        RealmApi.MapRealmEndpoints(erp);
+        
+        OpenIdEndpoints.MapEndpoints(erp);
+    }
+    
+}

IdentityShroud.Api/Apis/Filters/ClientIdValidationFilter.cs

@@ -0,0 +1,21 @@
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+
+namespace IdentityShroud.Api;
+
+public class ClientIdValidationFilter(IClientService clientService) : IEndpointFilter
+{
+    public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
+    {
+        Guid realmId = context.Arguments.OfType<Guid>().First();
+        int id = context.Arguments.OfType<int>().First();
+        Client? client = await clientService.FindById(realmId, id, context.HttpContext.RequestAborted);
+        if (client is null)
+        {
+            return Results.NotFound();
+        }
+        context.HttpContext.Items["ClientEntity"] = client;
+
+        return await next(context);
+    }
+}

IdentityShroud.Api/Apis/Filters/RealmIdValidationFilter.cs

@@ -0,0 +1,20 @@
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+
+namespace IdentityShroud.Api;
+
+public class RealmIdValidationFilter(IRealmService realmService) : IEndpointFilter
+{
+    public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
+    {
+        Guid id = context.Arguments.OfType<Guid>().First();
+        Realm? realm = await realmService.FindById(id, context.HttpContext.RequestAborted);
+        if (realm is null)
+        {
+            return Results.NotFound();
+        }
+        context.HttpContext.Items["RealmEntity"] = realm;
+
+        return await next(context);
+    }
+}

IdentityShroud.Api/Apis/Filters/RealmSlugValidationFilter.cs

@@ -1,5 +1,5 @@
+using IdentityShroud.Core.Contracts;
 using IdentityShroud.Core.Model;
-using IdentityShroud.Core.Services;
 
 namespace IdentityShroud.Api;
 
@@ -9,12 +9,13 @@ namespace IdentityShroud.Api;
 /// consistently.
 /// </summary>
 /// <param name="realmService"></param>
-public class SlugValidationFilter(IRealmService realmService) : IEndpointFilter
+public class RealmSlugValidationFilter(IRealmService realmService) : IEndpointFilter
 {
     public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
     {
-        string slug = context.Arguments.OfType<string>().First();
-        Realm? realm = await realmService.FindBySlug(slug);
+        string realmSlug = context.Arguments.OfType<string>().FirstOrDefault()
+            ?? throw new InvalidOperationException("Expected argument missing, ensure you include path parameters in your handlers signature even when you don't use them");
+        Realm? realm = await realmService.FindBySlug(realmSlug, context.HttpContext.RequestAborted);
         if (realm is null)
         {
             return Results.NotFound();

IdentityShroud.Api/Apis/Mappers/ClientMapper.cs

@@ -0,0 +1,11 @@
+using IdentityShroud.Core.Model;
+using Riok.Mapperly.Abstractions;
+
+namespace IdentityShroud.Api.Mappers;
+
+[Mapper]
+public partial class ClientMapper
+{
+    [MapperIgnoreSource(nameof(Client.Secrets))]
+    public partial ClientRepresentation ToDto(Client client);
+}

IdentityShroud.Api/Apis/Mappers/KeyMapper.cs

@@ -1,34 +1,22 @@
-using System.Security.Cryptography;
 using IdentityShroud.Core.Contracts;
 using IdentityShroud.Core.Messages;
 using IdentityShroud.Core.Model;
-using IdentityShroud.Core.Security;
-using Microsoft.AspNetCore.WebUtilities;
 
 namespace IdentityShroud.Api.Mappers;
 
-public class KeyMapper(IEncryptionService encryptionService)
+public class KeyMapper(IKeyService keyService)
 {
-    public JsonWebKey KeyToJsonWebKey(Key key)
+    public JsonWebKeySet KeyListToJsonWebKeySet(IEnumerable<RealmKey> keys)
     {
-        using var rsa = RsaHelper.LoadFromPkcs8(key.GetPrivateKey(encryptionService));
-        RSAParameters parameters = rsa.ExportParameters(includePrivateParameters: false);
-        
-        return new JsonWebKey()
+        JsonWebKeySet wks = new();
+        foreach (var k in keys)
         {
-            KeyType = rsa.SignatureAlgorithm,
-            KeyId = key.Id.ToString(),
-            Use = "sig",
-            Exponent = WebEncoders.Base64UrlEncode(parameters.Exponent!),
-            Modulus = WebEncoders.Base64UrlEncode(parameters.Modulus!),
-        };
-    }
-
-    public JsonWebKeySet KeyListToJsonWebKeySet(IEnumerable<Key> keys)
-    {
-        return new JsonWebKeySet()
-        {
-            Keys = keys.Select(e => KeyToJsonWebKey(e)).ToList(),
-        };
+            var wk = keyService.CreateJsonWebKey(k);
+            if (wk is {})
+            {
+                wks.Keys.Add(wk);
+            }
+        }
+        return wks;
     }
 }

IdentityShroud.Api/Apis/OpenIdEndpoints.cs

@@ -0,0 +1,72 @@
+using IdentityShroud.Api.Mappers;
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Messages;
+using IdentityShroud.Core.Model;
+using Microsoft.AspNetCore.Http.HttpResults;
+using Microsoft.AspNetCore.Mvc;
+
+namespace IdentityShroud.Api;
+
+public static class OpenIdEndpoints
+{
+    // openid: auth/realms/{realmSlug}/.well-known/openid-configuration
+    // openid: auth/realms/{realmSlug}/openid-connect/(auth|token|jwks)
+    
+    
+    public static void MapEndpoints(this IEndpointRouteBuilder erp)
+    {
+        var realmsGroup = erp.MapGroup("/auth/realms");
+        
+        var realmSlugGroup = realmsGroup.MapGroup("{realmSlug}")
+            .AddEndpointFilter<RealmSlugValidationFilter>();
+        realmSlugGroup.MapGet(".well-known/openid-configuration", GetOpenIdConfiguration);
+
+        var openidConnect = realmSlugGroup.MapGroup("openid-connect");
+        openidConnect.MapPost("auth", OpenIdConnectAuth);
+        openidConnect.MapPost("token", OpenIdConnectToken);
+        openidConnect.MapGet("jwks", OpenIdConnectJwks);
+    }
+    
+    private static async Task<JsonHttpResult<OpenIdConfiguration>> GetOpenIdConfiguration(
+        string realmSlug,
+        [FromServices]IRealmService realmService,
+        HttpContext context)
+    {
+        Realm realm = context.GetValidatedRealm();
+        
+        var s = $"{context.Request.Scheme}://{context.Request.Host}{context.Request.Path}";
+        var searchString = $"realms/{realmSlug}";
+        int index = s.IndexOf(searchString, StringComparison.OrdinalIgnoreCase);
+        string baseUri = s.Substring(0, index + searchString.Length);
+
+        return TypedResults.Json(new OpenIdConfiguration()
+        {
+            AuthorizationEndpoint = baseUri + "/openid-connect/auth",
+            TokenEndpoint = baseUri + "/openid-connect/token",
+            Issuer =  baseUri,
+            JwksUri =  baseUri + "/openid-connect/jwks",
+        }, AppJsonSerializerContext.Default.OpenIdConfiguration);
+    }
+
+    private static async Task<Results<Ok<JsonWebKeySet>, BadRequest>> OpenIdConnectJwks(
+        string realmSlug,
+        [FromServices]IRealmService realmService,
+        [FromServices]KeyMapper keyMapper,
+        HttpContext context)
+    {
+        Realm realm = context.GetValidatedRealm();
+        await realmService.LoadActiveKeys(realm);
+        return TypedResults.Ok(keyMapper.KeyListToJsonWebKeySet(realm.Keys));
+    }
+
+    private static Task OpenIdConnectToken(HttpContext context)
+    {
+        throw new NotImplementedException();
+    }
+
+    private static Task OpenIdConnectAuth(HttpContext context)
+    {
+        throw new NotImplementedException();
+    }
+
+}

IdentityShroud.Api/Apis/RealmApi.cs

@@ -1,7 +1,4 @@
-using FluentResults;
-using IdentityShroud.Api.Mappers;
-using IdentityShroud.Api.Validation;
-using IdentityShroud.Core.Messages;
+using IdentityShroud.Core.Contracts;
 using IdentityShroud.Core.Messages.Realm;
 using IdentityShroud.Core.Model;
 using IdentityShroud.Core.Services;
@@ -15,26 +12,28 @@ public static class HttpContextExtensions
     public static Realm GetValidatedRealm(this HttpContext context) => (Realm)context.Items["RealmEntity"]!;    
 }
 
+// api: api/v1/realms/{realmId}/....
+// api: api/v1/realms/{realmId}/clients/{clientId}
+
 
 
 public static class RealmApi
 {
-    public static void MapRealmEndpoints(this IEndpointRouteBuilder app)
+    public static void MapRealmEndpoints(IEndpointRouteBuilder erp)
     {
-        var realmsGroup = app.MapGroup("/realms");
+        var realmsGroup = erp.MapGroup("/api/v1/realms");
         realmsGroup.MapPost("", RealmCreate)
             .Validate<RealmCreateRequest>() 
             .WithName("Create Realm")
             .Produces(StatusCodes.Status201Created);
         
-        var realmSlugGroup = realmsGroup.MapGroup("{slug}")
-            .AddEndpointFilter<SlugValidationFilter>();
-        realmSlugGroup.MapGet(".well-known/openid-configuration", GetOpenIdConfiguration);
+        var realmIdGroup = realmsGroup.MapGroup("{realmId}")
+            .AddEndpointFilter<RealmIdValidationFilter>();
+
+        ClientApi.MapEndpoints(realmIdGroup);
+        
+            
 
-        var openidConnect = realmSlugGroup.MapGroup("openid-connect");
-        openidConnect.MapPost("auth", OpenIdConnectAuth);
-        openidConnect.MapPost("token", OpenIdConnectToken);
-        openidConnect.MapGet("jwks", OpenIdConnectJwks);
     }
     
     private static async Task<Results<Created<RealmCreateResponse>, InternalServerError>> 
@@ -47,46 +46,4 @@ public static class RealmApi
         // TODO make helper to convert failure response to a proper HTTP result.
         return TypedResults.InternalServerError();
     }
-
-    private static async Task<Results<Ok<JsonWebKeySet>, BadRequest>> OpenIdConnectJwks(
-        string slug,
-        [FromServices]IRealmService realmService,
-        [FromServices]KeyMapper keyMapper,
-        HttpContext context)
-    {
-        Realm realm = context.GetValidatedRealm();
-        await realmService.LoadActiveKeys(realm);
-        return TypedResults.Ok(keyMapper.KeyListToJsonWebKeySet(realm.Keys));
-    }
-
-    private static Task OpenIdConnectToken(HttpContext context)
-    {
-        throw new NotImplementedException();
-    }
-
-    private static Task OpenIdConnectAuth(HttpContext context)
-    {
-        throw new NotImplementedException();
-    }
-
-    private static async Task<JsonHttpResult<OpenIdConfiguration>> GetOpenIdConfiguration(
-        string slug,
-        [FromServices]IRealmService realmService,
-        HttpContext context)
-    {
-        Realm realm = context.GetValidatedRealm();
-        
-        var s = $"{context.Request.Scheme}://{context.Request.Host}{context.Request.Path}";
-        var searchString = $"realms/{slug}";
-        int index = s.IndexOf(searchString, StringComparison.OrdinalIgnoreCase);
-        string baseUri = s.Substring(0, index + searchString.Length);
-
-        return TypedResults.Json(new OpenIdConfiguration()
-        {
-            AuthorizationEndpoint = baseUri + "/openid-connect/auth",
-            TokenEndpoint = baseUri + "/openid-connect/token",
-            Issuer =  baseUri,
-            JwksUri =  baseUri + "/openid-connect/jwks",
-        }, AppJsonSerializerContext.Default.OpenIdConfiguration);
-    }
 }

IdentityShroud.Api/Apis/Validation/ClientCreateRequestValidator.cs

@@ -0,0 +1,22 @@
+using FluentValidation;
+using IdentityShroud.Core.Contracts;
+
+namespace IdentityShroud.Api;
+
+public class ClientCreateRequestValidator : AbstractValidator<ClientCreateRequest>
+{
+    // most of standard ascii minus the control characters and space 
+    private const string ClientIdPattern = "^[\x21-\x7E]+";
+
+    private string[] AllowedAlgorithms = [ "RS256", "ES256" ];
+    
+    public ClientCreateRequestValidator()
+    {
+        RuleFor(e => e.ClientId).NotEmpty().MaximumLength(40).Matches(ClientIdPattern);
+        RuleFor(e => e.Name).MaximumLength(80);
+        RuleFor(e => e.Description).MaximumLength(2048);
+        RuleFor(e => e.SignatureAlgorithm)
+            .Must(v => v is null || AllowedAlgorithms.Contains(v))
+            .WithMessage($"SignatureAlgorithm must be one of {string.Join(", ", AllowedAlgorithms)} or null");
+    }
+}

IdentityShroud.Api/Apis/Validation/RealmCreateRequestValidator.cs

@@ -1,7 +1,7 @@
 using FluentValidation;
 using IdentityShroud.Core.Messages.Realm;
 
-namespace IdentityShroud.Api.Validation;
+namespace IdentityShroud.Api;
 
 public class RealmCreateRequestValidator : AbstractValidator<RealmCreateRequest>
 {

IdentityShroud.Api/Apis/Validation/ValidateFilter.cs

@@ -1,6 +1,6 @@
 using FluentValidation;
 
-namespace IdentityShroud.Api.Validation;
+namespace IdentityShroud.Api;
 
 public class ValidateFilter<T> : IEndpointFilter where T : class
 {

IdentityShroud.Api/AppJsonSerializerContext.cs

@@ -1,7 +1,6 @@
 using System.Text.Json.Serialization;
 using IdentityShroud.Core.Messages;
 using IdentityShroud.Core.Messages.Realm;
-using Microsoft.Extensions.Diagnostics.HealthChecks;
 
 [JsonSerializable(typeof(OpenIdConfiguration))]
 [JsonSerializable(typeof(RealmCreateRequest))]

IdentityShroud.Api/IdentityShroud.Api.csproj

@@ -18,6 +18,7 @@
         <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="12.1.1" />
         <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.0"/>
         <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.2" />
+        <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
         <PackageReference Include="Serilog" Version="4.3.0" />
         <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
         <PackageReference Include="Serilog.Expressions" Version="5.0.0" />

IdentityShroud.Api/IdentityShroud.Api.csproj.DotSettings

@@ -1,3 +1,5 @@
 <wpf:ResourceDictionary xml:space="preserve" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:s="clr-namespace:System;assembly=mscorlib" xmlns:ss="urn:shemas-jetbrains-com:settings-storage-xaml" xmlns:wpf="http://schemas.microsoft.com/winfx/2006/xaml/presentation">
 	<s:Boolean x:Key="/Default/CodeInspection/NamespaceProvider/NamespaceFoldersToSkip/=apis_005Cdto/@EntryIndexedValue">True</s:Boolean>
-	<s:Boolean x:Key="/Default/CodeInspection/NamespaceProvider/NamespaceFoldersToSkip/=apis_005Cfilters/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>
+	<s:Boolean x:Key="/Default/CodeInspection/NamespaceProvider/NamespaceFoldersToSkip/=apis_005Cfilters/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/CodeInspection/NamespaceProvider/NamespaceFoldersToSkip/=apis_005Cvalidation/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/CodeInspection/NamespaceProvider/NamespaceFoldersToSkip/=validation/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>

IdentityShroud.Api/Program.cs

@@ -1,10 +1,10 @@
 using FluentValidation;
 using IdentityShroud.Api;
 using IdentityShroud.Api.Mappers;
-using IdentityShroud.Api.Validation;
 using IdentityShroud.Core;
 using IdentityShroud.Core.Contracts;
 using IdentityShroud.Core.Security;
+using IdentityShroud.Core.Security.Keys;
 using IdentityShroud.Core.Services;
 using Serilog;
 using Serilog.Formatting.Json;
@@ -36,11 +36,15 @@ void ConfigureBuilder(WebApplicationBuilder builder)
     // Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
     services.AddOpenApi();
     services.AddScoped<Db>();
+    services.AddScoped<IClientService, ClientService>();
+    services.AddSingleton<IClock, ClockService>();
+    services.AddSingleton<IEncryptionService, EncryptionService>();
+    services.AddScoped<IKeyProviderFactory, KeyProviderFactory>();
+    services.AddScoped<IKeyService, KeyService>();
     services.AddScoped<IRealmService, RealmService>();
     services.AddOptions<DbConfiguration>().Bind(configuration.GetSection("db"));
     services.AddSingleton<ISecretProvider, ConfigurationSecretProvider>();
-    services.AddSingleton<KeyMapper>();
-    services.AddSingleton<IEncryptionService, EncryptionService>();
+    services.AddScoped<KeyMapper>();
     
     services.AddValidatorsFromAssemblyContaining<RealmCreateRequestValidator>();    
     
@@ -57,7 +61,8 @@ void ConfigureApplication(WebApplication app)
         app.MapOpenApi();
     }
     app.UseSerilogRequestLogging();
-    app.MapRealmEndpoints();
+    app.MapApis();
+    
     // app.UseRouting();
     // app.MapControllers();
 }

IdentityShroud.Api/Validation/EndpointRouteBuilderExtensions.cs

@@ -1,7 +0,0 @@
-namespace IdentityShroud.Api.Validation;
-
-public static class EndpointRouteBuilderExtensions
-{
-    public static RouteHandlerBuilder Validate<TDto>(this RouteHandlerBuilder builder) where TDto : class
-        => builder.AddEndpointFilter<ValidateFilter<TDto>>();    
-}

IdentityShroud.Core.Tests/Fixtures/DbFixture.cs

@@ -1,5 +1,4 @@
-using DotNet.Testcontainers.Containers;
-using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
 using Npgsql;
 using Testcontainers.PostgreSql;

IdentityShroud.Core.Tests/IdentityShroud.Core.Tests.csproj

@@ -30,4 +30,8 @@
       <ProjectReference Include="..\IdentityShroud.TestUtils\IdentityShroud.TestUtils.csproj" />
     </ItemGroup>
 
+    <ItemGroup>
+      <Folder Include="Model\" />
+    </ItemGroup>
+
 </Project>

IdentityShroud.Core.Tests/Model/KeyTests.cs

@@ -1,51 +0,0 @@
-using IdentityShroud.Core.Contracts;
-using IdentityShroud.Core.Model;
-
-namespace IdentityShroud.Core.Tests.Model;
-
-public class KeyTests
-{
-    [Fact]
-    public void SetNewKey()
-    {
-        byte[] privateKey = [5, 6, 7, 8];
-        byte[] encryptedPrivateKey = [1, 2, 3, 4];
-        
-        var encryptionService = Substitute.For<IEncryptionService>();
-        encryptionService
-            .Encrypt(Arg.Any<byte[]>())
-            .Returns(x => encryptedPrivateKey); 
-        
-        Key key = new();
-        key.SetPrivateKey(encryptionService, privateKey);
-
-        // should be able to return original without calling decrypt
-        Assert.Equal(privateKey, key.GetPrivateKey(encryptionService));
-        Assert.Equal(encryptedPrivateKey, key.PrivateKeyEncrypted);
-
-        encryptionService.Received(1).Encrypt(privateKey);
-        encryptionService.DidNotReceive().Decrypt(Arg.Any<byte[]>());
-    }
-    
-    [Fact]
-    public void GetDecryptedKey()
-    {
-        byte[] privateKey = [5, 6, 7, 8];
-        byte[] encryptedPrivateKey = [1, 2, 3, 4];
-        
-        var encryptionService = Substitute.For<IEncryptionService>();
-        encryptionService
-            .Decrypt(encryptedPrivateKey)
-            .Returns(x => privateKey); 
-        
-        Key key = new();
-        key.PrivateKeyEncrypted = encryptedPrivateKey;
-
-        // should be able to return original without calling decrypt
-        Assert.Equal(privateKey, key.GetPrivateKey(encryptionService));
-        Assert.Equal(encryptedPrivateKey, key.PrivateKeyEncrypted);
-
-        encryptionService.Received(1).Decrypt(encryptedPrivateKey);
-    }
-    
-}

IdentityShroud.Core.Tests/Services/ClientServiceTests.cs

@@ -0,0 +1,154 @@
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Services;
+using IdentityShroud.Core.Tests.Fixtures;
+using IdentityShroud.TestUtils.Substitutes;
+using Microsoft.EntityFrameworkCore;
+
+namespace IdentityShroud.Core.Tests.Services;
+
+public class ClientServiceTests : IClassFixture<DbFixture>
+{
+    private readonly DbFixture _dbFixture;
+    private readonly IEncryptionService _encryptionService = EncryptionServiceSubstitute.CreatePassthrough();
+    private readonly IClock _clock = Substitute.For<IClock>();
+    private readonly Guid _realmId = new("a1b2c3d4-0000-0000-0000-000000000001");
+
+    public ClientServiceTests(DbFixture dbFixture)
+    {
+        _dbFixture = dbFixture;
+        using Db db = dbFixture.CreateDbContext();
+        if (!db.Database.EnsureCreated())
+            TruncateTables(db);
+        EnsureRealm(db);
+    }
+
+    private void TruncateTables(Db db)
+    {
+        db.Database.ExecuteSqlRaw("TRUNCATE client CASCADE;");
+        db.Database.ExecuteSqlRaw("TRUNCATE realm CASCADE;");
+    }
+
+    private void EnsureRealm(Db db)
+    {
+        if (!db.Realms.Any(r => r.Id == _realmId))
+        {
+            db.Realms.Add(new() { Id = _realmId, Slug = "test-realm", Name = "Test Realm" });
+            db.SaveChanges();
+        }
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task Create(bool allowClientCredentialsFlow)
+    {
+        // Setup
+        DateTime now = DateTime.UtcNow;
+        _clock.UtcNow().Returns(now);
+
+        Client val;
+        await using (var db = _dbFixture.CreateDbContext())
+        {
+            // Act
+            ClientService sut = new(db, _encryptionService, _clock);
+            var response = await sut.Create(
+                _realmId,
+                new ClientCreateRequest
+                {
+                    ClientId = "test-client",
+                    Name = "Test Client",
+                    Description = "A test client",
+                    AllowClientCredentialsFlow = allowClientCredentialsFlow,
+                },
+                TestContext.Current.CancellationToken);
+
+            // Verify
+            val = ResultAssert.Success(response);
+            Assert.Equal(_realmId, val.RealmId);
+            Assert.Equal("test-client", val.ClientId);
+            Assert.Equal("Test Client", val.Name);
+            Assert.Equal("A test client", val.Description);
+            Assert.Equal(allowClientCredentialsFlow, val.AllowClientCredentialsFlow);
+            Assert.Equal(now, val.CreatedAt);
+        }
+
+        await using (var db = _dbFixture.CreateDbContext())
+        {
+            var dbRecord = await db.Clients
+                .Include(e => e.Secrets)
+                .SingleAsync(e => e.Id == val.Id, TestContext.Current.CancellationToken);
+
+            if (allowClientCredentialsFlow)
+                Assert.Single(dbRecord.Secrets);
+            else
+                Assert.Empty(dbRecord.Secrets);
+        }
+    }
+
+    [Theory]
+    [InlineData("existing-client", true)]
+    [InlineData("missing-client", false)]
+    public async Task GetByClientId(string clientId, bool shouldFind)
+    {
+        // Setup
+        _clock.UtcNow().Returns(DateTime.UtcNow);
+        await using (var setupContext = _dbFixture.CreateDbContext())
+        {
+            setupContext.Clients.Add(new()
+            {
+                RealmId = _realmId,
+                ClientId = "existing-client",
+                CreatedAt = DateTime.UtcNow,
+            });
+
+            await setupContext.SaveChangesAsync(TestContext.Current.CancellationToken);
+        }
+
+        await using var actContext = _dbFixture.CreateDbContext();
+        // Act
+        ClientService sut = new(actContext, _encryptionService, _clock);
+        Client? result = await sut.GetByClientId(_realmId, clientId, TestContext.Current.CancellationToken);
+
+        // Verify
+        if (shouldFind)
+            Assert.NotNull(result);
+        else
+            Assert.Null(result);
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task FindById(bool shouldFind)
+    {
+        // Setup
+        _clock.UtcNow().Returns(DateTime.UtcNow);
+        int existingId;
+        await using (var setupContext = _dbFixture.CreateDbContext())
+        {
+            Client client = new()
+            {
+                RealmId = _realmId,
+                ClientId = "find-by-id-client",
+                CreatedAt = DateTime.UtcNow,
+            };
+            setupContext.Clients.Add(client);
+            await setupContext.SaveChangesAsync(TestContext.Current.CancellationToken);
+            existingId = client.Id;
+        }
+
+        int searchId = shouldFind ? existingId : existingId + 9999;
+
+        await using var actContext = _dbFixture.CreateDbContext();
+        // Act
+        ClientService sut = new(actContext, _encryptionService, _clock);
+        Client? result = await sut.FindById(_realmId, searchId, TestContext.Current.CancellationToken);
+
+        // Verify
+        if (shouldFind)
+            Assert.NotNull(result);
+        else
+            Assert.Null(result);
+    }
+}

IdentityShroud.Core.Tests/Services/RealmServiceTests.cs

@@ -1,7 +1,8 @@
 using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Security.Keys;
 using IdentityShroud.Core.Services;
 using IdentityShroud.Core.Tests.Fixtures;
-using IdentityShroud.TestUtils.Substitutes;
 using Microsoft.EntityFrameworkCore;
 
 namespace IdentityShroud.Core.Tests.Services;
@@ -9,7 +10,7 @@ namespace IdentityShroud.Core.Tests.Services;
 public class RealmServiceTests : IClassFixture<DbFixture>
 {
     private readonly DbFixture _dbFixture;
-    private readonly IEncryptionService _encryptionService = EncryptionServiceSubstitute.CreatePassthrough();
+    private readonly IKeyService _keyService = Substitute.For<IKeyService>();
 
     public RealmServiceTests(DbFixture dbFixture)
     {
@@ -34,25 +35,37 @@ public class RealmServiceTests : IClassFixture<DbFixture>
         if (idString is not null)
             realmId = new(idString);
 
-        using Db db = _dbFixture.CreateDbContext();
-        RealmService sut = new(db, _encryptionService);
-        // Act
+        RealmCreateResponse? val;
+        await using (var db = _dbFixture.CreateDbContext())
+        {
+            _keyService.CreateKey(Arg.Any<KeyPolicy>())
+                .Returns(new RealmKey(Guid.NewGuid(), "TST", [21], DateTime.UtcNow));
+            // Act
+            RealmService sut = new(db, _keyService);
+            var response = await sut.Create(
+                new(realmId, "slug", "New realm"),
+                TestContext.Current.CancellationToken);
 
-        var response = await sut.Create(
-            new(realmId, "slug", "New realm"),
-            TestContext.Current.CancellationToken);
+            // Verify
+            val = ResultAssert.Success(response);
+            if (realmId.HasValue)
+                Assert.Equal(realmId, val.Id);
+            else
+                Assert.NotEqual(Guid.Empty, val.Id);
 
-        // Verify
-        RealmCreateResponse val = ResultAssert.Success(response);
-        if (realmId.HasValue)
-            Assert.Equal(realmId, val.Id);
-        else
-            Assert.NotEqual(Guid.Empty, val.Id);
+            Assert.Equal("slug", val.Slug);
+            Assert.Equal("New realm", val.Name);
 
-        Assert.Equal("slug", val.Slug);
-        Assert.Equal("New realm", val.Name);
+            _keyService.Received().CreateKey(Arg.Any<KeyPolicy>());
+        }
 
-        // TODO verify data has been stored!
+        await using (var db = _dbFixture.CreateDbContext())
+        {
+            var dbRecord = await db.Realms
+                .Include(e => e.Keys)
+                .SingleAsync(e => e.Id == val.Id, TestContext.Current.CancellationToken);
+            Assert.Equal("TST", dbRecord.Keys[0].KeyType);
+        }
     }
 
     [Theory]
@@ -60,7 +73,7 @@ public class RealmServiceTests : IClassFixture<DbFixture>
     [InlineData("foo", "Foo")]
     public async Task FindBySlug(string slug, string? name)
     {
-        using (var setupContext = _dbFixture.CreateDbContext())
+        await using (var setupContext = _dbFixture.CreateDbContext())
         {
             setupContext.Realms.Add(new()
             {
@@ -76,11 +89,48 @@ public class RealmServiceTests : IClassFixture<DbFixture>
             await setupContext.SaveChangesAsync(TestContext.Current.CancellationToken);
         }
 
-        using Db actContext = _dbFixture.CreateDbContext();
-        RealmService sut = new(actContext, _encryptionService);
+        await using var actContext = _dbFixture.CreateDbContext();
         // Act
+        RealmService sut = new(actContext, _keyService);
         var result = await sut.FindBySlug(slug, TestContext.Current.CancellationToken);
 
+        // Verify
         Assert.Equal(name, result?.Name);
     }
+
+    [Theory]
+    [InlineData("b0423bba-2411-497b-a5b6-c5adf404b862", true)]
+    [InlineData("65ac9dba-6d43-4fa4-b57f-133ed639fbcb", false)]
+    public async Task FindById(string idString, bool shouldFind)
+    {
+        Guid id = new(idString);
+        await using (var setupContext = _dbFixture.CreateDbContext())
+        {
+            setupContext.Realms.Add(new()
+            {
+                Id = new("b0423bba-2411-497b-a5b6-c5adf404b862"),
+                Slug = "foo",
+                Name = "Foo",
+            });
+            setupContext.Realms.Add(new()
+            {
+                Id = new("d4ffc7d0-7b2c-4f02-82b9-a74610435b0d"),
+                Slug = "bar",
+                Name = "Bar",
+            });
+            
+            await setupContext.SaveChangesAsync(TestContext.Current.CancellationToken);
+        }
+
+        await using var actContext = _dbFixture.CreateDbContext();
+        // Act
+        RealmService sut = new(actContext, _keyService);
+        Realm? result = await sut.FindById(id, TestContext.Current.CancellationToken);
+
+        // Verify
+        if (shouldFind)
+            Assert.NotNull(result);
+        else 
+            Assert.Null(result);
+    }
 }

IdentityShroud.Core.Tests/UnitTest1.cs

@@ -2,7 +2,6 @@
 using System.Text;
 using System.Text.Json;
 using IdentityShroud.Core.DTO;
-using IdentityShroud.Core.Messages;
 using Microsoft.AspNetCore.WebUtilities;
 
 namespace IdentityShroud.Core.Tests;

IdentityShroud.Core/Contracts/IClientService.cs

@@ -0,0 +1,14 @@
+using IdentityShroud.Core.Model;
+
+namespace IdentityShroud.Core.Contracts;
+
+public interface IClientService
+{
+    Task<Result<Client>> Create(
+        Guid realmId,
+        ClientCreateRequest request, 
+        CancellationToken ct = default);
+
+    Task<Client?> GetByClientId(Guid realmId, string clientId, CancellationToken ct = default);
+    Task<Client?> FindById(Guid realmId, int id, CancellationToken ct = default);
+}

IdentityShroud.Core/Contracts/IClock.cs

@@ -0,0 +1,6 @@
+namespace IdentityShroud.Core.Contracts;
+
+public interface IClock
+{
+    DateTime UtcNow();
+}

IdentityShroud.Core/Contracts/IEncryptionService.cs

@@ -3,5 +3,5 @@ namespace IdentityShroud.Core.Contracts;
 public interface IEncryptionService
 {
     byte[] Encrypt(byte[] plain);
-    byte[] Decrypt(byte[] cipher);
+    byte[] Decrypt(ReadOnlyMemory<byte> cipher);
 }

IdentityShroud.Core/Contracts/IKeyService.cs

@@ -0,0 +1,12 @@
+using IdentityShroud.Core.Messages;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Security.Keys;
+
+namespace IdentityShroud.Core.Contracts;
+
+public interface IKeyService
+{
+    RealmKey CreateKey(KeyPolicy policy);
+
+    JsonWebKey? CreateJsonWebKey(RealmKey realmKey);
+}

IdentityShroud.Core/Contracts/IRealmService.cs

@@ -1,10 +1,12 @@
 using IdentityShroud.Core.Messages.Realm;
 using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Services;
 
-namespace IdentityShroud.Core.Services;
+namespace IdentityShroud.Core.Contracts;
 
 public interface IRealmService
 {
+    Task<Realm?> FindById(Guid id, CancellationToken ct = default);
     Task<Realm?> FindBySlug(string slug, CancellationToken ct = default);
         
     Task<Result<RealmCreateResponse>> Create(RealmCreateRequest request, CancellationToken ct = default);

IdentityShroud.Core/DTO/Client/ClientCreateRequest.cs

@@ -0,0 +1,10 @@
+namespace IdentityShroud.Core.Contracts;
+
+public class ClientCreateRequest
+{
+    public required string ClientId { get; set; }
+    public string? Name { get; set; }
+    public string? Description { get; set; }
+    public string? SignatureAlgorithm { get; set; }
+    public bool? AllowClientCredentialsFlow { get; set; }
+}

IdentityShroud.Core/DTO/JsonWebKey.cs

@@ -0,0 +1,73 @@
+using System.Buffers;
+using System.Buffers.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace IdentityShroud.Core.Messages;
+
+// https://www.rfc-editor.org/rfc/rfc7517.html
+
+
+public class JsonWebKey
+{
+    [JsonPropertyName("kty")]
+    public string KeyType { get; set; } = "RSA";
+    
+    // Common values sig(nature) enc(ryption)
+    [JsonPropertyName("use")]
+    public string? Use { get; set; } = "sig"; // "sig" for signature, "enc" for encryption
+    
+    // Per standard this field is optional, commented out for now as it seems not 
+    // have any good use in an identity server. Anyone validating tokens should use
+    // the algorithm specified in the header of the token.
+    // [JsonPropertyName("alg")]
+    // public string? Algorithm { get; set; } = "RS256";
+    
+    [JsonPropertyName("kid")]
+    public required string KeyId { get; set; }
+    
+    // RSA Public Key Components
+    [JsonPropertyName("n")]
+    public string? Modulus { get; set; }
+    
+    [JsonPropertyName("e")]
+    public string? Exponent { get; set; }
+    
+    // ECdsa
+    public string? Curve { get; set; }
+    [JsonConverter(typeof(Base64UrlConverter))]
+    public byte[]? X { get; set; }
+    [JsonConverter(typeof(Base64UrlConverter))]
+    public byte[]? Y { get; set; }
+    
+    // Optional fields
+    // [JsonPropertyName("x5c")]
+    // [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    // public List<string>? X509CertificateChain { get; set; }
+    //
+    // [JsonPropertyName("x5t")]
+    // [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    // public string? X509CertificateThumbprint { get; set; }    
+}
+
+public class Base64UrlConverter : JsonConverter<byte[]>
+{
+    public override byte[] Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        // GetValueSpan gives you the raw UTF-8 bytes of the JSON string value
+        if (reader.HasValueSequence)
+        {
+            var valueSequence = reader.ValueSequence.ToArray();
+            return Base64Url.DecodeFromUtf8(valueSequence);
+        }
+        return Base64Url.DecodeFromUtf8(reader.ValueSpan);
+    }
+
+    public override void Write(Utf8JsonWriter writer, byte[] value, JsonSerializerOptions options)
+    {
+        int encodedLength = Base64Url.GetEncodedLength(value.Length);
+        Span<byte> buffer = encodedLength <= 256 ? stackalloc byte[encodedLength] : new byte[encodedLength];
+        Base64Url.EncodeToUtf8(value, buffer);
+        writer.WriteStringValue(buffer);
+    }
+}

IdentityShroud.Core/Db.cs

@@ -16,8 +16,9 @@ public class Db(
     ILoggerFactory? loggerFactory) 
     : DbContext
 {
+    public virtual DbSet<Client> Clients { get; set; }
     public virtual DbSet<Realm> Realms { get; set; }
-    public virtual DbSet<Key> Keys { get; set; }
+    public virtual DbSet<RealmKey> Keys { get; set; }
     
     protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
     {

IdentityShroud.Core/Helpers/SlugHelper.cs

@@ -1,4 +1,3 @@
-using System;
 using System.Globalization;
 using System.Security.Cryptography;
 using System.Text;

IdentityShroud.Core/IdentityShroud.Core.csproj

@@ -11,6 +11,7 @@
       <PackageReference Include="FluentResults" Version="4.0.0" />
       <PackageReference Include="FluentValidation" Version="12.1.1" />
       <PackageReference Include="jose-jwt" Version="5.2.0" />
+      <PackageReference Include="LanguageExt.Core" Version="4.4.9" />
       <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.2" />
       <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.0" />
     </ItemGroup>

IdentityShroud.Core/Model/Client.cs

@@ -1,11 +1,29 @@
-using IdentityShroud.Core.Security;
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using Microsoft.EntityFrameworkCore;
 
 namespace IdentityShroud.Core.Model;
 
+[Table("client")]
+[Index(nameof(ClientId), IsUnique = true)]
 public class Client
 {
-    public Guid Id { get; set; }
-    public string Name { get; set; }
+    [Key]
+    public int Id { get; set; }
+    public Guid RealmId { get; set; }
+    [MaxLength(40)]
+    public required string ClientId { get; set; }
+    [MaxLength(80)]
+    public string? Name { get; set; }
+    [MaxLength(2048)]
+    public string? Description { get; set; }
     
-    public string? SignatureAlgorithm { get; set; } = JsonWebAlgorithm.RS256;
+    [MaxLength(20)]
+    public string? SignatureAlgorithm { get; set; }
+    
+    public bool AllowClientCredentialsFlow { get; set; } = false;
+    
+    public required DateTime CreatedAt { get; set; }
+
+    public List<ClientSecret> Secrets { get; set; } = [];
 }

IdentityShroud.Core/Model/ClientSecret.cs

@@ -0,0 +1,15 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+
+namespace IdentityShroud.Core.Model;
+
+[Table("client_secret")]
+public class ClientSecret
+{
+    [Key]
+    public int Id { get; set; }
+    public Guid ClientId { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public DateTime? RevokedAt { get; set; }
+    public required byte[] SecretEncrypted { get; set; }
+}

IdentityShroud.Core/Model/Key.cs

@@ -1,45 +0,0 @@
-using System.ComponentModel.DataAnnotations.Schema;
-using IdentityShroud.Core.Contracts;
-
-namespace IdentityShroud.Core.Model;
-
-
-[Table("key")]
-public class Key
-{
-    private byte[] _privateKeyDecrypted = [];
-
-    public Guid Id { get; set; }
-    
-    public DateTime CreatedAt { get; set; }
-    public DateTime? DeactivatedAt { get; set; }
-
-    /// <summary>
-    /// Key with highest priority will be used. While there is not really a use case for this I know some users
-    /// are more comfortable replacing keys by using priority then directly deactivating the old key.
-    /// </summary>
-    public int Priority { get; set; } = 10;
-    
-    public byte[] PrivateKeyEncrypted
-    {
-        get;
-        set
-        {
-            field = value;
-            _privateKeyDecrypted = [];
-        }
-    } = [];
-
-    public byte[] GetPrivateKey(IEncryptionService encryptionService)
-    {
-        if (_privateKeyDecrypted.Length == 0 && PrivateKeyEncrypted.Length > 0)
-            _privateKeyDecrypted = encryptionService.Decrypt(PrivateKeyEncrypted);
-        return _privateKeyDecrypted;
-    }
-
-    public void SetPrivateKey(IEncryptionService encryptionService, byte[] privateKey)
-    {
-        PrivateKeyEncrypted = encryptionService.Encrypt(privateKey);
-        _privateKeyDecrypted = privateKey;
-    }
-}

IdentityShroud.Core/Model/Realm.cs

@@ -1,7 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 using System.ComponentModel.DataAnnotations.Schema;
 using IdentityShroud.Core.Security;
-using Microsoft.EntityFrameworkCore;
 
 namespace IdentityShroud.Core.Model;
 
@@ -20,7 +19,7 @@ public class Realm
     public string Name { get; set; } = "";
     public List<Client> Clients { get; init; } = [];
 
-    public List<Key> Keys { get; init; } = [];
+    public List<RealmKey> Keys { get; init; } = [];
 
     /// <summary>
     /// Can be overriden per client

IdentityShroud.Core/Model/RealmKey.cs

@@ -0,0 +1,22 @@
+using System.ComponentModel.DataAnnotations.Schema;
+
+namespace IdentityShroud.Core.Model;
+
+
+[Table("realm_key")]
+public record RealmKey(Guid Id, string KeyType, byte[] KeyDataEncrypted, DateTime CreatedAt)
+{
+    public Guid Id { get; private set; } = Id;
+    public string KeyType { get; private set; } = KeyType;
+    public byte[] KeyDataEncrypted { get; private set; } = KeyDataEncrypted;
+    public DateTime CreatedAt { get; private set; } = CreatedAt;
+    public DateTime? RevokedAt { get; set; }
+
+    /// <summary>
+    /// Key with highest priority will be used. While there is not really a use case for this I know some users
+    /// are more comfortable replacing keys by using priority then directly deactivating the old key.
+    /// </summary>
+    public int Priority { get; set; } = 10;
+    
+
+}

IdentityShroud.Core/Security/AesGcmHelper.cs

@@ -31,9 +31,8 @@ public static class AesGcmHelper
     //   • payload  – byte[] containing nonce‖ciphertext‖tag
     //   • returns  – the original plaintext bytes
     // --------------------------------------------------------------------
-    public static byte[] DecryptAesGcm(byte[] payload, byte[] key)
+    public static byte[] DecryptAesGcm(ReadOnlyMemory<byte> payload, byte[] key)
     {
-        if (payload == null) throw new ArgumentNullException(nameof(payload));
         if (key == null)     throw new ArgumentNullException(nameof(key));
         if (key.Length != 32) // 256‑bit key
             throw new ArgumentException("Key must be 256 bits (32 bytes) for AES‑256‑GCM.", nameof(key));
@@ -49,9 +48,9 @@ public static class AesGcmHelper
         if (payload.Length < nonceSize + tagSize)
             throw new ArgumentException("Payload is too short to contain nonce, ciphertext, and tag.", nameof(payload));
 
-        ReadOnlySpan<byte> nonce = new(payload, 0, nonceSize);
-        ReadOnlySpan<byte> ciphertext = new(payload, nonceSize, payload.Length - nonceSize - tagSize);
-        ReadOnlySpan<byte> tag = new(payload, payload.Length - tagSize, tagSize);
+        ReadOnlySpan<byte> nonce = payload.Span[..nonceSize];
+        ReadOnlySpan<byte> ciphertext = payload.Span.Slice(nonceSize, payload.Length - nonceSize - tagSize);
+        ReadOnlySpan<byte> tag = payload.Span.Slice(payload.Length - tagSize, tagSize);
 
         byte[] plaintext = new byte[ciphertext.Length];
 

IdentityShroud.Core/Security/JsonWebAlgorithm.cs

@@ -1,5 +1,3 @@
-using System.Security.Cryptography;
-
 namespace IdentityShroud.Core.Security;
 
 public static class JsonWebAlgorithm

IdentityShroud.Core/Security/Keys/IKeyProvider.cs

@@ -0,0 +1,19 @@
+using IdentityShroud.Core.Messages;
+
+namespace IdentityShroud.Core.Security.Keys;
+
+public abstract class KeyPolicy
+{
+    public abstract string KeyType { get; }
+}
+
+
+public interface IKeyProvider
+{
+    byte[] CreateKey(KeyPolicy policy);
+
+    void SetJwkParameters(byte[] key, JsonWebKey jwk);
+}
+
+
+

IdentityShroud.Core/Security/Keys/IKeyProviderFactory.cs

@@ -0,0 +1,7 @@
+namespace IdentityShroud.Core.Security.Keys;
+
+
+public interface IKeyProviderFactory
+{
+    public IKeyProvider CreateProvider(string keyType);
+}

IdentityShroud.Core/Security/Keys/KeyProviderFactory.cs

@@ -0,0 +1,17 @@
+using IdentityShroud.Core.Security.Keys.Rsa;
+
+namespace IdentityShroud.Core.Security.Keys;
+
+public class KeyProviderFactory : IKeyProviderFactory
+{
+    public IKeyProvider CreateProvider(string keyType)
+    {
+        switch (keyType)
+        {
+            case "RSA":
+                return new RsaProvider();
+            default:
+                throw new NotImplementedException();
+        }
+    }
+}

IdentityShroud.Core/Security/Keys/Rsa/RsaProvider.cs

@@ -0,0 +1,35 @@
+using System.Buffers.Text;
+using System.Security.Cryptography;
+using IdentityShroud.Core.Messages;
+
+namespace IdentityShroud.Core.Security.Keys.Rsa;
+
+public class RsaKeyPolicy : KeyPolicy
+{
+    public override string KeyType => "RSA";
+    public int KeySize { get; } = 2048;
+}
+
+public class RsaProvider : IKeyProvider
+{
+    public byte[] CreateKey(KeyPolicy policy)
+    {
+        if (policy is RsaKeyPolicy p)
+        {
+            using var rsa = RSA.Create(p.KeySize);
+            return rsa.ExportPkcs8PrivateKey();
+        }
+
+        throw new ArgumentException("Incorrect policy type", nameof(policy));
+    }
+
+    public void SetJwkParameters(byte[] key, JsonWebKey jwk)
+    {
+        using var rsa = RSA.Create();
+        rsa.ImportPkcs8PrivateKey(key, out _);
+        var parameters = rsa.ExportParameters(includePrivateParameters: false);
+
+        jwk.Exponent = Base64Url.EncodeToString(parameters.Exponent);
+        jwk.Modulus = Base64Url.EncodeToString(parameters.Modulus);
+    }
+}

IdentityShroud.Core/Services/ClientService.cs

@@ -0,0 +1,64 @@
+using System.Security.Cryptography;
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+using Microsoft.EntityFrameworkCore;
+
+namespace IdentityShroud.Core.Services;
+
+public class ClientService(
+    Db db,
+    IEncryptionService cryptor,
+    IClock clock) : IClientService
+{
+    public async Task<Result<Client>> Create(Guid realmId, ClientCreateRequest request, CancellationToken ct = default)
+    {
+        Client client = new()
+        {
+            RealmId = realmId,
+            ClientId = request.ClientId,
+            Name = request.Name,
+            Description = request.Description,
+            SignatureAlgorithm = request.SignatureAlgorithm,
+            AllowClientCredentialsFlow = request.AllowClientCredentialsFlow ?? false,
+            CreatedAt = clock.UtcNow(),
+        };
+        
+        if (client.AllowClientCredentialsFlow)
+        {
+            client.Secrets.Add(CreateSecret());
+        }
+
+        await db.AddAsync(client, ct);
+        await db.SaveChangesAsync(ct);
+
+        return client;
+    }
+
+    public async Task<Client?> GetByClientId(
+        Guid realmId,
+        string clientId, 
+        CancellationToken ct = default)
+    {
+        return await db.Clients.FirstOrDefaultAsync(c => c.ClientId == clientId && c.RealmId == realmId, ct);
+    }
+
+    public async Task<Client?> FindById(
+        Guid realmId,
+        int id, 
+        CancellationToken ct = default)
+    {
+        return await db.Clients.FirstOrDefaultAsync(c => c.Id == id && c.RealmId == realmId, ct);
+    }
+
+    private ClientSecret CreateSecret()
+    {
+        byte[] secret = RandomNumberGenerator.GetBytes(24);
+
+        return new ClientSecret()
+        {
+            CreatedAt = clock.UtcNow(),
+            SecretEncrypted = cryptor.Encrypt(secret),
+        };
+
+    }
+}

IdentityShroud.Core/Services/ClockService.cs

@@ -0,0 +1,11 @@
+using IdentityShroud.Core.Contracts;
+
+namespace IdentityShroud.Core.Services;
+
+public class ClockService : IClock
+{
+    public DateTime UtcNow()
+    {
+        return DateTime.UtcNow;
+    }
+}

IdentityShroud.Core/Services/EncryptionService.cs

@@ -20,7 +20,7 @@ public class EncryptionService : IEncryptionService
         return AesGcmHelper.EncryptAesGcm(plain, encryptionKey);
     }
 
-    public byte[] Decrypt(byte[] cipher)
+    public byte[] Decrypt(ReadOnlyMemory<byte> cipher)
     {
         return AesGcmHelper.DecryptAesGcm(cipher, encryptionKey);
     }

IdentityShroud.Core/Services/KeyService.cs

@@ -0,0 +1,51 @@
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Messages;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Security.Keys;
+
+namespace IdentityShroud.Core.Services;
+
+public class KeyService(
+    IEncryptionService cryptor,
+    IKeyProviderFactory keyProviderFactory,
+    IClock clock) : IKeyService
+{
+    public RealmKey CreateKey(KeyPolicy policy)
+    {
+        IKeyProvider provider = keyProviderFactory.CreateProvider(policy.KeyType);
+        var plainKey = provider.CreateKey(policy);
+
+        return CreateKey(policy.KeyType, plainKey);
+    }
+
+    public JsonWebKey? CreateJsonWebKey(RealmKey realmKey)
+    {
+        JsonWebKey jwk = new()
+        {
+            KeyId = realmKey.Id.ToString(),
+            KeyType = realmKey.KeyType,
+            Use = "sig",
+        };
+        
+        IKeyProvider provider = keyProviderFactory.CreateProvider(realmKey.KeyType);
+        provider.SetJwkParameters(
+            cryptor.Decrypt(realmKey.KeyDataEncrypted),
+            jwk);
+
+        return jwk;
+    }
+
+    private RealmKey CreateKey(string keyType, byte[] plainKey) =>
+        new RealmKey(
+            Guid.NewGuid(),
+            keyType,
+            cryptor.Encrypt(plainKey),
+            clock.UtcNow());
+
+    // public byte[] GetPrivateKey(IEncryptionService encryptionService)
+    // {
+    //     if (_privateKeyDecrypted.Length == 0 && PrivateKeyEncrypted.Length > 0)
+    //         _privateKeyDecrypted = encryptionService.Decrypt(PrivateKeyEncrypted);
+    //     return _privateKeyDecrypted;
+    // }
+}

IdentityShroud.Core/Services/RealmService.cs

@@ -1,8 +1,9 @@
-using System.Security.Cryptography;
 using IdentityShroud.Core.Contracts;
 using IdentityShroud.Core.Helpers;
 using IdentityShroud.Core.Messages.Realm;
 using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Security.Keys;
+using IdentityShroud.Core.Security.Keys.Rsa;
 using Microsoft.EntityFrameworkCore;
 
 namespace IdentityShroud.Core.Services;
@@ -11,8 +12,14 @@ public record RealmCreateResponse(Guid Id, string Slug, string Name);
 
 public class RealmService(
     Db db,
-    IEncryptionService encryptionService) : IRealmService
+    IKeyService keyService) : IRealmService
 {
+    public async Task<Realm?> FindById(Guid id, CancellationToken ct = default)
+    {
+        return await db.Realms
+            .SingleOrDefaultAsync(r => r.Id == id, ct);
+    }
+
     public async Task<Realm?> FindBySlug(string slug, CancellationToken ct = default)
     {
         return await db.Realms
@@ -26,9 +33,10 @@ public class RealmService(
             Id = request.Id ?? Guid.CreateVersion7(),
             Slug = request.Slug ?? SlugHelper.GenerateSlug(request.Name),
             Name = request.Name,
-            Keys = [ CreateKey() ],
         };
         
+        realm.Keys.Add(keyService.CreateKey(GetKeyPolicy(realm)));
+
         db.Add(realm);
         await db.SaveChangesAsync(ct);
         
@@ -36,25 +44,20 @@ public class RealmService(
             realm.Id, realm.Slug, realm.Name);
     }
 
+    /// <summary>
+    /// Place holder for getting policies from the realm and falling back to sane defaults when no policies have been set.
+    /// </summary>
+    /// <param name="_"></param>
+    /// <returns></returns>
+    private KeyPolicy GetKeyPolicy(Realm _) => new RsaKeyPolicy();
+    
+
     public async Task LoadActiveKeys(Realm realm)
     {
         await db.Entry(realm).Collection(r => r.Keys)
             .Query()
-            .Where(k => k.DeactivatedAt == null)
+            .Where(k => k.RevokedAt == null)
             .LoadAsync();
         
     }
-
-    private Key CreateKey()
-    {
-        using RSA rsa = RSA.Create(2048);
-
-        Key key = new()
-        {
-            Priority = 10,
-        };
-        key.SetPrivateKey(encryptionService, rsa.ExportPkcs8PrivateKey());
-
-        return key;
-    }
 }

IdentityShroud.TestUtils/Asserts/JsonObjectAssert.cs

@@ -1,6 +1,5 @@
 using System.Text.Json.Nodes;
 using System.Text.RegularExpressions;
-using Xunit;
 
 namespace IdentityShroud.TestUtils.Asserts;
 

IdentityShroud.TestUtils/Asserts/ResultAssert.cs

@@ -1,5 +1,4 @@
 using FluentResults;
-using Xunit;
 
 namespace IdentityShroud.Core.Tests;
 

IdentityShroud.TestUtils/Substitutes/EncryptionServiceSubstitute.cs

@@ -11,8 +11,8 @@ public static class EncryptionServiceSubstitute
             .Encrypt(Arg.Any<byte[]>())
             .Returns(x => x.ArgAt<byte[]>(0));
         encryptionService
-            .Decrypt(Arg.Any<byte[]>())
-            .Returns(x => x.ArgAt<byte[]>(0));
+            .Decrypt(Arg.Any<ReadOnlyMemory<byte>>())
+            .Returns(x => x.ArgAt<ReadOnlyMemory<byte>>(0).ToArray());
         return encryptionService;
     }
 }

IdentityShroud.sln.DotSettings.user

@@ -5,29 +5,34 @@
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ADebugger_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Ff9d2f95d72fa884d8b6ddefc717c56da3657fbb2d5fb683656c3589eb6587_003FDebugger_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ADeveloperExceptionPageMiddlewareImpl_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003F2b5a64a615692cae2c8f378e99676581abe4bc355bb3844bfc6c6db3d576853_003FDeveloperExceptionPageMiddlewareImpl_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AGeneratedRouteBuilderExtensions_002Eg_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003F698a85dfa04f73158f8da37069798c22c467dfc_003FGeneratedRouteBuilderExtensions_002Eg_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
+	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AGeneratedRouteBuilderExtensions_002Eg_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003F9f95c1d38311d5248a1d1324797b98c2e56789a_003FGeneratedRouteBuilderExtensions_002Eg_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AHealthCheckEndpointRouteBuilderExtensions_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F6d0f079e13da4e98881aa3e6e169c6d34f08_003F0e_003Fc2b30661_003FHealthCheckEndpointRouteBuilderExtensions_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AIAsyncDisposable_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003F7d59f4f94af72f8d3797655412cdc64435acc6454985685e415ee5fe817f_003FIAsyncDisposable_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AKeySizes_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fe6cebf5d2d92b49eb99f568415b3cd457a252cacf81d426ca4f3e94ff429daf7_003FKeySizes_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
+	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AList_00601_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003Fd2753e160c1949ef9afa6a794019cfe8d908_003Fce_003Fba21ad0a_003FList_00601_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ANamingConventionsExtensions_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Feacd26cff49d864d97bf44d3424fd383a26620b1d0c43fb1d6f115da85c655_003FNamingConventionsExtensions_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AOkOfT_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fe2a19de442f561af862af2dcad0852b7e62707a5cf194d266d1656f92bbb6d2_003FOkOfT_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003APostgreSqlBuilder_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fcdd0beaf7beaf8366c0862f34fe40da30911084d957625ab31577851ee8cae7_003FPostgreSqlBuilder_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003APostgreSqlContainer_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fc82112acf224de1d157da0309437b227be6c1ef877865c23872f49eaf9d73c_003FPostgreSqlContainer_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AResultsOfT_002EGenerated_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fff2e2c5ca93c7786ef8425ca6caf751702328924211687ce72e74fd1265e8_003FResultsOfT_002EGenerated_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
+	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ARouteGroupBuilder_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fd42b8f8feda3bfb3dc17f133a52ce45931ed5066c46a4d834c8ed46e0a6_003FRouteGroupBuilder_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
+	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AThrowHelper_002ESerialization_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003F8433b9271c0f176fb5ceb7b1c3d62e1318fe8e62b4e5d7e882952dc543fec_003FThrowHelper_002ESerialization_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ATypedResults_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fcea118513a410f660e578fe32bed95cf86457dd135e4b4632ca91eb4f7b_003FTypedResults_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
+	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AWebEncoders_002Ecs_002Fl_003A_002E_002E_003F_002E_002E_003F_002Econfig_003FJetBrains_003FRider2025_002E3_003Fresharper_002Dhost_003FSourcesCache_003Fce6b69dd397f614758bc5821136ec8af3fa22563dd657769e231f51be1fbbc_003FWebEncoders_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/dotCover/Editor/HighlightingSourceSnapshotLocation/@EntryValue">/home/eelke/.cache/JetBrains/Rider2025.3/resharper-host/temp/Rider/vAny/CoverageData/_IdentityShroud.-1277985570/Snapshot/snapshot.utdcvr</s:String>
 	<s:String x:Key="/Default/Environment/Hierarchy/Build/BuildTool/DotNetCliExePath/@EntryValue">/home/eelke/.dotnet/dotnet</s:String>
 	<s:String x:Key="/Default/Environment/Hierarchy/Build/BuildTool/CustomBuildToolPath/@EntryValue">/home/eelke/.dotnet/sdk/10.0.102/MSBuild.dll</s:String>
-	<s:String x:Key="/Default/Environment/UnitTesting/UnitTestSessionStore/Sessions/=6e5d049f_002D5af8_002D43d4_002D878d_002D591b09b1e74a/@EntryIndexedValue">&lt;SessionState ContinuousTestingMode="0" IsActive="True" Name="All tests from Solution #3" xmlns="urn:schemas-jetbrains-com:jetbrains-ut-session"&gt;
+	<s:String x:Key="/Default/Environment/UnitTesting/UnitTestSessionStore/Sessions/=92a0e31a_002D2dfa_002D4c9d_002D994b_002D2d5679155267/@EntryIndexedValue">&lt;SessionState ContinuousTestingMode="0" IsActive="True" Name="All tests from Solution" xmlns="urn:schemas-jetbrains-com:jetbrains-ut-session"&gt;
   &lt;Solution /&gt;
 &lt;/SessionState&gt;</s:String>
 	
 	
-	<s:String x:Key="/Default/Environment/UnitTesting/UnitTestSessionStore/Sessions/=a4b5fea0_002D4511_002D4f66_002D888d_002Daea8a1e4c94d/@EntryIndexedValue">&lt;SessionState ContinuousTestingMode="0" Name="All tests from Solution" xmlns="urn:schemas-jetbrains-com:jetbrains-ut-session"&gt;
-  &lt;Solution /&gt;
-&lt;/SessionState&gt;</s:String>
-	<s:String x:Key="/Default/Environment/UnitTesting/UnitTestSessionStore/Sessions/=b6b17914_002D7f7b_002D403e_002Db1eb_002D2c847c515018/@EntryIndexedValue">&lt;SessionState ContinuousTestingMode="0" Name="All tests from Solution #2" xmlns="urn:schemas-jetbrains-com:jetbrains-ut-session"&gt;
-  &lt;Solution /&gt;
-&lt;/SessionState&gt;</s:String>
+	
+	
+	
+	
+	
+	
 	
 	
 	</wpf:ResourceDictionary>