Class ConditionalPiiSymmetricEncryption

Namespace

SEBT.Portal.Infrastructure.Services

Assembly

SEBT.Portal.Infrastructure.dll

Gates PiiAesGcmSymmetricEncryption behind EncryptAtRest for writes while preserving envelope decryption and legacy plaintext pass-through on reads.

public sealed class ConditionalPiiSymmetricEncryption : IPiiSymmetricEncryption

Inheritance

object

ConditionalPiiSymmetricEncryption

Implements

IPiiSymmetricEncryption

Constructors

ConditionalPiiSymmetricEncryption(PiiAesGcmSymmetricEncryption, IOptions<PiiEncryptionSettings>)

public ConditionalPiiSymmetricEncryption(PiiAesGcmSymmetricEncryption inner, IOptions<PiiEncryptionSettings> options)

Parameters

inner PiiAesGcmSymmetricEncryption

options IOptions<PiiEncryptionSettings>

Methods

Decrypt(string)

Requires a valid authenticated envelope produced by this service — throws PiiDecryptException on mismatch.

public string Decrypt(string storedValue)

Parameters

storedValue string

Returns

string

DecryptOrPassThroughLegacy(string?)

Converts stored column text to plaintext. Envelopes decrypt; non-envelope values are returned verbatim (migration / legacy plaintext). Throws PiiDecryptException for envelopes that decrypt but fail AEAD verification.

public string? DecryptOrPassThroughLegacy(string? storedValue)

Parameters

storedValue string

Returns

string

Encrypt(string?)

Returns null when plaintext is null or empty.

public string? Encrypt(string? plaintext)

Parameters

plaintext string

Returns

string

IsEnvelope(string?)

True when the stored value was produced by Encrypt(string?) (case-sensitive prefix).

public bool IsEnvelope(string? storedValue)

Parameters

storedValue string

Returns

bool

ReSealWithActiveEncryptor(string)

Decrypts ciphertext (IsEnvelope(string?) true), then seals it again using the configured active encryptor (key rotation / re-pack helper).

public string ReSealWithActiveEncryptor(string envelopeCiphertext)

Parameters

envelopeCiphertext string

Returns

string