Class IdentifierHasher

Namespace

SEBT.Portal.Infrastructure.Services

Assembly

SEBT.Portal.Infrastructure.dll

HMAC-SHA256 implementation of IIdentifierHasher for hashing sensitive identifiers.

public class IdentifierHasher : IIdentifierHasher

Inheritance

object

IdentifierHasher

Implements

IIdentifierHasher

Constructors

IdentifierHasher(IOptions<IdentifierHasherSettings>)

public IdentifierHasher(IOptions<IdentifierHasherSettings> options)

Parameters

options IOptions<IdentifierHasherSettings>

Methods

Hash(string?)

Hashes a plaintext identifier for storage. Input normalization is implementation-specific.

public string? Hash(string? plaintext)

Parameters

plaintext string

The plaintext identifier to hash.

Returns

string

The HMAC-SHA256 hash as a 64-character hex string, or null if input is null/whitespace.

HashForAnalytics(string?)

Hashes a value for emission to analytics tools. Skips the storage-side normalization (no trim, no dash/space stripping) and returns lowercase hex so external pipelines can reproduce the digest from a published reference algorithm. Returns null if input is null/whitespace. See docs/analytics/hashed-sebt-app-id.md for the contract.

public string? HashForAnalytics(string? plaintext)

Parameters

plaintext string

The plaintext identifier to hash.

Returns

string

The HMAC-SHA256 hash as a 64-character lowercase hex string, or null.

HashForStorage(string?)

Returns the value suitable for storage. If the value is already a stored hash (64 hex chars), returns as-is. Otherwise hashes the plaintext. Use when updating records to avoid double-hashing.

public string? HashForStorage(string? value)

Parameters

value string

Returns

string

Matches(string?, string?)

Verifies that the given plaintext produces the stored hash using constant-time comparison.

public bool Matches(string? plaintext, string? storedHash)

Parameters

plaintext string

The plaintext identifier to verify.

storedHash string

The hash stored in the database.

Returns

bool

True if the plaintext hashes to the stored hash.