Class PlaintextPiiSymmetricEncryption

Namespace

SEBT.Portal.Infrastructure.Services

Assembly

SEBT.Portal.Infrastructure.dll

Plaintext-at-rest storage when EncryptAtRest is false and no key ring is configured. Does not decrypt existing AES-GCM envelopes — configure keys or enable encryption before reading ciphertext columns.

public sealed class PlaintextPiiSymmetricEncryption : IPiiSymmetricEncryption

Inheritance

object

PlaintextPiiSymmetricEncryption

Implements

IPiiSymmetricEncryption

Methods

Decrypt(string)

Requires a valid authenticated envelope produced by this service — throws PiiDecryptException on mismatch.

public string Decrypt(string storedValue)

Parameters

storedValue string

Returns

string

DecryptOrPassThroughLegacy(string?)

Converts stored column text to plaintext. Envelopes decrypt; non-envelope values are returned verbatim (migration / legacy plaintext). Throws PiiDecryptException for envelopes that decrypt but fail AEAD verification.

public string? DecryptOrPassThroughLegacy(string? storedValue)

Parameters

storedValue string

Returns

string

Encrypt(string?)

Returns null when plaintext is null or empty.

public string? Encrypt(string? plaintext)

Parameters

plaintext string

Returns

string

IsEnvelope(string?)

True when the stored value was produced by Encrypt(string?) (case-sensitive prefix).

public bool IsEnvelope(string? storedValue)

Parameters

storedValue string

Returns

bool

ReSealWithActiveEncryptor(string)

Decrypts ciphertext (IsEnvelope(string?) true), then seals it again using the configured active encryptor (key rotation / re-pack helper).

public string ReSealWithActiveEncryptor(string envelopeCiphertext)

Parameters

envelopeCiphertext string

Returns

string