Namespace SEBT.Portal.Infrastructure.Services
Classes
- AddressValidationService
Validates addresses against configurable blocked address lists and applies street name abbreviations for addresses exceeding a configurable length limit. Runs after Smarty normalization (handled by
UpdateAddressCommandHandler) so that checks operate on the canonical address form.Two blocked-address paths participate:
- The legacy inline list from BlockedAddresses, matched on normalized street alone (used for small hand-curated lists, e.g. DC's 5 entries).
- IBlockedAddressDataSource entries, matched on (normalized street + 5-digit ZIP) so that large state-wide lists can disambiguate same-street collisions across cities.
- ConditionalPiiSymmetricEncryption
Gates PiiAesGcmSymmetricEncryption behind EncryptAtRest for writes while preserving envelope decryption and legacy plaintext pass-through on reads.
- CsvBlockedAddressDataSource
Loads blocked-address entries from a CSV embedded as an assembly resource. Expected CSV columns (Salesforce export shape): OFF_ADR_L1__c, OFF_ADR_L2__c, OFF_ADR_CTY__c, OFF_ADR_PO_BOX__c, OFF_ADR_STA__c, OFF_ADR_ZIP__c.
Rows with a Line 1 value yield an entry with that street; rows with only a PO box number synthesize a "PO BOX {n}" street. ZIP+4 input is reduced to the 5-digit prefix; rows with fewer than 5 digits in the ZIP column are dropped.
The parser is a pragmatic comma-split rather than a full RFC 4180 implementation: the upstream Salesforce export does not quote fields or include embedded commas. If that ever changes, switch to a CSV library before extending this class.
- DataSeeder
Infrastructure implementation of IDataSeeder that handles database operations and mapping between domain models and entities.
- DatabaseMigrator
Implementation of IDatabaseMigrator that applies Entity Framework Core migrations.
- DisabledSocureClient
No-op implementation of ISocureClient used when Socure integration is disabled. Returns a NotConfigured result for all operations.
- EmailLookupHasher
HMAC-SHA256 over normalized-email bytes for deterministic SQL equality lookups.
- EmailOtpSenderService
Sends OTP codes via HTML email, rendering the template in the recipient's language. Translations are loaded from the EmailContent.{state}.json embedded resource, generated from the content CSVs via
pnpm copy:generate.
- EmptyBlockedAddressDataSource
Default IBlockedAddressDataSource for states that rely solely on the inline
AddressValidationData.BlockedAddresseslist (e.g., DC). Returns no entries; the legacy L1-only matcher is sufficient for small hand-curated lists.
- FeatureFlagQueryService
Service for querying feature flags. Priority order is as follows, with latest being high priority:
- appsettings.json (defaults)
- State-specific JSON (appsettings.{State}.json)
- AWS AppConfig Agent (if configured — highest priority)
- HMACSHA256Hasher
HMAC-SHA256 implementation of IHMACSHA256Hasher backed by SecretKey. Produces a lowercase hex-encoded 64-character hash of the input string. This is the underlying primitive used by state connectors that need a deterministic, keyed hash without the normalization layer of IdentifierHasher.
- HouseholdIdentifierResolver
Resolves the preferred household identifier from the authenticated user. For states that do not persist PII, phone can be resolved from the JWT only. In Development, a configured phone override (DevelopmentPhoneOverride:Phone) takes precedence over JWT/user.
- HttpSocureClient
Real HTTP implementation of ISocureClient. Calls Socure's POST /api/evaluation endpoint for both KYC assessment and DocV token generation. The Socure API returns both in a single response — see design doc for rationale.
- IdProofingService
Unified identity proofing service. Evaluates IAL requirements for resource+action pairs and determines PII visibility. Singleton lifetime — holds a volatile reference to settings that is swapped safely on config changes.
- IdentifierHasher
HMAC-SHA256 implementation of IIdentifierHasher for hashing sensitive identifiers.
- JwtTokenService
Generates portal JWTs for all authentication paths. Implements three focused interfaces — one per caller — so each entry point owns its claim resolution. A shared SEBT.Portal.Infrastructure.Services.JwtTokenService.BuildAndSignToken(System.Guid, string, System.Collections.Generic.IReadOnlyDictionary<string, string>) handles mechanical JWT construction.
- OidcExchangeService
performs the OIDC token exchange and id_token verification entirely server-side. The client secret, JWKS validation, and callback-token signing all happen here; UseCases handlers orchestrate the flow through IOidcExchangeService.
The service is stateless between requests (all flow state lives in the pre-auth session store). Inject as scoped or transient.
- OidcVerificationClaimTranslator
Translates external OIDC identity-verification claims (e.g. from PingOne/Socure) into the portal's IAL model. Determines whether the verification is still valid based on the configurable validity duration. When the configured LevelClaimName is missing, empty, or not a recognized level, the translator tries FallbackLevelClaimName unless it duplicates
LevelClaimName. Likewise for verification date via FallbackDateClaimName
- OidcVerificationResult
Result of translating OIDC verification claims into the portal's IAL model.
- OtpGeneratorService
Service responsible for generating One-Time Passwords (OTP).
- OutagePageStateResolver
Default IOutagePageStateResolver: schedule wins per-surface when windows targeting that surface exist; otherwise the surface's manual feature flag decides.
- OutageScheduleEvaluator
Evaluates the configured OutageScheduleSettings against the current time so the outage page can auto-enable during scheduled (state-backend) maintenance windows without a manual flag toggle. Windows apply per-surface via Target. Reads the schedule via Microsoft.Extensions.Options.IOptionsMonitor<TOptions> so AWS AppConfig updates take effect without a redeploy.
Startup validation rejects an unknown timezone, an unparseable window, and an unrecognized target, so none of those should reach this class. The checks below remain as a backstop and log at Error: reaching one means validation was bypassed, and the feature-flag endpoints must keep answering either way. Both methods share OutageWindowParsing with the validator, so their notion of a well-formed window cannot drift apart.
- PassThroughAddressVerificationService
When Smarty is disabled, performs trimming/ZIP formatting and enforces AddressValidationPolicySettings (e.g. General Delivery) without calling an external API.
- PiiAesGcmSymmetricEncryption
AEAD envelopes for reversible PII: AES-GCM / 96-bit nonce / 128-bit tag. Format is stable + versioned (EnvelopePrefix).
- PiiPlaintextEncryptionBackfill
Migrates plaintext-at-rest (or ciphertext lacking the email MAC column) into authenticated AES-GCM envelopes. Executes after EF migrations — idempotent skips rows that already have coherent ciphertext.
- PiiSymmetricEncryptionFactory
Selects reversible PII crypto: AES-GCM when EncryptAtRest (requires keys), optional AES read support when encryption is off but keys remain configured, or plaintext-only when off and keyless.
- PlaintextPiiSymmetricEncryption
Plaintext-at-rest storage when EncryptAtRest is false and no key ring is configured. Does not decrypt existing AES-GCM envelopes — configure keys or enable encryption before reading ciphertext columns.
- SelfServiceEvaluator
Evaluates self-service action permissions from SelfServiceRulesSettings. Uses permissive aggregation: if any application in the household is eligible, the action is allowed.
- SmartyAddressVerificationDiagnostics
Exercises SmartyAddressVerificationService against canned HTTP outcomes. Constructs the real service with a fake System.Net.Http.HttpMessageHandler that replays the requested response (or throws a transport failure), so the service's error handling and logging run without any network activity.
- SmartyAddressVerificationService
Calls Smarty US Street Address API to validate and normalize US mailing addresses.
- SmtpClientService
Service for sending emails using SMTP protocol.
- StubSocureClient
Stub implementation of ISocureClient for development and testing. Returns deterministic data without making HTTP calls. Swapped for the real HTTP client when Socure credentials are available.
Interfaces
- IAddressVerificationDiagnostics
Runs address verification against simulated Smarty outcomes so diagnostic endpoints can exercise the verification service's error-handling and logging paths without any network activity.
- IDatabaseMigrator
Service for applying database migrations.
- IOutageScheduleEvaluator
Decides whether the current time falls within a configured outage window so the outage page can auto-enable during scheduled maintenance. Windows are evaluated per-surface via their Target.