hexasync.dataprotection.endpoints

ASP.NET Core admin endpoints for hexasync.dataprotection. Currently the KEK self-test (MapDataProtectionSelfTest) that proves a named KEK provider (Local / AzureKeyVault) is healthy on demand — without touching the DEK keyring or real data. This package isolates the ASP.NET Core dependency; the core hexasync.dataprotection package stays HTTP-free.

It depends on no auth middleware — this package is upstream of every consumer, and hexasync.auth.middleware depends on hexasync.services.proxy (built in the same repo), so a reference here would form a repo cycle. Authorization is consumer-supplied via the configure callback: you apply your own capability gate there.

Wiring

builder.Services.AddDataProtectionSelfTestRateLimiter();   // fixed-window, 5/min per caller
// ...
app.UseRateLimiter();
app.MapDataProtectionSelfTest("/api/v3/admin/dataprotection/self-test",
    endpoint => endpoint.RequireCapability(DataProtectionCapabilities.KekSelfTest)); // consumer's auth middleware

DataProtectionCapabilities.KekSelfTest ("dataprotection:kek:self_test") is a library-owned string constant — mirror it into the consumer's capability catalog and grant it to SUPER_ADMIN.