hexasync.dataprotection.endpoints

ASP.NET Core admin endpoints for hexasync.dataprotection. Currently the KEK self-test (MapDataProtectionSelfTest) that proves a named KEK provider (Local / AzureKeyVault) is healthy on demand — without touching the DEK keyring or real data. This package isolates the ASP.NET Core dependency; the core hexasync.dataprotection package stays HTTP-free.

It depends on no auth middleware — this package is upstream of every consumer, and hexasync.auth.middleware depends on hexasync.services.proxy (built in the same repo), so a reference here would form a repo cycle. Authorization is consumer-supplied via the configure callback: you apply your own capability gate there.

Wiring

builder.Services.AddDataProtectionSelfTestRateLimiter();   // fixed-window, 5/min per caller
// ...
app.UseRateLimiter();
app.MapDataProtectionSelfTest("/api/v3/admin/dataprotection/self-test",
    endpoint => endpoint.RequireCapability(DataProtectionCapabilities.KekSelfTest)); // consumer's auth middleware

DataProtectionCapabilities.KekSelfTest ("dataprotection:kek:self_test") is a library-owned string constant — mirror it into the consumer's capability catalog and grant it to SUPER_ADMIN.

Manual DEK rotation — the one endpoint that mutates key state

Mints a new DEK generation on demand — the on-demand counterpart to the age-based rotation the maintenance driver performs. Existing data is untouched: the previous generation is retired and retained for decrypt, and rows stay on their DEK until a force-reconcile pass moves them.

builder.Services.AddDataProtectionDekRotateRateLimiter();   // fixed-window, 5/hour per caller
// ...
app.UseRateLimiter();
app.MapDataProtectionDekRotate("/api/v3/admin/dataprotection/dek/rotate",
    endpoint => endpoint.RequireCapability(DataProtectionCapabilities.DekRotate));

Opt-in by mapping. There is no enable switch: a consumer that does not call MapDataProtectionDekRotate has no rotation route, exactly like the self-test and the two status endpoints. The call site is the switch, and it sits directly beside the capability gate that protects it, so the two cannot drift apart.

configure is required — omitting it is an ArgumentNullException, because an ungated route that mutates key state must not be constructible. dataprotection:dek:rotate is the only capability in this package that mutates key state; grant it to SUPER_ADMIN only.

POST returns { "keyId": "…" }, the new generation's id. That value is not a secret: it is stamped in the clear in every hxdp:v1.<key_id>.… blob. Nothing else is returned.

Why 5/hour and not 5/minute (the self-test's limit): the cost of a flood is not the request. Every rotation appends a keyring row, and every pod's startup warm unwraps every non-destroyed generation — one KEK call each, on every boot, forever. A burst does not fail; it quietly buys slower boots and a bigger vault bill. This bounds the burst; the capability gate is what bounds long-run growth.

If the endpoint is enabled but the library was never composed, MapDataProtectionDekRotate throws at map time — a startup failure, rather than a 500 discovered on the day someone actually needs to rotate.