VaultConnector

Handles loading and decrypting Vault backup files for fallback scenarios.

Attempts to load secrets from an encrypted backup file.

The cache dictionary to populate with loaded secrets if backup was successfully loaded, otherwise .

Helper class for retrieving X509 certificates in different environments (Windows and Linux).

Returns a in a Linux environment.

Returns a

Returns a in a Windows environment.

Returns a

Represents a connection to an Azure Key Vault, providing methods to retrieve secrets.

The client ID used for authentication with Azure Key Vault.

The name of the environment variable that holds the client secret for authentication with Azure Key Vault.

The SecretClient instance used to interact with Azure Key Vault.

Indicates whether the library has been initialized, preventing multiple initializations.

The MemoryCache instance used for caching secrets retrieved from Azure Key Vault.

Gets the expiration time for cached secrets, set to 5 minutes from the current time.

Initializes the Azure Key Vault connection with the specified environment and authentication method.

The Azure Key Vault environment to connect to. The authentication method to be used when connecting to the Azure Key Vault environment. The initialized AzureKeyVaultConnection instance.

Checks the status of the preferred Azure Key Vault server and returns an available server address.

Preferred environment. URL of available node. Thrown if no Azure Key Vault server is available in the specified environment.

Health check for Azure Key Vault servers.

The address of the Azure Key Vault server to check. if the server is reachable, otherwise .

Configures and returns a MemoryCache instance with a specified size limit.

A instance configured with a size limit of 100 MB.

Gets the value of a secret from Azure Key Vault by its name.

The name of the secret to retrieve. The value of the secret.

Gets the KeyVaultSecret object from Azure Key Vault by its name.

The name of the secret to retrieve. The object.

Generates a SecretClient using the provided tenant ID, client ID, and client secret for authentication.

The tenant ID for Azure authentication. The client ID for Azure authentication. The client secret for Azure authentication. A instance authenticated with the provided credentials.

Generates SecretClientOptions with predefined retry settings for Azure Key Vault operations.

This method configures the retry policy for Azure Key Vault operations, including delay, maximum delay, maximum retries, and retry mode.
It has exponential backoff settings to handle transient failures when communicating with Azure Key Vault. A instance with predefined retry settings.

Verifies that the AzureKeyVaultConnection has been initialized.

if the connection has been initialized, otherwise throws an . Thrown if the AzureKeyVaultConnection has not been initialized.

The timestamp of the last successful Vault token fetch, used to determine when to refresh the token.

The VaultClient instance used to connect to the Vault environment.

A thread-safe cache of secrets retrieved from Vault, keyed by their secret path.

Indicates whether the library has been initialized, preventing multiple initializations.

Indicates whether the library is currently operating in emergency backup mode.

Initializes the library to be able to connect to a given HashiCorp Vault environment.

The Vault environment to connect to. The authentication method to be used when connecting to the Vault environment. The username to be used when connecting to the Vault environment, only needed for UserPass authentication. The password to be used when connecting to the Vault environment, only needed for UserPass authentication. Thrown if the library fails to initialize the Vault connection and no backup is available.

Checks the status of the preferred HashiCorp Vault server and returns an available server address.

Preferred environment. URL of available node. Thrown if no HashiCorp Vault server is available in the specified environment.

Health check for vault servers.

The address of the HashiCorp Vault server to check. if the server is reachable, otherwise .

Generates a VaultClient to connect to a given Vault environment.

The HTTPS address of the Vault environment. The authentication method to be used when connecting to the Vault environment. The password to be used when connecting to the Vault environment, only needed for UserPass authentication. The username to be used when connecting to the Vault environment, only needed for UserPass authentication.

Gets the KV Secrets from the given path.

The path of the KV Secrets to get. The engine to mount. Default is "kv" which is the default for a KV engine, only overwrite if another KV engine contains the KV Secrets path. Returns a containing in its Result.

Gets the latest KV v1 secret values from Vault and replaces the locally cached value.

The path of the KV secret to retrieve. The KV v1 engine mount point. Defaults to kv. The latest values stored at the requested secret path.

Ensures that the library has been initialized and that the Vault token is still valid.

If running in emergency backup mode, it will not check for Vault token validity, as there is no Vault connection available. Thrown if the library has not been initialized or if the Vault token has expired and cannot be refreshed.

Creates or replaces a KV v1 secret and refreshes the locally cached value.

The path where the KV secret is stored. The secret fields to write. The KV v1 engine mount point. Defaults to kv.

Gets the KV Secrets from the given path. This is for V2 KV engines, cannot be used with V1 KV engines.

The path of the KV Secrets to get. The version of the KV Secret to get. Default is null, which pulls the latest version, only overwrite if a specific version is desired. The engine to mount. Default is "kv" which is the default for a KV engine, only overwrite if another KV engine contains the KV Secrets path. Returns a containing in its Result.

Lists the secret paths under a given path in a KV v1 engine.

The path under which to list secret paths. The KV v1 engine mount point. Defaults to kv. A list of secret paths. Thrown if the library has not been initialized or if the Vault connection is not available (e.g., in emergency backup mode).

Provides encryption and decryption utilities for Vault backup files.

Uses AES encryption with a 6-character alphanumeric key.

Derives a 256-bit AES key from a 6-character alphanumeric string.

The 6-character encryption key A byte array representing the derived key

Encrypts plaintext using AES encryption.

The plaintext to encrypt The 6-character encryption key Base64-encoded encrypted data (IV + ciphertext)

Decrypts Base64-encoded encrypted data.

The Base64-encoded encrypted data (IV + ciphertext) The 6-character encryption key The decrypted plaintext

Used to specify the authentication method when connecting to the Vault environment.

TLS based authentication method that relies on certificates located on the machine running the application.

Username and password based authentication method, mostly reserved for HashiCorp Vault.

Client secret based authentication method, mostly reserved for Azure Key Vault.

Managed identity based authentication method, mostly reserved for Azure Key Vault.

Represents a username and password combination used for UserPass authentication.

The username to authenticate with when using UserPass authentication.

The password to authenticate with when using UserPass authentication.

Used to specify the environment to connect to.

Vault environment located at CreativCompany HQ.

Vault environment located at DigitalOcean.

Used to specify the type of Vault server to connect to.

Vault server hosted by internally, integrated with HashiCorp Vault.

Vault server hosted by Microsoft Azure, integrated with Azure Key Vault.

Static class containing functionality to connect to Vault environments and retrieve Secrets, in a easy to use way tailored for CreativCompany's own setup.

Initializes the library to be able to connect to a given Vault environment. This will last the entire lifetime of the application. If connection to Vault fails, will attempt to fallback to an encrypted backup file if available.

The type of Vault server to connect to. The Vault environment the library to connect to. The authentication method to be used when connecting to the Vault environment. The username to be used when connecting to the Vault environment, only needed for UserPass authentication. The password to be used when connecting to the Vault environment, only needed for UserPass authentication.