git.stella-ops.org/src/__Libraries/StellaOps.Cryptography/DefaultCryptoProvider.cs

using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Globalization;
using System.Linq;
using System.Security.Cryptography;
using static StellaOps.Localization.T;

namespace StellaOps.Cryptography;

/// <summary>
/// Default in-process crypto provider exposing password hashing capabilities.
/// </summary>
public sealed class DefaultCryptoProvider : ICryptoProvider, ICryptoProviderDiagnostics
{
    private readonly ConcurrentDictionary<string, IPasswordHasher> passwordHashers;
    private readonly ConcurrentDictionary<string, CryptoSigningKey> signingKeys;
    private static readonly HashSet<string> SupportedSigningAlgorithms = new(StringComparer.OrdinalIgnoreCase)
    {
        SignatureAlgorithms.Es256
    };

    private static readonly HashSet<string> SupportedHashAlgorithms = new(StringComparer.OrdinalIgnoreCase)
    {
        HashAlgorithms.Sha256,
        HashAlgorithms.Sha384,
        HashAlgorithms.Sha512
    };

    public DefaultCryptoProvider()
    {
        passwordHashers = new ConcurrentDictionary<string, IPasswordHasher>(StringComparer.OrdinalIgnoreCase);
        signingKeys = new ConcurrentDictionary<string, CryptoSigningKey>(StringComparer.Ordinal);

        var argon = new Argon2idPasswordHasher();
        var pbkdf2 = new Pbkdf2PasswordHasher();

        passwordHashers.TryAdd(PasswordHashAlgorithm.Argon2id.ToString(), argon);
        passwordHashers.TryAdd(PasswordHashAlgorithms.Argon2id, argon);
        passwordHashers.TryAdd(PasswordHashAlgorithm.Pbkdf2.ToString(), pbkdf2);
        passwordHashers.TryAdd(PasswordHashAlgorithms.Pbkdf2Sha256, pbkdf2);
    }

    public string Name => "default";

    public bool Supports(CryptoCapability capability, string algorithmId)
    {
        if (string.IsNullOrWhiteSpace(algorithmId))
        {
            return false;
        }

        return capability switch
        {
            CryptoCapability.PasswordHashing => passwordHashers.ContainsKey(algorithmId),
            CryptoCapability.Signing or CryptoCapability.Verification => SupportedSigningAlgorithms.Contains(algorithmId),
            CryptoCapability.ContentHashing => SupportedHashAlgorithms.Contains(algorithmId),
            _ => false
        };
    }

    public IPasswordHasher GetPasswordHasher(string algorithmId)
    {
        if (!Supports(CryptoCapability.PasswordHashing, algorithmId))
        {
            throw new InvalidOperationException(_t("crypto.provider.algorithm_not_supported", algorithmId, Name));
        }

        return passwordHashers[algorithmId];
    }

    public ICryptoHasher GetHasher(string algorithmId)
    {
        if (!Supports(CryptoCapability.ContentHashing, algorithmId))
        {
            throw new InvalidOperationException(_t("crypto.provider.hash_not_supported", algorithmId, Name));
        }

        return new DefaultCryptoHasher(algorithmId);
    }

    public ICryptoSigner GetSigner(string algorithmId, CryptoKeyReference keyReference)
    {
        ArgumentNullException.ThrowIfNull(keyReference);

        if (!Supports(CryptoCapability.Signing, algorithmId))
        {
            throw new InvalidOperationException(_t("crypto.provider.algorithm_not_supported", algorithmId, Name));
        }

        if (!signingKeys.TryGetValue(keyReference.KeyId, out var signingKey))
        {
            throw new KeyNotFoundException(_t("crypto.provider.key_not_registered", keyReference.KeyId, Name));
        }

        if (!string.Equals(signingKey.AlgorithmId, algorithmId, StringComparison.OrdinalIgnoreCase))
        {
            throw new InvalidOperationException(
                _t("crypto.provider.key_algorithm_mismatch", keyReference.KeyId, signingKey.AlgorithmId, algorithmId));
        }

        return EcdsaSigner.Create(signingKey);
    }

    public ICryptoSigner CreateEphemeralVerifier(string algorithmId, ReadOnlySpan<byte> publicKeyBytes)
    {
        if (!Supports(CryptoCapability.Verification, algorithmId))
        {
            throw new InvalidOperationException(_t("crypto.provider.verify_not_supported", algorithmId, Name));
        }

        return EcdsaSigner.CreateVerifierFromPublicKey(algorithmId, publicKeyBytes);
    }

    public void UpsertSigningKey(CryptoSigningKey signingKey)
    {
        ArgumentNullException.ThrowIfNull(signingKey);
        EnsureSigningSupported(signingKey.AlgorithmId);
        if (signingKey.Kind != CryptoSigningKeyKind.Ec)
        {
            throw new InvalidOperationException(_t("crypto.provider.ec_keys_only", Name));
        }
        ValidateSigningKey(signingKey);

        signingKeys.AddOrUpdate(signingKey.Reference.KeyId, signingKey, (_, _) => signingKey);
    }

    public bool RemoveSigningKey(string keyId)
    {
        if (string.IsNullOrWhiteSpace(keyId))
        {
            return false;
        }

        return signingKeys.TryRemove(keyId, out _);
    }

    public IReadOnlyCollection<CryptoSigningKey> GetSigningKeys()
        => signingKeys.Values.ToArray();

    public IEnumerable<CryptoProviderKeyDescriptor> DescribeKeys()
    {
        foreach (var key in signingKeys.Values)
        {
            var metadata = new Dictionary<string, string?>(StringComparer.OrdinalIgnoreCase)
            {
                ["kind"] = key.Kind.ToString(),
                ["createdAt"] = key.CreatedAt.UtcDateTime.ToString("O", CultureInfo.InvariantCulture),
                ["providerHint"] = key.Reference.ProviderHint,
                ["provider"] = Name
            };

            if (key.ExpiresAt.HasValue)
            {
                metadata["expiresAt"] = key.ExpiresAt.Value.UtcDateTime.ToString("O", CultureInfo.InvariantCulture);
            }

            foreach (var pair in key.Metadata)
            {
                metadata[$"meta.{pair.Key}"] = pair.Value;
            }

            yield return new CryptoProviderKeyDescriptor(
                Name,
                key.Reference.KeyId,
                key.AlgorithmId,
                metadata);
        }
    }

    private static void EnsureSigningSupported(string algorithmId)
    {
        if (!SupportedSigningAlgorithms.Contains(algorithmId))
        {
            throw new InvalidOperationException(_t("crypto.provider.algorithm_not_supported", algorithmId, "default"));
        }
    }

    private static void ValidateSigningKey(CryptoSigningKey signingKey)
    {
        if (!string.Equals(signingKey.AlgorithmId, SignatureAlgorithms.Es256, StringComparison.OrdinalIgnoreCase))
        {
            throw new InvalidOperationException(_t("crypto.provider.es256_only", "default"));
        }

        var expected = ECCurve.NamedCurves.nistP256;
        var curve = signingKey.PrivateParameters.Curve;
        if (!curve.IsNamed || !string.Equals(curve.Oid.Value, expected.Oid.Value, StringComparison.Ordinal))
        {
            throw new InvalidOperationException(_t("crypto.provider.p256_required"));
        }
    }
}