pvNugsSecretManagerNc10Abstractions 10.0.1

pvNugsSecretManagerNc10Abstractions

pvNugsSecretManagerNc10Abstractions is the contract package for the pvWay Secret Manager architecture on .NET Core 10.

It defines the interfaces used by:

• the Secret Manager orchestration layer (caching, cross-cutting concerns)
• one provider implementation (Azure Key Vault, environment variables, HashiCorp Vault, and others)
• the consumer application that requests secrets without coupling to a specific backend

Features

• Static secret retrieval contracts
• Dynamic credential retrieval contracts (username/password + expiration)
• Database secrets support detection (rotating credentials)
• Provider-agnostic API surface
• Dictionary-based parameter model for maximum provider flexibility
• Cancellation token support on all async operations
• Rich XML documentation for IntelliSense and generated API docs

Installation

dotnet add package pvNugsSecretManagerNc10Abstractions

Package Manager Console:

Install-Package pvNugsSecretManagerNc10Abstractions

Target Framework

• .NET Core 10.0+

Core Interfaces

IPvNugsSecretManager

Consumer-facing entry point to retrieve:

• multiple static secrets (GetStaticSecretsAsync)
• a single static secret (GetStaticSecretAsync)
• a dynamic credential (GetDynamicSecretAsync)

Properties:

• SupportsDatabaseSecrets - indicates whether the implementation supports dynamic database secrets (rotating credentials)

IPvNugsSecretProvider

Provider-facing contract implemented by backend adapters (Azure, env vars, HashiCorp Vault, etc.).

Properties:

• SupportsDatabaseSecrets - indicates whether the provider supports dynamic database secrets (rotating credentials)

IPvNugsDynamicCredential

Represents short-lived access material:

• Username
• Password
• ExpirationDateUtc

Parameter Dictionary Model

All retrieval methods use:

IReadOnlyDictionary<string, string> parameters

This allows each provider to define its own contract. Examples:

• Azure provider: could require only name
• HashiCorp Vault provider: could require mountPoint, path, key, roleName

The selected provider validates the dictionary and documents required/optional keys.

Quick Start (Consumer)

var parameters = new Dictionary<string, string>
{
    ["name"] = "database-password"
};

var secret = await secretManager.GetStaticSecretAsync(parameters, cancellationToken);

Dynamic credential example:

var parameters = new Dictionary<string, string>
{
    ["name"] = "app-database"
};

var credential = await secretManager.GetDynamicSecretAsync(parameters, cancellationToken);

if (credential == null || DateTime.UtcNow >= credential.ExpirationDateUtc)
    throw new InvalidOperationException("Unable to obtain valid credentials.");

Dependency Injection Example

The abstraction package only contains contracts. Typical DI wiring is done in the implementation packages:

services.AddSingleton<IPvNugsSecretProvider, YourProviderImplementation>();
services.AddSingleton<IPvNugsSecretManager, YourSecretManagerImplementation>();

Security Guidance

• Do not log secret values or raw credential payloads
• Validate dynamic credential expiration before use
• Use secure transport/authentication to the backing secret store
• Keep provider validation strict (required keys, formats, allowed values)
• Prefer least-privilege access policies in the backend system

Architecture Overview

Three packages are typically used together:

1. pvNugsSecretManagerNc10Abstractions
2. pvNugsSecretManagerNc10
3. One provider package (Azure / Environment Variables / HashiCorp Vault / AWS)

This split keeps consumers independent from backend details while preserving extensibility.

License

MIT - see LICENSE in the repository.