Coffrify 0.2.0

Coffrify — .NET SDK

Official .NET 8+ SDK for Coffrify, encrypted file transfer infrastructure.

Pure BCL (System.Net.Http, System.Security.Cryptography, System.Text.Json). Zero NuGet runtime deps.

Install

dotnet add package Coffrify

Quickstart

using Coffrify;

var coffrify = new CoffrifyClient(Environment.GetEnvironmentVariable("COFFRIFY_API_KEY")!);

var transfer = await coffrify.Transfers.CreateAsync(
    new[] { new TransferFileInput("rapport.pdf", 1_240_000, "application/pdf") },
    expiresInHours: 72,
    maxDownloads: 10,
    password: "s3cret!");
Console.WriteLine(transfer.GetProperty("share_url").GetString());

var hook = await coffrify.Webhooks.CreateAsync(
    name: "Production hook",
    url: "https://app.example.com/hooks/coffrify",
    events: new[] { "transfer.created", "transfer.scan_infected", "workspace.payment_failed" });
Console.WriteLine($"Save this secret: {hook.GetProperty("secret").GetString()}");

Resources

Every resource is a lazily-initialized property on CoffrifyClient. Methods are async and return System.Text.Json.JsonElement (the raw decoded response).

// Programmable Confidentiality — share with a fluent policy.
var resp = await coffrify.Programmable.ShareAsync(
    new[] { new Dictionary<string, object?> { ["name"] = "ndaa.pdf", ["size"] = 1_024L } },
    new ProgrammableResource.Policy
    {
        MaxViews = 5,
        ExpiresIn = "12h",
        Geo = new[] { "FR", "DE" },
        RequirePassword = true,
    });

Webhook signature verification (ASP.NET Core)

app.MapPost("/hooks/coffrify", async (HttpRequest req) =>
{
    using var sr = new StreamReader(req.Body);
    var raw = await sr.ReadToEndAsync();
    var sig = req.Headers["X-Coffrify-Signature"].ToString();
    var v   = Webhook.Verify(raw, sig, Environment.GetEnvironmentVariable("COFFRIFY_WEBHOOK_SECRET")!);
    if (!v.Valid) return Results.BadRequest(v.Reason);

    return v.Event.GetProperty("type").GetString() switch
    {
        "transfer.downloaded" => Results.Ok(),
        _ => Results.Ok(),
    };
});

The header has the form t=<timestamp>,v1=<hmac_hex>. Verification:

1. Confirms the timestamp is within ±5 minutes (replay protection).
2. Recomputes HMAC-SHA256 in constant time (CryptographicOperations.FixedTimeEquals).

License

MIT.