Concierge.Auth.Client.Secrets 1.0.3

Concierge.Auth.Client.Secrets

Self-service credential rotation against AuthService (contract §10.3), built on top of Concierge.Auth.Client's client_credentials table.

Install and register

services.AddConciergeAuthClient(configuration, db => db.UseNpgsql(cs, npgsql =>
    npgsql.MigrationsHistoryTable("__EFMigrationsHistory", "concierge"))); // base package — required first
services.AddConciergeSecretManagement(configuration); // binds "Concierge:AuthClient:SecretRotation"

ConciergeSecretRotationOptions.HeaderName (default X-Api-Key) is the only option this package adds — everything else (AuthServiceBaseUrl, ClientKey) comes from the base package's ConciergeAuthClientOptions.

First credential (no self-registration)

There is no self-registration path (contract §10.1, invariant 1) — the first credential is always issued by an admin and delivered out-of-band by email. Import it once:

await credentialStore.ImportInitialSecretAsync(secretFromEmail, cancellationToken);

Rotation

var outcome = await rotationClient.RotateAsync(cancellationToken);
if (outcome.IsFailure)
{
    // outcome.Error.Code is one of:
    //   ROTATION_NO_ACTIVE_CREDENTIAL — nothing imported yet, admin re-issue required
    //   ROTATION_REJECTED            — 401/403 from AuthService; NEVER retry this,
    //                                   the credential is already dead (lost a
    //                                   concurrent rotation race, or was revoked)
    //   ROTATION_UNAVAILABLE         — AuthService unreachable/5xx after retries
    //   ROTATION_PERSIST_FAILED      — AuthService rotated but the local commit
    //                                   failed; the credential may be lost, admin
    //                                   re-issue required, do not retry
}

RotateAsync calls POST /client-services/v1/:clientKey/rotate with the current active secret in the configured header, then revokes the old row and inserts the new one in one database transaction. A 401/403 is never retried — contract §10 invariant 8: it means the credential is already dead, not a transient fault, and blind-retrying would hammer AuthService forever without recovering. Timeouts and 5xx get up to 3 bounded attempts; 401/403 do not.

Logging constraint

The header carrying the secret is per-client configured and cannot be statically deny-listed (contract §10.6) — this package never passes a raw header collection to any logger, and does not log at all. The raw secret is never logged, persisted in an exception message, or echoed in a Result message; only its SHA-256 fingerprint is ever surfaced.

Out of scope here

JWKS, peer public keys, middleware, profile operations, RabbitMQ — see the other extension packages.