NDM-Key-Vault 7.1.0

This package is used to connect to an HTTP endpoint (BaseUri) that returns Key Vault secrets.

The BaseUri is expected to expose:

• GET {BaseUri}/GetKey?keyName={name} returning the secret value as plain text
• POST {BaseUri}/GetKeys with a JSON array body of secret names, returning a JSON object mapping names to values

API contract (Azure Function)

This package is a client for an HTTP “Key Vault proxy” endpoint (commonly an Azure Function).

GET {BaseUri}/GetKey

• Query string: keyName (string)
• Response body: the secret value as plain text (not JSON)
• Success: 200 OK
• Failure: any non-success status code should be returned (for example 401/403, 404, 429, 5xx)

POST {BaseUri}/GetKeys

• Request body: JSON array of secret names
  • Example: ["SecretA","SecretB"]
• Response body: JSON object mapping secret names to secret values
  • Example: { "SecretA": "value", "SecretB": "value" }
• Success: 200 OK
• Failure: any non-success status code should be returned (for example 401/403, 404, 429, 5xx)

Client behavior

• Secrets are cached in-process by name (and BaseUri) for KeyVaultCacheOptions.Expiration.
• For cache misses, outbound requests are throttled by KeyVaultClientOptions.MaxConcurrentRequests.
• HTTP/timeout/deserialize failures are raised as KeyVaultClientException.
• Missing/empty secret values are raised as KeyVaultClientException (including bulk dictionary fetches).
• Caller-initiated cancellation is propagated as OperationCanceledException.

How to use the package:

services.AddNDMKeyVaultClient(o ⇒ { o.BaseUri = builder.Configuration["KeyVault:Uri"] ?? throw new InvalidOperationException("KeyVault:Uri is missing.");

o.Timeout = TimeSpan.FromSeconds(15);
o.MaxConcurrentRequests = 2; // or 4, 8 depending on behavior

});

// builder.Services.Configure<KeyVaultCacheOptions>(opt ⇒ opt.Expiration = TimeSpan.FromMinutes(60));

// Optional: configure the underlying HttpClient (for example, add auth headers) // services.AddNDMKeyVaultClient(o ⇒ { o.BaseUri = ...; }, http ⇒ http.DefaultRequestHeaders.Add("X-Api-Key", "..."));

// Recommended bulk usage (safe for typical secret names) // var secrets = await keyVaultService.GetCredentialsDictionaryAsync(new[] { "Secret1", "Secret2" }, cancellationToken);

// Temp no config console builder.Services.AddSingleton<IOptions<KeyVaultClientOptions>>( Options.Create(new KeyVaultClientOptions { BaseUri = "https://kvfunctionapp-test.azurewebsites.net/api/GetSecret", Timeout = TimeSpan.FromSeconds(15) }) );

builder.Services.AddNDMKeyVaultClient(_ ⇒ { });