[#22] - implement per-realm JWT secret rotation with lifecycle management#23

Merged

https-richardy merged 47 commits into

feature/22-per-realm-secret-rotation

Apr 24, 2026

Commits on Apr 21, 2026

feature(#22): this commit introduces realm-id and expiration dates to the secret class to support per-realm secrets and key rotation
https-richardy
committed
feature(#22): this commit includes filtering classes to simplify the creation and configuration of filters related to secrets. This improves the flexibility and reusability of filtering criteria wi…
https-richardy
committed
feature(#22): this commit introduces the `secret` class with field constants in `documents.cs`
https-richardy
committed
feature(#22): this commit introduces secret filters stage for dynamic secret filtering, allowing dynamic filters to be applied in MongoDB pipelines for the secret entity
https-richardy
committed
refactor(#22): this commit refactors the secrets collection with filters and counts, updates the constructor to accept a realm provider, and implements aggregation pipelines in MongoDB for searchin…
https-richardy
committed
refactor(#22): this commit introduces static properties, making it easier to create standard or custom filter instances.
https-richardy
committed
feature(#22): Implements secret rotation by introducing the secret rotation service interface and implementation to manage the secret lifecycle (creation, rotation, deletion) with expiration logic …
https-richardy
committed
feature(#22): this commit renames the “for realm” method to “with realm”
https-richardy
committed
feature(#22): this commit includes the registration of the key rotation service with a transient lifetime
https-richardy
committed
feature(#22): this commit removes the initial secrets extension; secrets are no longer generated automatically during service configuration, as this is now done per realm and during realm creation.
https-richardy
committed
refactor(#22): this commit adjusts the filter classes
https-richardy
committed
feature(#22): this commit implements “prune secrets” in the secret rotation interface and service, allowing you to remove all secrets from a realm.
https-richardy
committed
feature(#22): this commit implements a background key rotation service that performs key rotation, validation, and secret cleanup for all realms every 24 hours, using parallel processing and logs f…
https-richardy
committed
feature(#22): this commit updates well known controller to include realm in route and enhance response handling for JWKS endpoints
https-richardy
committed
feature(#22): this commit updates secret handling in authentication tests to include realm association and expiration dates
https-richardy
committed
feature(#22): this commit introduces realm property in records classes
https-richardy
committed
feature(#22): this commit introduces can validate filter to secret filters
https-richardy
committed
feature(#22): this commit introduces "workers" namespace to usings for improved organization
https-richardy
committed
feature(#22): enhance JWT authentication to resolve signing keys based on realm and secret filters
https-richardy
committed
feature(#22): this commit introduces workers extension to register "key rotation background service"
https-richardy
committed
refactor(#22): this commit updates method to accept IReadOnlyCollection of secrets
https-richardy
committed
feature(#22): this commit updates token validation to support multiple public keys and enhance private key retrieval logic
https-richardy
committed
feature(#22): this commit updates handler to include realm collection and enhance secret retrieval logic
https-richardy
committed
feature(#22): this commit update endpoint tests to include 'master' prefix in url requests
https-richardy
committed
feature(#22): this commit updates method to include realm for JWKS URI generation
https-richardy
committed
feature(#22): this commit updates handler to include realm collection and enhance configuration retrieval logic
https-richardy
committed
feature(#22): this commit refactor to include secret rotation service and ensure secret exists during realm creation
https-richardy
committed
feature(#22): this commit removes the private `scope factory` field and directly uses the `scope factory` parameter in the constructor and in internal references.
https-richardy
committed
tests(#22): this commit introduces tests for signature key rotation
https-richardy
committed
feature(#22): this commit updates the secret expiration logic
https-richardy
committed
feature(#22): this commit adds end-to-end tests for key rotation and key purging
https-richardy
committed
feature(#22): this commit makes System.Text.Json a global using statement in the project
https-richardy
committed
feature(#22): this commit introduces a handler to retrieve secrets from the realm
https-richardy
committed
feature(#22): this commit introduces a “secret mapper” with an extension method to convert domain objects
https-richardy
committed
feature(#22): this commit introduces the schemes for retrieving secrets from a realm
https-richardy
committed
feature(#22): this commit introduces the “secret scheme” class for secret management to represent secret information and its expiration dates.
https-richardy
committed
feature(#22): this commit includes new “global using” directives that make it easier to use types from this namespace throughout the project.
https-richardy
committed
feature(#22): this commit introduces validation to ensure that the realm exists before fetching secrets.
https-richardy
committed
feature(#22): this commit introduces an endpoint to list secrets in a realm, allowing you to retrieve secrets from a specific realm with the appropriate authorization.
https-richardy
committed
feature(#22): this commit introduces a handler for rotating realm secrets to rotate the secrets of a specific realm, using the rotation service and validating the realm's existence.
https-richardy
committed
feature(#22): this commit introduces an endpoint for rotating realm secrets
https-richardy
committed
feature(#22): secrets are now sorted by the `created at` field in descending order before being converted to the response format, ensuring that the most recent ones are returned first.
https-richardy
committed

Commits on Apr 24, 2026

feature(#22): thiss commit updates CHANGELOG for 4.1.0 release, adding per-realm key rotation and realm-specific .well-known endpoints
https-richardy
committed