TraconContentProtectionOptions

Namespace Tracon · Assembly Tracon.Core.dll

Settings for at-rest content protection.

public sealed class TraconContentProtectionOptions

Inheritance

object ← TraconContentProtectionOptions

Inherited Members

object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Remarks

Always registered, but TraconContentProtectionOptions.Enabled defaults to false: without AddContentProtection(...), nothing is encrypted and every store behaves exactly as it does today.

TraconContentProtectionOptions.Keys never carries a key’s raw material — it maps a key id to the name of another configuration key the raw value is read from at run time, the same indirection Tracon uses elsewhere for provider credentials. The example below shows both: the ContentProtection section names ContentProtectionKeys:2026-08, and that key holds the actual value — set through dotnet user-secrets, never committed to appsettings.json.

"Tracon": { "ContentProtection": {
  "Enabled": true,
  "ActiveKeyId": "2026-08",
  "Keys": { "2026-08": "ContentProtectionKeys:2026-08" }
}},
"ContentProtectionKeys": { "2026-08": "<32-byte base64 key>" }

Constructors

TraconContentProtectionOptions()

public TraconContentProtectionOptions()

Fields

SectionName

The configuration section this type binds to.

public const string SectionName = "Tracon:ContentProtection"

Field Value

string

Properties

ActiveKeyId

Gets or sets the key id new writes are protected with.

public string? ActiveKeyId { get; set; }

Property Value

string?

Remarks

Must be a key of TraconContentProtectionOptions.Keys when TraconContentProtectionOptions.Enabled is true.

Columns

Gets the set of columns protection applies to. Defaults to all of them.

public ISet<ProtectedColumn> Columns { get; }

Property Value

ISet<ProtectedColumn>

Enabled

Gets or sets a value indicating whether the content protection ring is added to the pipeline.

public bool Enabled { get; set; }

Property Value

bool

Keys

Gets the map from a key id to the name of the configuration key its raw material is read from.

public IDictionary<string, string> Keys { get; }

Property Value

IDictionary<string, string>

Remarks

An entry stays here for as long as any stored value still carries its key id — removing it makes those values unreadable (TraconException, naming the missing key id).