TraconContentProtectionOptions

Namespace Tracon · Assembly Tracon.Core.dll

Settings for at-rest content protection.

public sealed class TraconContentProtectionOptions

Inheritance

object ← TraconContentProtectionOptions

Inherited Members

object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Remarks

Always registered, but TraconContentProtectionOptions.Enabled defaults to false: without AddContentProtection(...), nothing is encrypted and every store behaves exactly as it does today.

TraconContentProtectionOptions.Keys never carries a key’s raw material — it maps a key id to the name of another configuration key the raw value is read from at run time, the same indirection Tracon uses elsewhere for provider credentials. The example below shows both: the ContentProtection section names ContentProtectionKeys:2026-08, and that key holds the actual value — set through dotnet user-secrets, never committed to appsettings.json.

"Tracon": { "ContentProtection": {
  "Enabled": true,
  "ActiveKeyId": "2026-08",
  "Keys": { "2026-08": "ContentProtectionKeys:2026-08" }
}},
"ContentProtectionKeys": { "2026-08": "<32-byte base64 key>" }

Constructors

TraconContentProtectionOptions()

public TraconContentProtectionOptions()

Fields

SectionName

The configuration section this type binds to.

public const string SectionName = "Tracon:ContentProtection"

Field Value

string

Properties

ActiveKeyId

Gets or sets the key id new writes are protected with.

public string? ActiveKeyId { get; set; }

Property Value

string?

Remarks

Must be a key of TraconContentProtectionOptions.Keys when TraconContentProtectionOptions.Enabled is true.

Columns

Gets the set of columns protection applies to. Defaults to all of them.

public ISet<ProtectedColumn> Columns { get; }

Property Value

ISet<ProtectedColumn>

Remarks

In configuration, a list of ProtectedColumn names (Columns:0 = "RunInput", matched case-insensitively). A list that is present replaces the default.

An entry that is not a ProtectedColumn name — a misspelling, an empty entry, an undefined number — stops the application at startup with an Options.OptionsValidationException that names the entry as written, whether TraconContentProtectionOptions.Enabled is on or off. Such an entry used to be skipped, and the column the operator meant stayed in plain text. An undefined value added in code stops the application too; code that rewrites the set after binding replaces the configured entries.

Enabled

Gets or sets a value indicating whether the content protection ring is added to the pipeline.

public bool Enabled { get; set; }

Property Value

bool

Keys

Gets the map from a key id to the name of the configuration key its raw material is read from.

public IDictionary<string, string> Keys { get; }

Property Value

IDictionary<string, string>

Remarks

An entry stays here for as long as any stored value still carries its key id — removing it makes those values unreadable (TraconException, naming the missing key id).

An entry with an empty name stops the application at startup with an Options.OptionsValidationException that names the key id, also while TraconContentProtectionOptions.Enabled is false: an old row is still decrypted through this map after protection is turned off.