swaters86

MyCompany.MyProduct.Api/
├── Features/                                        # Vertical slices grouped by business capability (preferred over Layers)
│   ├── Billing/                                     # Business feature area: billing transactions, adjustments, etc.
│   │   ├── CreateBillingTransaction/                # Single use case slice (Command)
│   │   │   ├── CreateBillingTransactionCommand.cs   # MediatR request (input for the use case)
│   │   │   ├── CreateBillingTransactionValidator.cs # FluentValidation/input validation for command
│   │   │   ├── CreateBillingTransactionHandler.cs   # Use case logic; calls repo/db abstractions, maps result
│   │   │   ├── CreateBillingTransactionRequest.cs   # API request model (controller-facing model) if separate from command
│   │   │   ├── CreateBillingTransactionResponse.cs  # API response model / DTO for endpoint response
│   │   │   └── Sql/                                 # SQL for this use case if feature-specific

swaters86

// MtlsEnrollmentClient.Csr.Production.Net10.cs
// .NET 10 Worker Service helper (CSR-based enrollment, production-upgraded)
//
// Features:
//  - Generates private key locally and creates CSR (PKCS#10)
//  - Sends CSR + enrollment code to API /enroll/csr
//  - Installs returned signed cert and associates with local private key
//  - mTLS HttpClient creation
//  - Renewal via /cert/renew/csr using mTLS + fresh CSR
//  - Thumbprint + DeviceId persisted in HKLM registry using DPAPI

swaters86

// MtlsEnrollmentClient.Net10.cs
// .NET 10 Worker Service helper for enrollment + mTLS API calls
//
// Implements:
//  - EnsureClientCertificateInstalledAsync(enrollmentCode)
//  - CreateMtlsHttpClient()
//  - TryRenewCertificateAsync()
//
// Notes:
//  - Looks up cert in LocalMachine\My using a subject marker (e.g. "OU=tenant_demo_001").

swaters86

// MtlsEnrollmentClient.cs - .NET Framework 4.8 / C# 7.3
// Drop into your Windows Service project.
// NO DataContract/DataMember required.
//
// References needed (Framework built-ins):
// - System.Net.Http
// - System.Web.Extensions  (for JavaScriptSerializer)
// - System.Security
//
// Implements:

swaters86

// MtlsEnrollmentClient.cs - .NET Framework 4.8 / C# 7.3
// Drop into your Windows Service project.
// Implements:
//  - EnsureClientCertificateInstalledAsync(enrollmentCode) -> installs client cert if missing
//  - CreateMtlsHttpClient() -> HttpClient that automatically presents the client cert (mTLS)
//  - TryRenewCertificateAsync() -> rotate cert using /cert/renew
//
// Storage:
//  - Certificate is stored in LocalMachine\My and private key is marked non-exportable when imported.
//  - You should run your service under a dedicated service account and lock down private key ACLs.

swaters86

// Program.cs - .NET 10 Minimal API (Aspire-hosted)
// Implements:
//  - POST /enroll  (enrollment code -> returns client cert PFX + password)
//  - POST /cert/renew (mTLS -> rotates/renews cert)
//  - GET /phi/ping (mTLS protected example)
// Notes:
//  - This assumes TLS terminates at this API (Kestrel) so HttpContext.Connection.ClientCertificate is present.
//  - Replace the in-memory stores with DB/Dapper for real usage (tenant mapping, enrollment codes, revocation).
//  - For production: run your own internal CA OR a managed PKI; add revocation checking & chain validation.

swaters86

// DpapiRegistrySecrets.Net48.cs
// Target: .NET Framework 4.8 (C# 7.x) (Windows only)
// No NuGet needed for DPAPI on .NET Framework.

using System;
using System.Security.Cryptography;
using System.Text;
using Microsoft.Win32;

public static class DpapiRegistrySecrets

swaters86

// DpapiRegistrySecrets.cs
// Works on: .NET Framework 4.8 (C# 7.x) + .NET 10 (Aspire) ON WINDOWS.
// Notes for .NET 10:
// - This uses DPAPI via ProtectedData (Windows-only). If your .NET 10 project can't resolve ProtectedData,
//   add NuGet: System.Security.Cryptography.ProtectedData (Windows-only). Then it will compile/run on Windows.
//
// Usage is a few lines: SaveSecret(...), LoadSecret(...), ProtectToBase64(...), UnprotectFromBase64(...)

using System;
using System.Text;

swaters86

using Microsoft.Win32;

public static class SecretRegistry
{
    private const string KeyPath = @"SOFTWARE\YourCompany\Connector\Secrets";

    public static void SaveClientSecret(string secretPlaintext)
    {
        string protectedBase64 = DpapiSecretStore.ProtectToBase64(secretPlaintext);
        using (var key = Registry.LocalMachine.CreateSubKey(KeyPath, writable: true))

swaters86

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;

public static class SecretVault
{
    private static readonly string Dir =
        Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),
            "YourCompany", "YourService");