DigitalData.Core/DigitalData.Core.Security/CryptFactory.cs

using DigitalData.Core.Abstractions.Security;
using Microsoft.Extensions.Logging;
using System.Security.Cryptography;

namespace DigitalData.Core.Security
{
    public class CryptFactory : ICryptFactory
    {
        private static readonly Lazy<CryptFactory> LazyInstance = new (() => new ());

        public static CryptFactory Instance => LazyInstance.Value;

        public int KeySizeInBits { get; init; } = 2048;

        public string PbePassword { private get; init; } = Secrets.PBE_PASSWORD;

        public PbeEncryptionAlgorithm PbeEncryptionAlgorithm { get; init; } = PbeEncryptionAlgorithm.Aes256Cbc;

        public HashAlgorithmName PbeHashAlgorithmName { get; init; } = HashAlgorithmName.SHA256;

        public int PbeIterationCount { get; init; } = 100_000;

        private readonly Lazy<PbeParameters> _lazyPbeParameters;

        public PbeParameters PbeParameters => _lazyPbeParameters.Value;

        public string EncryptedPrivateKeyPemLabel { get; init; } = "ENCRYPTED PRIVATE KEY";

        public IDictionary<string, IRSADecryptor> Decryptors { get; init; }

        public IRSADecryptor this[string key] { get => Decryptors[key]; set => Decryptors[key] = value; }

        public CryptFactory(ILogger<CryptFactory>? logger = null, IDictionary<string, IRSADecryptor>? decryptors = null)
        {
            _lazyPbeParameters = new(() => new PbeParameters(PbeEncryptionAlgorithm, PbeHashAlgorithmName, PbeIterationCount));

            Decryptors = decryptors ?? new Dictionary<string, IRSADecryptor>();

            logger?.LogInformation("CryptFactory initialized. Core.Secrets version: {Version}, Created on: {CreationDate}.", Secrets.Version, Secrets.CreationDate.ToString("dd.MM.yyyy"));
        }

        public string CreateRSAPrivateKeyPem(int? keySizeInBits = null)
            => RSA.Create(keySizeInBits ?? KeySizeInBits).ExportRSAPrivateKeyPem();

        public string CreateEncryptedPrivateKeyPem(
            int? keySizeInBits = null,
            string? password = null,
            PbeEncryptionAlgorithm? pbeEncryptionAlgorithm = null,
            HashAlgorithmName? hashAlgorithmName = null,
            int? iterationCount = null)
        {
            password ??= PbePassword;

            var pbeParameters = (pbeEncryptionAlgorithm is null && hashAlgorithmName is null && iterationCount is null)
                ? new PbeParameters(
                    pbeEncryptionAlgorithm ?? PbeEncryptionAlgorithm,
                    hashAlgorithmName ?? PbeHashAlgorithmName,
                    iterationCount ?? PbeIterationCount)
                : PbeParameters;
            
            var encryptedPrivateKey = RSA.Create(keySizeInBits ?? KeySizeInBits).ExportEncryptedPkcs8PrivateKey(password.AsSpan(), pbeParameters);

            var pemChars = PemEncoding.Write(EncryptedPrivateKeyPemLabel, encryptedPrivateKey);

            return new string(pemChars);
        }

        public bool TryGetRSADecryptor(string key, out IRSADecryptor? decryptor) => _decryptors.TryGetValue(key, out decryptor);
    }
}