AppSurface Search
Section API Reference
API Reference Language: C# Component: Config Audience: developer

GoogleSecretManager

Type

GoogleSecretManagerClientAdapter

Source

Default IAppSurfaceGoogleSecretManagerClient backed by Google Cloud Secret Manager.

Remarks

The default constructor creates the Google client lazily so applications that register the provider but do not resolve Google-backed keys avoid opening Secret Manager transport during service registration.

Type

AppSurfaceGoogleSecretManagerOptionsValidator

Source

Validates AppSurfaceGoogleSecretManagerOptions before provider lookup.

Type

AppSurfaceGoogleSecretConvention

Source

Describes a scoped convention resolver for Google Secret Manager mappings.

Parameters

  • LogicalKeyPrefixThe logical-key prefix this convention may claim.
  • SecretIdPrefixThe optional prefix prepended to normalized secret ids.
  • VersionThe optional version or alias used by this convention.
Type

AppSurfaceGoogleSecretMapping

Source

Maps one AppSurface logical configuration key to a Google Secret Manager secret.

Parameters

  • LogicalKeyThe logical AppSurface configuration key.
  • SecretIdOrResourceNameA short secret id or full Secret Manager version resource name.
  • VersionThe optional version or alias for short secret ids.
Type

AppSurfaceGoogleSecretManagerModule

Source

Registers the AppSurface Google Secret Manager configuration provider.

Type

GoogleSecretManagerConfigResolution<T>

Source

Describes a typed Google Secret Manager configuration resolution.

Type Parameters

  • TThe requested configuration type.
Method

Unclaimed

GoogleSecretManagerConfigResolution<T> Unclaimed() Source

Creates an unclaimed resolution.

Returns

An unclaimed resolution.

Method

Found

GoogleSecretManagerConfigResolution<T> Found(T? value, string source) Source

Creates a found resolution.

Parameters

  • valueThe converted value.
  • sourceThe source name.

Returns

A found resolution.

Method

Failed

GoogleSecretManagerConfigResolution<T> Failed(GoogleSecretManagerResultStatus status, ConfigProviderTerminalDiagnostic diagnostic, string source) Source

Creates a failed claimed-key resolution.

Parameters

  • statusThe failed status.
  • diagnosticThe display-safe diagnostic.
  • sourceThe source name.

Returns

A failed resolution.

Property

Status

GoogleSecretManagerResultStatus Status { get; } Source

Gets the resolution status.

Property

Value

T? Value { get; } Source

Gets the converted value when Status is GoogleSecretManagerResultStatus.Found.

Property

Diagnostic

ConfigProviderTerminalDiagnostic? Diagnostic { get; } Source

Gets the display-safe terminal diagnostic when resolution failed for a claimed key.

Property

Source

string? Source { get; } Source

Gets the provider source name.

Type

ServiceCollectionGoogleSecretManagerExtensions

Source

Provides service collection helpers for AppSurface Google Secret Manager.

Method

ConfigureAppSurfaceGoogleSecretManager

IServiceCollection ConfigureAppSurfaceGoogleSecretManager(this IServiceCollection services, Action<AppSurfaceGoogleSecretManagerOptions> configure) Source

Configures Google Secret Manager options.

Parameters

  • servicesThe service collection to configure.
  • configureThe options callback.

Returns

The original service collection.

Method

UseAppSurfaceGoogleSecretManagerClient

2 overloads
IServiceCollection UseAppSurfaceGoogleSecretManagerClient<TClient>(this IServiceCollection services) Source

Replaces the Google Secret Manager client seam.

Type Parameters

  • TClientThe client implementation type.

Parameters

  • servicesThe service collection to configure.

Returns

The original service collection.

IServiceCollection UseAppSurfaceGoogleSecretManagerClient(this IServiceCollection services, IAppSurfaceGoogleSecretManagerClient client) Source

Replaces the Google Secret Manager client seam with a specific instance.

Parameters

  • servicesThe service collection to configure.
  • clientThe client instance.

Returns

The original service collection.

Type

IAppSurfaceGoogleSecretManagerClient

Source

Reads Secret Manager version payloads for the AppSurface Google Secret Manager provider.

Method

AccessSecretVersion

AppSurfaceGoogleSecretPayload AccessSecretVersion(string resourceName, TimeSpan timeout) Source

Accesses one Secret Manager version.

Parameters

  • resourceNameThe full Secret Manager version resource name.
  • timeoutThe bounded lookup timeout.

Returns

The secret version payload.

Type

AppSurfaceGoogleSecretPayload

Source

Carries one Google Secret Manager version payload.

Parameters

  • DataThe raw payload bytes.
  • ResolvedResourceNameThe resolved Secret Manager version resource name, if available.

Remarks

Record equality compares Data by array reference, not by content, because byte[] does not override equality. Compare payload contents explicitly when byte identity matters.

Enum

GoogleSecretManagerResultStatus

Source

Classifies Google Secret Manager configuration resolution outcomes.

Type

GoogleSecretManagerConfigProvider

Source

AppSurface configuration provider that resolves claimed keys from Google Secret Manager.

Remarks

The provider sits above LocalSecrets and file configuration but below environment variables. Only explicitly mapped or convention-claimed keys are owned by this provider; unclaimed keys fall through. Claimed-key failures are terminal when fail-closed behavior is enabled.

Method

ResolveValue

GoogleSecretManagerConfigResolution<T> ResolveValue<T>(string environment, string key) Source

Resolves a value and returns the structured provider status before config-provider adaptation.

Type Parameters

  • TThe requested configuration value type.

Parameters

  • environmentThe AppSurface environment being resolved.
  • keyThe logical AppSurface configuration key.

Returns

The typed Google Secret Manager resolution.

Type

AppSurfaceGoogleSecretManagerOptions

Source

Configures the AppSurface Google Secret Manager provider.

Remarks

Keys are claimed explicitly by MapSecret or by an opt-in convention resolver. Claimed keys fail closed by default when Google Secret Manager cannot safely return the value. Environment variables still remain the top AppSurface emergency override because DefaultConfigManager checks them before normal providers.

Method

AllowLatest

AppSurfaceGoogleSecretManagerOptions AllowLatest() Source

Allows use of the mutable latest Secret Manager version alias.

Returns

The same options instance.

Method

MapSecret

AppSurfaceGoogleSecretManagerOptions MapSecret(string logicalKey, string secretIdOrResourceName, string? version = null) Source

Maps an AppSurface logical configuration key to a Google Secret Manager secret id or full version resource name.

Parameters

  • logicalKeyThe logical AppSurface configuration key, for example Stripe:ApiKey.
  • secretIdOrResourceNameA short secret id or full projects/.../secrets/.../versions/... name.
  • versionThe version or alias for short secret ids. Overrides DefaultVersion.

Returns

The same options instance.

Method

EnableConventionResolver

AppSurfaceGoogleSecretManagerOptions EnableConventionResolver(string logicalKeyPrefix, string secretIdPrefix = "", string? version = null) Source

Enables a scoped convention resolver for logical keys under logicalKeyPrefix.

Parameters

  • logicalKeyPrefixThe required logical-key prefix that the convention may claim.
  • secretIdPrefixAn optional prefix prepended to normalized secret ids.
  • versionThe version or alias used by claimed convention keys.

Returns

The same options instance.

Property

ProjectId

string? ProjectId { get; set; } Source

Gets or sets the Google Cloud project id used for short secret ids.

Property

DefaultVersion

string? DefaultVersion { get; set; } Source

Gets or sets the default secret version used by mappings that do not specify one.

Remarks

Keep this unset for production unless every mapping supplies its own version or alias. Set AllowLatestVersion before using latest; mutable latest is an explicit opt-in, not the silent production default.

Property

AllowLatestVersion

bool AllowLatestVersion { get; set; } Source

Gets or sets a value indicating whether the mutable latest version alias is allowed.

Property

FailClosedOnProviderFailure

bool FailClosedOnProviderFailure { get; set; } Source

Gets or sets a value indicating whether claimed-key failures should stop lower-priority providers.

Property

LookupTimeout

TimeSpan LookupTimeout { get; set; } Source

Gets or sets the bounded timeout for one Secret Manager lookup.

Property

CacheTtl

TimeSpan? CacheTtl { get; set; } Source

Gets or sets the optional in-memory cache duration for successful secret values.

Remarks

Leave unset for strict read-through behavior. When enabled, rotation is visible after this duration or after the app rebuilds the provider. The provider does not run background refresh.

Property

Mappings

IReadOnlyList<AppSurfaceGoogleSecretMapping> Mappings { get; } Source

Gets explicit logical-key to Secret Manager mappings.

Property

Conventions

IReadOnlyList<AppSurfaceGoogleSecretConvention> Conventions { get; } Source

Gets opt-in convention resolvers.