Oleksandr Bezdieniezhnykh
3a925b9b0f
- Deleted the `POST /resources/get/{dataFolder?}` and `GET /resources/get-installer` endpoints as part of the architectural shift towards simplified resource management.
- Removed associated methods and configurations, including `ResourcesService.GetEncryptedResource`, `ResourcesService.GetInstaller`, and related properties in `ResourcesConfig`.
- Cleaned up environment variables and configuration files to reflect the removal of installer-related settings.
- Eliminated the `GetResourceRequest` DTO and its validator, along with the `WrongResourceName` error code.
- Updated documentation to clarify the changes in resource handling and the retirement of per-user file encryption.
Co-authored-by: Cursor <cursoragent@cursor.com>
1.8 KiB
Module: Azaion.Services.Security
Purpose
Static utility class providing the SHA-384 password hashing helper used by UserService.
Cycle 1 (2026-05-13) note —
GetHWHashwas deleted andGetApiEncryptionKeywas simplified from(email, password, hardwareHash)to(email, password)by AZ-197.Cycle 2 (2026-05-14) note —
GetApiEncryptionKey,EncryptTo, andDecryptTowere all removed along with the encrypted-download endpoint. OnlyToHashremains; it still backs SHA-384 password hashing inUserService(PasswordHash = request.Password.ToHash()). TheAzaion.Test/SecurityTest.csunit tests went with the removed methods, leaving theAzaion.Testproject empty (also removed from the solution). See_docs/06_metrics/retro_2026-05-14.mdonce cycle 2's retro lands.
Public Interface
| Method | Signature | Description |
|---|---|---|
ToHash |
static string ToHash(this string str) |
Extension: SHA-384 hash of input, returned as Base64 |
Internal Logic
ToHashuses SHA-384 with UTF-8 encoding, outputting Base64.
Dependencies
System.Security.Cryptography(SHA384)System.Text.Encoding
Consumers
Azaion.Services/UserService.cs—RegisterUser(password storage) andValidateUser(login comparison) both callrequest.Password.ToHash()
Data Models
None.
Configuration
None.
External Integrations
None.
Security
- Password hashing uses SHA-384 with no per-user salt and no key stretching. Not resistant to rainbow-table attacks (security audit F-7 — open). Unchanged by cycles 1 and 2.
Tests
None at the unit-test level after the Azaion.Test project was removed in cycle 2. ToHash is exercised end-to-end through every login / register e2e test (e2e/Azaion.E2E/Tests/).