From 44741d2162021170152c10902982f107d2a8aa93 Mon Sep 17 00:00:00 2001
From: Khwezi Mngoma <khwezi@msn.com>
Date: Sun, 14 Jun 2026 11:33:04 +0200
Subject: [PATCH] Added data protection keys and cert encryption to them

---
 MidrandBookshop/MidrandBookshop.csproj |  7 ++++---
 MidrandBookshop/Program.cs             | 20 ++++++++++++++++----
 midrandbooks-uat.yml                   | 26 +++++++++++++++++++-------
 3 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/MidrandBookshop/MidrandBookshop.csproj b/MidrandBookshop/MidrandBookshop.csproj
index 2f45540..1918eb9 100644
--- a/MidrandBookshop/MidrandBookshop.csproj
+++ b/MidrandBookshop/MidrandBookshop.csproj
@@ -18,13 +18,13 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="LiteCharms.Features" Version="1.127.0" />
+    <PackageReference Include="LiteCharms.Features" Version="1.130.0" />
   </ItemGroup>
 
   <!-- UI -->
   <ItemGroup>
     <PackageReference Include="ANM.Blazored.Toast" Version="0.1.1" />
-    <PackageReference Include="LiteCharms.Features.MidrandBooks" Version="1.127.0" />
+    <PackageReference Include="LiteCharms.Features.MidrandBooks" Version="1.130.0" />
     
     <!-- Global Usings -->
     <Using Include="Blazored.Toast.Services" />
@@ -54,8 +54,9 @@
     <Using Include="Microsoft.JSInterop" />
     <Using Include="System.Globalization" />
     <Using Include="System.Security.Claims" />
-    <Using Include="Microsoft.AspNetCore.HttpOverrides" />
     <Using Include="Microsoft.Extensions.Options" />
+    <Using Include="Microsoft.EntityFrameworkCore" />
+    <Using Include="Microsoft.AspNetCore.HttpOverrides" />
     <Using Include="Microsoft.AspNetCore.Components.Authorization" />
     <Using Include="Microsoft.AspNetCore.Components.Routing" />
     <Using Include="Microsoft.AspNetCore.Components.Web" />
diff --git a/MidrandBookshop/Program.cs b/MidrandBookshop/Program.cs
index 90017df..6837eb7 100644
--- a/MidrandBookshop/Program.cs
+++ b/MidrandBookshop/Program.cs
@@ -2,25 +2,26 @@ using LiteCharms.Features.Extensions;
 using LiteCharms.Features.Mediator;
 using LiteCharms.Features.MidrandBooks.Extensions;
 using LiteCharms.Features.MidrandBooks.Payments;
+using LiteCharms.Features.Postgres;
 using MidrandBookshop.Components;
 using static LiteCharms.Features.Extensions.Quartz;
 
 var builder = WebApplication.CreateBuilder(args);
 
+builder.Services.AddAntiforgery();
+
 builder.Services.AddRazorComponents()
     .AddInteractiveServerComponents();
 
 builder.AddMonitoring();
 builder.Services.AddEndpointsApiExplorer();
 
-builder.Services.AddMediator();
-builder.Services.AddLiteCharmsWebSecurity(builder.Configuration, builder.Environment);
-
 builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(TelemetryPipelineBehavior<,>));
 builder.Services.AddScoped(typeof(IPipelineBehavior<,>), typeof(LoggingPipelineBehavior<,>));
 
 builder.Services.AddQuartzSchedulerClient(MidrandShopSchedulerName, builder.Configuration);
 
+builder.Services.AddMediator();
 builder.Services.AddEmailServices(builder.Configuration);
 builder.Services.AddEmailServiceBus();
 
@@ -28,8 +29,12 @@ builder.Services.AddHttpClient();
 builder.Services.AddScoped<CartService>();
 builder.Services.AddShopServices(includeLocalStorage: true);
 builder.Services.AddHashServices(builder.Configuration);
-builder.Services.AddSecurityApiSdk(builder.Configuration);
 builder.Services.AddPayfastServices(builder.Configuration);
+
+builder.Services.AddSecurityApiSdk(builder.Configuration);
+builder.Services.AddLiteCharmsWebSecurity(builder.Configuration);
+
+builder.Services.AddDataProtectionDatabase(builder.Configuration);
 builder.Services.AddMidrandShopDatabase(builder.Configuration);
 
 builder.Services.AddMidrandShopPostgresHealthCheck();
@@ -44,6 +49,13 @@ builder.Services.Configure<ForwardedHeadersOptions>(options =>
 
 var app = builder.Build();
 
+using var security = app.Services.CreateScope();
+{
+    var dataProtectionContext = security.ServiceProvider.GetRequiredService<DataProtectionDbContext>();
+
+    await dataProtectionContext.Database.MigrateAsync();
+}
+
 app.UseForwardedHeaders();
 app.AddSecurityEndpoints();
 
diff --git a/midrandbooks-uat.yml b/midrandbooks-uat.yml
index 11f2e49..88a3bd6 100644
--- a/midrandbooks-uat.yml
+++ b/midrandbooks-uat.yml
@@ -40,6 +40,7 @@ metadata:
 type: Opaque
 data:  
   connection-string: SG9zdD0xOTIuMTY4LjEuMTcwO0RhdGFiYXNlPW1pZHJhbmRzaG9wLWRldjtVc2VybmFtZT1taWRyYW5kc2hvcC1kZXYtdXNlcjtQYXNzd29yZD1hUFh5a0tnM3RTOWNtRDtQZXJzaXN0IFNlY3VyaXR5IEluZm89VHJ1ZQ==
+  dataprotection-connection-string: SG9zdD0xOTIuMTY4LjEuMTcwO0RhdGFiYXNlPW1pZHJhbmRzaG9wLWRldjtVc2VybmFtZT1taWRyYW5kc2hvcC1kZXYtdXNlcjtQYXNzd29yZD1hUFh5a0tnM3RTOWNtRDtQZXJzaXN0IFNlY3VyaXR5IEluZm89VHJ1ZQ==
   connection-string-quartz: SG9zdD0xOTIuMTY4LjEuMTcwO0RhdGFiYXNlPXNjaGVkdWxlci1kZXY7VXNlcm5hbWU9c2NoZWR1bGVyLWRldi11c2VyO1Bhc3N3b3JkPWtWVm1vV0tKM3h6Z1FYO1BlcnNpc3QgU2VjdXJpdHkgSW5mbz1UcnVl
   aspire-apikey: bWMzRzYzSzJqNVpPRXNpMEFqTW9qTFRYbTFLRVpGY3R6SUlqU3dEaVRHdXQ4cUdTa1B1V3d4R1AxUmJzY0pVbw==
   hasher-salt: VEdsbmFIUWdRMmhoY20xekxDQk5hV1J5WVc1a1FtOXZhM01nYldGclpTQnNiM1J6SUc5bUlHMXZibVY1SUdGdVpDQmhjbVVnWVNCemRXTmpaWE56Wm5Wc0lIWnBjbUZzSUhOMGIzSjVJR2x1SUZOdmRYUm9JRUZtY21sallRPT0=  
@@ -52,6 +53,8 @@ data:
   payfast-merchantkey: anU2bmF2bjBqY2JmMA==
   litecharms-client-clientid: bWlkcmFuZGJvb2tzLWFwaS1zY2FsZXItdWF0
   litecharms-client-clientsecret: c2VjcmV0XzBhOGRjMWY5OTA2MTU5MGE1MmIxMjcyZGIzYTE4NzFkMjc2MWM3OWZiZDA1OGIyYTk2ODkxMTAyOWU0YjIwOGE=
+  dataprotection-cert: MIIKgAIBAzCCCjYGCSqGSIb3DQEHAaCCCicEggojMIIKHzCCBFIGCSqGSIb3DQEHBqCCBEMwggQ/AgEAMIIEOAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAh9qkaVgGmz/gICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEKb2CyrUL6BTZjUF5py8BLWAggPQ7c0M6pLz8pH5B3xfcC11DeteY9ixT9hpyxYTgcBCfxxv0hunGMxoi0OZc+YGp7YEp8XSAfGd34g9xDs2TmAnwjQqVibGLGR3fpISZH20T5DHaSwgWppxeFVE7UvedixCnkwH6W9EN8cUHVd2ISVN+EhrrOJRVI6X+62uJQwq3BmY9IouuaH8dpMqmtV1xSkVd3W54goY30yZtBlP8s17lRwHXnYJRPa2Qyv0qclyTK46ktmm5eNjWhNZwYmrFgX7yxZqPw/zk2Q1f0tmE7yJpGC6xnpbPhQXxHR2X89OCB6S9hMm3uiEic01fTsaTEBIVoSwT71IZVUCa4wZaer0xS07oWQK3Yl0nu/IfmbJCk+IHRHrBMZ+uOk7EW133n+Cr48mpgr2gvCe/V3KeiDcAQYVfht7ihgME27GV6VD7Z30JmjF7DhON921zh/7NhoIiLKoIMlR1kID39M78yG4n5Xf6YdQbdWE2PTtPtBNJdk0C1vLMOcKVfm4MVnV/B4uiYZXztd0nKMD4v/kgApxDOpw/HYN5psVbAeC3Y1clpP0UsbMJ//VWPMAkpbm/GzIMHleid5rLP7UIgxxopUYOwIP6hl8wnsosOlLo09XNIARoPqANorh6x+9QlhN+58JSYILjnFnkr47EYxZHqCIzCLv1VZdmfpbQ8fKJ02LjGu9SGXsQD3qvQkvLGyegBcp3+8gXka1TiaKTOKHwy85RhH3uq1qW5fV4nxQpvV3+MlEVPRsh7FcMhSeK+66CHOCZ7JEG4JQA7ocd0UkatXksF+ds8yX02ugLX40tmFvnlDg4XXzJ1yEpHc0u+73qqC+9s56qGsm84VZ0hn7Zdc98DrXZ+U7HklZycPnvtpPwxzvlIpfDrbYbU+yj/+iriYDhFt94GzajEKsmlq9HtW8wSWg60mJoUIlz5AV/ZSwT7S8y2WplE+TMFFyg1TjOb4Jq/THpInUInfz+oQjr6w56fPdUkDW7f5+Si3YYWvVfTDgAqT7/xVvliMc8pQ7gZebzeBBjZCmV5qTLeeOphjRL9yMNwHkrVh1qW5eGvHUESgNVdU5B/m1VrctW2NPcVfXMqDg3hvfwapMlEm9LXw/bXtNfK8LJZ0fI7S8USTP8aX/BVkN/wad7V0GjLGJgq5kZTKRFqZDfIy7lH8FcUMZ22Ex0II2uv0ohAnimZtUYkBLPXRiYg4AdOV0YsP6KwU/62uUFiXx/GBmKY4AI2+qT2DcJ0umed9qW/U25H91z9iasrNvE+hXNv4tEzJew+tIYpUvK0jRqLeT1Wjbk8eprTCCBcUGCSqGSIb3DQEHAaCCBbYEggWyMIIFrjCCBaoGCyqGSIb3DQEMCgECoIIFMTCCBS0wVwYJKoZIhvcNAQUNMEowKQYJKoZIhvcNAQUMMBwECNV0zVDMR21/AgIIADAMBggqhkiG9w0CCQUAMB0GCWCGSAFlAwQBKgQQmFQv8M4PJNOzsnkTAj+KWASCBND06MB//M0VAlAOf2k8HYiTg/T3SaFxohZWia0rkyoK/bKYIghehUzSyiQ0jssCrAP/wNz+CpA3WTLXrOiDh8WX/2EjR2/jsvtTKCdbjb07JKWEQp4Q5Ho5uf1catT59dAse+IueVN94liEVEtISWNaIXh+eXpBm2ozZ8DIR4Cn3Ju4Od/oF45pHYgOGiB/kmMoAC02wMOdsVvtKoXPMYsFfw0Zjp9fL5uro6rWXDh9a6v8LKhrkHvYtsyYViE2h8o9mliTgtkjov4e6Lj6nUbEn3IyDe7mrlZ5Me27KW5fWYrjsXM9hQLvLkuUHwm6gKkUqvZygez77BIkO0kH+8Ww3oO0XLXYOHhgAl++wCLGL/BXV3+C9Gb5dvQQGkKyP7eZDKF/TF6jSzK7kGvY1Ik61AKHw1qg7NDHe6Ga3TXQ0D6Uuum/u0tZmDcljOTjVWZR/JDQknF6UNPeB9Q8F3woTixTzyuihR9vxg5ry6Wpfp3+dSut5wwn6mSWIdjvJrJa58FpMDnpZtlEEwd3h4Fva6YswsJD24TfZTXQUIiVXRZTciB9SomLp0n2okjzRZop672yxXeRCKfowxDJHSSAm8PYAF0e2x6QrewMZxQEvueC8uk6+7cjuzq8VbPFx8OAOK7liIAeGshOhMrN8Bl5v0R00ybiH8S3SSp8op/wEcAWFrhXM1epS8AyIjNRXShB3KZhNPUh8XpJH4ATXgmyInI9MVt5FYhepjj8PsBEbDTSvQN2czxi0Yabc3vqMe+q+uNoK9kXnoI8cVK0RjsWm/Cf5QANgPEUX8kcFBuZbgQ68xL1/JeX9bRX/QIS4YojQY7F4mZulHRJQhseOuMRwe2yafMgkusjBPSgD0Nmw55/kzWssYLqoocLZ08DFV7eCQgamu0SWdjeIVGmo27PnbQuLUnJMc6ncBLIrbp711NfGilCb4j77/ol1Sff3KNiphkoIc51lfHQ3QqBLZbbosRBaPxIlH8soZP8Zr1R/sGjTyth4epKIBZL6/R0iopzJcTMbrUcqrMmHIPCuYdcX+hHFhSEochSH9wJee4Bd8/T8tXmMUmBUvKTRRfHkc7s/exCfLLf8qOX23RUpkdI5ufoLQEOepROj7ekPUGyMyOxrwkCPtaaRjOpv9MKbdL6p5EBGzJ0Tlr+ztClerhgNFu9eg/5t9WaLXrl+KBThsayjzS7qZppPkxvEiSBgCFeRK863l+uW2uQnmN8m53iGLP84K2NCBPPmJ3uzp1PbH/MBwXzFnml+ojLL4BoorTmgSPThhHvLnMP11tOYkN2WAHvzP2JK1A2Zv6VMVnAOGbG+wDmqsAmQZ7BuyQrxfASqpg+HLTxqad776/zvp4zuY3JVbrlm6cT6pDn+uJG5HKFtp/pA5X9oAYnSbIDWMjRhaTLIweCblMEEMTsS95iEcobhvU6s3nTSASFIZ95RhaBHcluQ1ydNYeaZMRFWx9SPrKEUOJiz9LwiTL1jKtAtnwhrBdO6i0S7Jbb+UW4bgGr5XRrTTGJDWIL7zrw/53axCz6TKgrWK1NbcCuGKktX5wB+Vq1eQYP4V2aboabryJiAio8gFCtgA7bE0p1OWs2VcCy2zWv+UM7kZyXEye8vXj5C1CypnE+n5r36O2ZSzFmMCMGCSqGSIb3DQEJFTEWBBQ1lQ+totrkZkQb7uE6lOz/gPzqKTA/BgkqhkiG9w0BCRQxMh4wAEwAaQB0AGUAQwBoAGEAcgBtAHMARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuMEEwMTANBglghkgBZQMEAgEFAAQgAW7Ot+6j9Xu4nT7pL9rF43iOnSd5qLd+yJM5A5q2wDAECH1pO/hUEzlNAgIIAA==
+  dataprotection-password: OWlIUSMmcl41eWZYRXc=
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -104,6 +107,16 @@ spec:
             - configMapRef:
                 name: midrandbooks-config
           env:
+            - name: DataProtection__Certificate
+              valueFrom:
+                secretKeyRef:
+                  name: midrandbooks-secrets
+                  key: dataprotection-cert
+            - name: DataProtection__Password
+              valueFrom:
+                secretKeyRef:
+                  name: midrandbooks-secrets
+                  key: dataprotection-password
             - name: LiteCharmsSettings__ClientId
               valueFrom:
                 secretKeyRef:
@@ -164,6 +177,11 @@ spec:
                 secretKeyRef:
                   name: midrandbooks-secrets
                   key: connection-string
+            - name: ConnectionStrings__PostgresDataProtection
+              valueFrom:
+                secretKeyRef:
+                  name: midrandbooks-secrets
+                  key: dataprotection-connection-string
             - name: Monitoring__ApiKey
               valueFrom:
                 secretKeyRef:
@@ -173,9 +191,6 @@ spec:
             - name: data
               mountPath: /app/wwwroot/content
               subPath: bookshop-content
-            - name: shared-keys-volume
-              mountPath: /app/shared-keys
-              subPath: dataprotection-keys
           livenessProbe:
             httpGet:
               path: /health
@@ -191,10 +206,7 @@ spec:
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: midrandbooks-pvc
-        - name: shared-keys-volume
-          persistentVolumeClaim:
-            claimName: midrandbooks-pvc
+            claimName: midrandbooks-pvc        
 ---
 apiVersion: v1
 kind: Service