Class SecretProtector

Namespace

McServerLauncher.Services

Assembly

McServerLauncher.dll

Protects small secrets (like the Playit API key) at rest, on every platform:

• Windows: DPAPI scoped to the current user, stored as "dpapi:" + base64. Only the same Windows user on the same machine can decrypt it.
• Linux/macOS: AES-256-GCM with a random per-user key kept in a file only the user can read (0600), stored as "aes:" + base64(nonce | tag | ciphertext). Both protect the settings file against other users and accidental leaks (backups, sharing the file); neither protects against malware already running as the same user — DPAPI can't either.

public static class SecretProtector

Inheritance

object

SecretProtector

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

IsProtected(string?)

True if stored is a protected blob written by us.

public static bool IsProtected(string? stored)

Parameters

stored string

Returns

bool

TryProtect(string?, out string?)

Tries to protect plain (idempotent: empty or already-protected input succeeds unchanged). Returns false when encryption fails (DPAPI unavailable, key file not writable…), leaving result as the original plaintext so the CALLER decides what to do — a secret is never silently downgraded to plaintext on disk anymore: Save(AppSettings) refuses to persist it and warns instead.

public static bool TryProtect(string? plain, out string? result)

Parameters

plain string

result string

Returns

bool

Unprotect(string)

Returns the plaintext for stored. Unprotected values pass through unchanged (legacy settings). If the blob can't be decrypted (another user/machine, missing key file, or a blob from another OS), returns empty so the app simply asks for the key again.

public static string Unprotect(string stored)

Parameters

stored string

Returns

string