feat(security): audit batch C — data posture, retention, DP keys (#22)

src/InboxIntel.Infrastructure/Retention/RetentionWorker.cs

@@ -0,0 +1,53 @@
+using InboxIntel.Infrastructure.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace InboxIntel.Infrastructure.Retention;
+
+/// <summary>
+/// Daily driver for <see cref="RetentionService"/> (AUDIT H-3). Exits immediately when both
+/// retention knobs are 0 (the default) so existing deployments see no behaviour change.
+/// </summary>
+public class RetentionWorker : BackgroundService
+{
+    private readonly IServiceScopeFactory _scopeFactory;
+    private readonly DataRetentionOptions _options;
+    private readonly ILogger<RetentionWorker> _logger;
+
+    public RetentionWorker(IServiceScopeFactory scopeFactory, IOptions<DataRetentionOptions> options, ILogger<RetentionWorker> logger)
+    {
+        _scopeFactory = scopeFactory;
+        _options = options.Value;
+        _logger = logger;
+    }
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        if (_options.PurgeTrashedAfterDays <= 0 && _options.PurgeAllAfterDays <= 0)
+        {
+            _logger.LogDebug("RetentionWorker idle: retention is disabled (all knobs 0).");
+            return;
+        }
+
+        _logger.LogInformation("RetentionWorker started; trashed>{Trashed}d, all>{All}d",
+            _options.PurgeTrashedAfterDays, _options.PurgeAllAfterDays);
+
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                using var scope = _scopeFactory.CreateScope();
+                var service = scope.ServiceProvider.GetRequiredService<RetentionService>();
+                await service.PurgeAsync(stoppingToken);
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested) { break; }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Retention purge failed; will retry next cycle.");
+            }
+            await Task.Delay(TimeSpan.FromHours(24), stoppingToken);
+        }
+    }
+}