chore: init project

src/InboxIntel.Infrastructure/Security/DataProtectionTokenProtector.cs

@@ -0,0 +1,25 @@
+using InboxIntel.Application.Abstractions;
+using Microsoft.AspNetCore.DataProtection;
+using System.Text;
+
+namespace InboxIntel.Infrastructure.Security;
+
+/// <summary>
+/// Encrypts OAuth refresh tokens at rest using the ASP.NET Core Data Protection
+/// API (AES-256-CBC + HMAC). Keys are persisted to a protected key ring so
+/// tokens survive restarts. Plaintext tokens are never logged.
+/// </summary>
+public class DataProtectionTokenProtector : ITokenProtector
+{
+    private const string Purpose = "InboxIntel.OAuthRefreshToken.v1";
+    private readonly IDataProtector _protector;
+
+    public DataProtectionTokenProtector(IDataProtectionProvider provider)
+        => _protector = provider.CreateProtector(Purpose);
+
+    public byte[] Protect(string plaintext)
+        => _protector.Protect(Encoding.UTF8.GetBytes(plaintext));
+
+    public string Unprotect(byte[] ciphertext)
+        => Encoding.UTF8.GetString(_protector.Unprotect(ciphertext));
+}