fix security

2026-06-21 19:53:19 +08:00
parent a37fad0e57
commit 7170b6efad
14 changed files with 422 additions and 27 deletions
@@ -2,9 +2,12 @@ public class FhirOptions
 {
    public const string Section = "Fhir";

-    /// <summary>Shared secret for integration engine authentication (interim until RBAC).</summary>
+    /// <summary>Single API key (convenience shorthand — prefer ApiKeys array for rotation).</summary>
    public string? ApiKey { get; set; }

+    /// <summary>Multiple active API keys for zero-downtime rotation. Both ApiKey and ApiKeys are checked.</summary>
+    public string[] ApiKeys { get; set; } = [];
+
    /// <summary>Identifier systems accepted for Patient.identifier (hospital MRNs).</summary>
    public string[] PatientIdentifierSystems { get; set; } =
    [