AES

Libraries/Esiur/Resource/Attributes/AuditingManagerAttribute.cs

@@ -0,0 +1,13 @@
+using Esiur.Security.Management;
+using System;
+
+namespace Esiur.Resource;
+
+/// <summary>
+/// Associates a registered auditing-manager implementation with a resource type.
+/// </summary>
+[AttributeUsage(AttributeTargets.Class, AllowMultiple = true, Inherited = true)]
+public sealed class AuditingManagerAttribute<T> : Attribute
+    where T : IAuditingManager
+{
+}

Libraries/Esiur/Resource/Attributes/PermissionsManagerAttribute.cs

@@ -0,0 +1,13 @@
+using Esiur.Security.Permissions;
+using System;
+
+namespace Esiur.Resource;
+
+/// <summary>
+/// Associates a registered permissions-manager implementation with a resource type.
+/// </summary>
+[AttributeUsage(AttributeTargets.Class, AllowMultiple = true, Inherited = true)]
+public sealed class PermissionsManagerAttribute<T> : Attribute
+    where T : IPermissionsManager
+{
+}

Libraries/Esiur/Resource/Attributes/RateControlManagerAttribute.cs

@@ -0,0 +1,13 @@
+using Esiur.Security.Management;
+using System;
+
+namespace Esiur.Resource;
+
+/// <summary>
+/// Associates a registered rate-control-manager implementation with a resource type.
+/// </summary>
+[AttributeUsage(AttributeTargets.Class, AllowMultiple = true, Inherited = true)]
+public sealed class RateControlManagerAttribute<T> : Attribute
+    where T : IRateControlManager
+{
+}

Libraries/Esiur/Resource/Warehouse.cs

@@ -30,6 +30,7 @@ using Esiur.Net.Packets;
 using Esiur.Protocol;
 using Esiur.Proxy;
 using Esiur.Security.Authority;
+using Esiur.Security.Cryptography;
 using Esiur.Security.Permissions;
 using Esiur.Security.RateLimiting;
 using Org.BouncyCastle.Asn1.Cms;
@@ -88,6 +89,8 @@ public class Warehouse
 
 
     Map<string, IAuthenticationProvider> _authenticationProviders = new Map<string, IAuthenticationProvider>();
+    readonly ConcurrentDictionary<string, IEncryptionProvider> _encryptionProviders
+        = new ConcurrentDictionary<string, IEncryptionProvider>(StringComparer.Ordinal);
     List<IPermissionsManager> _permissionsManagers = new List<IPermissionsManager>();
     readonly ConcurrentDictionary<string, RatePolicy> _ratePolicies
         = new ConcurrentDictionary<string, RatePolicy>(StringComparer.Ordinal);
@@ -123,6 +126,30 @@ public class Warehouse
         _authenticationProviders.Add(name, provider);
     }
 
+    /// <summary>
+    /// Registers an encryption provider using its default protocol name.
+    /// </summary>
+    public void RegisterEncryptionProvider(IEncryptionProvider provider)
+    {
+        if (provider == null)
+            throw new ArgumentNullException(nameof(provider));
+
+        RegisterEncryptionProvider(provider.DefaultName, provider);
+    }
+
+    /// <summary>
+    /// Registers an encryption provider under a protocol name used during session negotiation.
+    /// </summary>
+    public void RegisterEncryptionProvider(string name, IEncryptionProvider provider)
+    {
+        if (string.IsNullOrWhiteSpace(name))
+            throw new ArgumentException("An encryption provider name is required.", nameof(name));
+        if (provider == null)
+            throw new ArgumentNullException(nameof(provider));
+        if (!_encryptionProviders.TryAdd(name, provider))
+            throw new InvalidOperationException($"An encryption provider named `{name}` is already registered.");
+    }
+
 
     public void RegisterPermissionsManager(IPermissionsManager manager)
     {
@@ -179,6 +206,32 @@ public class Warehouse
         return null;
     }
 
+    /// <summary>
+    /// Gets a registered encryption provider or throws when the protocol is unavailable.
+    /// </summary>
+    public IEncryptionProvider GetEncryptionProvider(string name)
+    {
+        if (TryGetEncryptionProvider(name) is { } provider)
+            return provider;
+
+        throw new InvalidOperationException($"Encryption provider `{name}` was not found.");
+    }
+
+    /// <summary>
+    /// Attempts to get a registered encryption provider by protocol name.
+    /// </summary>
+    public IEncryptionProvider? TryGetEncryptionProvider(string name)
+        => !string.IsNullOrWhiteSpace(name)
+            && _encryptionProviders.TryGetValue(name, out var provider)
+                ? provider
+                : null;
+
+    /// <summary>
+    /// Returns a snapshot of encryption protocol names registered in this Warehouse.
+    /// </summary>
+    public string[] GetEncryptionProviderNames()
+        => _encryptionProviders.Keys.OrderBy(x => x, StringComparer.Ordinal).ToArray();
+
 
     public Warehouse() : this(new WarehouseConfiguration())
     {

Libraries/Esiur/Resource/WarehouseConfiguration.cs

@@ -11,6 +11,16 @@ public sealed class WarehouseConfiguration
     public ParserConfiguration Parser { get; set; } = new ParserConfiguration();
     public ResourceAttachmentConfiguration ResourceAttachments { get; set; } = new ResourceAttachmentConfiguration();
     public ConnectionConfiguration Connections { get; set; } = new ConnectionConfiguration();
+    public EncryptionConfiguration Encryption { get; set; } = new EncryptionConfiguration();
+}
+
+/// <summary>
+/// Bounds encrypted transport records before any peer-controlled allocation occurs.
+/// A value of zero disables the limit.
+/// </summary>
+public sealed class EncryptionConfiguration
+{
+    public uint MaximumRecordSize { get; set; } = 8 * 1024 * 1024 + 1024;
 }
 
 /// <summary>