feat: establish dotnet engineering foundation

Tiku.Infrastructure/Commerce/TenantSecretService.cs

@@ -6,7 +6,9 @@ using Tiku.Infrastructure.Persistence;
 
 namespace Tiku.Infrastructure.Commerce;
 
-internal sealed class TenantSecretService(TikuDbContext dbContext) : ITenantSecretService
+internal sealed class TenantSecretService(
+    TikuDbContext dbContext,
+    ITenantSecretProtector tenantSecretProtector) : ITenantSecretService
 {
     public async Task<JsonElement> GetActiveSecretPayloadAsync(
         Guid tenantId,
@@ -28,16 +30,28 @@ internal sealed class TenantSecretService(TikuDbContext dbContext) : ITenantSecr
                 item.SecretRef == secretRef &&
                 item.Status == TenantSecretStatus.Active &&
                 (item.ExpiresAt == null || item.ExpiresAt > now))
-            .Select(item => item.SecretPayload)
             .SingleOrDefaultAsync(cancellationToken);
 
-        if (secret.ValueKind is JsonValueKind.Undefined or JsonValueKind.Null)
+        if (secret is null)
         {
             throw new PaymentProviderException(
                 "Payment provider secret is not configured.",
                 "payment_secret_not_configured");
         }
 
-        return secret;
+        if (secret.EncryptedPayload.Length > 0)
+        {
+            return tenantSecretProtector.Unprotect(
+                tenantId,
+                secretRef,
+                secret.EncryptionKeyId,
+                secret.EncryptedPayload,
+                secret.EncryptionNonce,
+                secret.EncryptionTag);
+        }
+
+        throw new PaymentProviderException(
+            "Payment provider secret is not configured.",
+            "payment_secret_not_configured");
     }
 }