HMAC - Key rotation

[doerrD]

No description provided.

[Copilot]

Pull request overview

Adds key rotation support to the HMAC authentication flow by allowing multiple API keys per AppId, updating the authorization provider result shape, and extending the ASP.NET Core handler and tests accordingly.

Changes:

• Extend AuthorizationProviderResult to expose ApiKeys (multi-key) while keeping ApiKey as the primary/first key.
• Update MemoryHmacAuthenticationProvider and HmacAuthenticationHandler to validate incoming signatures against multiple keys.
• Bump package versions / release notes and add tests for multi-key authorization behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
softaware.Authentication.Hmac/softaware.Authentication.Hmac.csproj	Bumps core package version to reflect new functionality.
softaware.Authentication.Hmac/AuthorizationProvider/MemoryHmacAuthenticationProvider.cs	Adds multi-key constructor and returns multi-key results.
softaware.Authentication.Hmac/AuthorizationProvider/AuthorizationProviderResult.cs	Adds ApiKeys and a multi-key constructor for key rotation support.
softaware.Authentication.Hmac.AspNetCore/softaware.Authentication.Hmac.AspNetCore.csproj	Bumps ASP.NET Core package version and updates release notes for key rotation.
softaware.Authentication.Hmac.AspNetCore/HmacAuthenticationHandler.cs	Tries signature validation against multiple keys; modifies replay detection logic.
softaware.Authentication.Hmac.AspNetCore.Test/MiddlewareTest.cs	Adds new tests validating authorization with primary/secondary keys.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

MemoryHmacAuthenticationProvider used to keep a reference to the provided IDictionary, preserving custom key comparers (e.g., case-insensitive) and reflecting any updates made after construction. The new ToDictionary copy uses the default comparer and is a snapshot, which can be a breaking behavior change. Consider preserving the source comparer when possible and/or documenting the snapshot semantics explicitly.

[meinsiedler]

Shouldn't be much of an issue I'd say

[meinsiedler]

Extend the README.md to describe the key rotation for HMAC

[Copilot]

@doerrD I've opened a new pull request, #34, to work on those changes. Once the pull request is ready, I'll request review from you.