C# .NET — Airlock.Gateway.Sdk

using Airlock.Gateway.Sdk;
using Airlock.Gateway.Sdk.Models;

var client = new AirlockGatewayClient("https://<your-gateway-host>", bearerToken: "your-jwt-token");

var client = new AirlockGatewayClient(
    "https://<your-gateway-host>",
    clientId: "your-client-id",
    clientSecret: "your-client-secret");

// After obtaining a PAT from your org admin or Mobile Approver
client.SetPat("airlock_pat_...");

// Clear PAT when no longer needed
client.SetPat(null);

// After user login (Device Auth Grant or Auth Code + PKCE)
client.SetBearerToken(accessToken);

// 1. Initiate a pairing session
var pairing = await client.InitiatePairingAsync(new PairingInitiateRequest
{
    EnforcerId = "my-enforcer",
    WorkspaceName = "my-project",
    X25519PublicKey = myPublicKey, // For E2E encryption key exchange
});

// 2. Display pairing code to user (or show QR)
Console.WriteLine($"Pairing code: {pairing.PairingCode}");

// 3. Poll for approval from the Mobile Approver
var status = await client.GetPairingStatusAsync(pairing.Nonce);
if (status.State == "Completed")
{
    var routingToken = status.RoutingToken; // Save for future requests
}

// Claim a pre-generated code from the Mobile Approver
var claim = await client.ClaimPairingAsync(new PairingClaimRequest
{
    Code = "ABCD-1234",             // Code from the Mobile Approver
    EnforcerId = "my-enforcer",
    WorkspaceName = "my-project",
    X25519PublicKey = myPublicKey,
});

// The response contains the routing token and pairing details
var routingToken = claim.RoutingToken;

try
{
    var status = await client.CheckConsentAsync();
    // status == "approved" — proceed normally
}
catch (AirlockGatewayException ex) when (ex.ErrorCode == "app_consent_required")
{
    // User hasn't granted consent — prompt them to approve in the Mobile Approver
}
catch (AirlockGatewayException ex) when (ex.ErrorCode == "app_consent_pending")
{
    // Consent request sent, waiting for user approval
}

// Submit an artifact for approval
var requestId = await client.SubmitArtifactAsync(new ArtifactSubmitRequest
{
    EnforcerId = "my-enforcer",
    ArtifactHash = "sha256-hash",
    Ciphertext = new EncryptedPayload
    {
        Alg = "aes-256-gcm",
        Data = "base64-encrypted-content",
        Nonce = "nonce",
        Tag = "tag"
    },
    Metadata = new Dictionary<string, string>
    {
        ["routingToken"] = "rt-abc"
    }
});

// Wait for a decision (long-poll)
var decision = await client.WaitForDecisionAsync(requestId, timeoutSeconds: 30);
if (decision?.Body?.IsApproved == true)
{
    Console.WriteLine($"Approved: {decision.Body.Reason}");
}

var requestId = await client.EncryptAndSubmitArtifactAsync(new EncryptedArtifactRequest
{
    EnforcerId = "my-enforcer",
    Plaintext = "the content to approve",
    RoutingToken = "rt-abc",
    EncryptionKey = sharedAesKey, // Derived from X25519 ECDH during pairing
});

var result = client.VerifyDecision(decision, expectedArtifactHash, signerPublicKeyBase64Url);
if (result.IsValid)
{
    Console.WriteLine($"Verified decision: {result.Decision}");
}
else
{
    Console.WriteLine($"Verification failed: {result.FailureReason}");
}

try
{
    await client.SubmitArtifactAsync(request);
}
catch (AirlockGatewayException ex) when (ex.IsQuotaExceeded)
{
    // Handle quota exceeded (429)
}
catch (AirlockGatewayException ex) when (ex.IsPairingRevoked)
{
    // Handle revoked pairing (403)
}
catch (AirlockGatewayException ex) when (ex.IsConflict)
{
    // Handle idempotency conflict (409)
}

# From the repo root
cd src/dotnet

# Run the test enforcer
dotnet run --project Airlock.Gateway.Sdk.TestEnforcer