---
title: SystemHashUtil
summary: API reference for SystemHashUtil.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security.EnvironmentApi
reference_type: package
---

# SystemHashUtil

`SystemHashUtil` is a static class that generates and validates salted system-hash values used as identifiers for secure configuration retrieval. It is built on the framework-inherited `SAIF.HashUtil` package's `SaltShaker`.

## Purpose
- Compute a unique, salted hash identifying the calling system (by type and name) for use as a `systemHashValue` with `IEnvironmentService.GetSecureConfigSetting`.
- Validate that a previously issued system hash has not expired.

## Context
- Namespace: `SAIF.Services.Common`
- Assembly/package: `SAIF.Framework.Security.EnvironmentApi`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| ComputeHash | `public static string ComputeHash(SystemType type, string systemName)` | Computes a salted SHA-256 hash of `"{systemName}-{(int)type}"` using `SaltShaker`. See [BR-008](../../business-rules.md#br-008-system-hash-must-not-be-expired). |
| ComputeHashNow | `public static string ComputeHashNow(SystemType type, string systemName)` | Computes the unsalted hash value on the fly; used by the Environment API's system-hash route. |
| Get | `public static string Get(SystemType type)` | Resolves the entry/executing assembly name and calls `ComputeHash(type, assemblyName)`. |
| GetAssembly | `public static Assembly GetAssembly()` | Resolves the main entry or web application assembly, falling back through several detection strategies. |
| RemoveSystemHashSaltAndValidateLifetime | `public static string RemoveSystemHashSaltAndValidateLifetime(string systemHashValue, int expireSeconds, int nowBufferSeconds)` | Un-salts a hash to recover its embedded creation timestamp and throws `SystemHashExpiredException` if it falls outside the valid expiry window. |

The companion public enum `SystemType` (same file) defines: `Console`, `WindowsService`, `WebApp`, `Guidewire`, `ThickClient`, `Script` — used to add uniqueness to the generated hash.

## Behavioral notes
- `ComputeHash` calls `new SaltShaker(DateTime.Now).SaltHash(value)`, embedding a creation timestamp in the salted hash for later expiry validation.
- `GetAssembly` tries, in order: `Assembly.GetEntryAssembly()`, a web-application entry-assembly resolution via `HttpContext.Current.ApplicationInstance`, a legacy web entry-assembly resolution via stack-frame inspection, then `Assembly.GetExecutingAssembly()` as a last resort.
- `RemoveSystemHashSaltAndValidateLifetime` throws `SystemHashExpiredException` (from `SAIF.HashUtil`) when the current time (adjusted by `nowBufferSeconds`) falls outside the `[creation time, creation time + expireSeconds)` window.

## Constraints and usage notes
- No internal call sites for `GetSecureConfigSetting` (the method this hash is intended to support) exist within this library — `SystemHashUtil` is defined here for consuming applications to generate their own hash values*.
- Depends on the external, unindexed `SAIF.HashUtil` package for `SaltShaker` and `SystemHashExpiredException`.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- SAIF.Framework.Security.EnvironmentApi\Services.Common\SystemHashUtil.cs