SEC001: Missing Encryption.Kms package

Field	Value
Code	SEC001
Severity	Warning

Message

Property '{0}' on entity '{1}' is marked with [Encrypted] but the Oproto.FluentDynamoDb.Encryption.Kms package is not referenced. Add the package reference to enable field-level encryption.

Description

The [Encrypted] attribute requires the Oproto.FluentDynamoDb.Encryption.Kms package to provide encryption functionality. When a property is decorated with [Encrypted], the source generator expects the KMS encryption package to be available in the project so it can generate the necessary field-level encryption code.

This diagnostic is emitted as a warning because the entity definition itself is valid, but the encryption behavior cannot be applied at runtime without the supporting package. The generated code will compile, but encrypted fields will not be protected until the package is added.

Example

The following code triggers this diagnostic:

// Project file does NOT reference Oproto.FluentDynamoDb.Encryption.Kms

[DynamoDbTable("Customers")]
public partial class Customer
{
    [PartitionKey]
    [DynamoDbAttribute("pk")]
    public string Pk { get; set; } = string.Empty;

    // SEC001: Property marked [Encrypted] without KMS package
    [Encrypted]
    [DynamoDbAttribute("ssn")]
    public string SocialSecurityNumber { get; set; } = string.Empty;
}

Fix

The corrected version:

<!-- Add the Encryption.Kms package to your .csproj -->
<ItemGroup>
  <PackageReference Include="Oproto.FluentDynamoDb.Encryption.Kms"
                    Version="1.*" />
</ItemGroup>

// With the package referenced, no warning is emitted
[DynamoDbTable("Customers")]
public partial class Customer
{
    [PartitionKey]
    [DynamoDbAttribute("pk")]
    public string Pk { get; set; } = string.Empty;

    [Encrypted]
    [DynamoDbAttribute("ssn")]
    public string SocialSecurityNumber { get; set; } = string.Empty;
}