Merge pull request #25836 from ugurozturk/issue/25835

Add BLOB at-rest encryption and a content pipeline

docs/en/docs-nav.json

@@ -716,6 +716,14 @@
                       "path": "framework/infrastructure/blob-storing/custom-provider.md"
                     }
                   ]
+                },
+                {
+                  "text": "Content Pipeline",
+                  "path": "framework/infrastructure/blob-storing/pipeline.md"
+                },
+                {
+                  "text": "Encryption",
+                  "path": "framework/infrastructure/blob-storing/encryption.md"
                 }
               ]
             },

docs/en/framework/infrastructure/blob-storing/aws.md

@@ -67,7 +67,7 @@ Configure<AbpBlobStoringOptions>(options =>
 * **ProfilesLocation** (string): The path to the aws credentials file to look at.
 * **Region** (string): The system name of the AWS region (e.g., `us-east-1`). **Required** for real AWS S3. Optional when `ServiceURL` is configured for an S3-compatible service; some services accept any value (or `auto` for Cloudflare R2).
 * **ServiceURL** (string): Custom service URL for S3-compatible APIs (e.g., MinIO, DigitalOcean Spaces, Cloudflare R2). If not specified, the default AWS S3 service URL will be used based on the region. When using S3-compatible services, this should point to your service endpoint (e.g., `https://minio.example.com:9000`). The AWS SDK automatically appends a trailing slash to the configured value.
-* **DisablePayloadSigning** (bool): Default `false`. When set to `true`, the provider sends `x-amz-content-sha256: UNSIGNED-PAYLOAD` on `PutObject` requests instead of the streaming chunked signature (`STREAMING-AWS4-HMAC-SHA256-PAYLOAD`) that the AWS SDK v4 uses by default. Required for Cloudflare R2 and other S3-compatible services that do not implement streaming signing. The endpoint must be HTTPS when this option is enabled. Leave as `false` for real AWS S3.
+* **DisablePayloadSigning** (bool): Default `false`. When set to `true`, the provider sends `x-amz-content-sha256: UNSIGNED-PAYLOAD` on `PutObject` and multipart `UploadPart` requests instead of the streaming chunked signature (`STREAMING-AWS4-HMAC-SHA256-PAYLOAD`) that the AWS SDK v4 uses by default. Required for Cloudflare R2 and other S3-compatible services that do not implement streaming signing. The endpoint must be HTTPS when this option is enabled. Leave as `false` for real AWS S3.
 * **Policy** (string): An IAM policy in JSON format that you want to use as an inline session policy.
 * **DurationSeconds** (int): Validity period(s) of a temporary access certificate,minimum is 900 and the maximum is 3600. **note**: Using sub-accounts operated OSS,if the value is 0.
 * **ContainerName** (string): You can specify the container name in Aws. If this is not specified, it uses the name of the BLOB container defined with the `BlobContainerName` attribute (see the [BLOB storing document](../blob-storing)). Please note that Aws has some **rules for naming containers**. A container name must be a valid DNS name, conforming to the [following naming rules](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html):
@@ -147,7 +147,21 @@ Configure<AbpBlobStoringOptions>(options =>
 
 > **Note**: When using S3-compatible services, the provider automatically enables path-style requests which are required by most S3-compatible implementations.
 
-> **Note on `DisablePayloadSigning`**: AWS SDK v4 sends `PutObject` requests with `x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD`. Cloudflare R2 (and some other S3-compatible services) return `501 NotImplemented` for this signing mode. Setting `DisablePayloadSigning = true` switches to `UNSIGNED-PAYLOAD`, which these services accept. The endpoint must be HTTPS. Leave it `false` for real AWS S3.
+> **Note on `DisablePayloadSigning`**: AWS SDK v4 sends `PutObject` and multipart `UploadPart` requests with `x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD`. Cloudflare R2 (and some other S3-compatible services) return `501 NotImplemented` for this signing mode. Setting `DisablePayloadSigning = true` switches to `UNSIGNED-PAYLOAD` (for the multipart parts too), which these services accept. The endpoint must be HTTPS. Leave it `false` for real AWS S3.
+
+## Non-Seekable Uploads
+
+The AWS SDK can not rewind a non-seekable stream to retry a failed upload. For the containers using the [encryption](./encryption.md) or the [content pipeline](./pipeline.md) (which produce non-seekable streams), the provider compensates for that; containers without these features keep the plain `PutObject` upload they always had, also for non-seekable streams:
+
+* A source with a known length of up to 16 MB is buffered in memory and uploaded as a regular, retryable `PutObject` request.
+* A larger (or unknown-length) source is uploaded as a **multipart upload** (`TransferUtility`), which buffers and retries the upload part by part with constant memory usage.
+
+Notes on the multipart path:
+
+* The `ETag` of a multipart object is not the MD5 of the content.
+* The SDK aborts a failed multipart upload, but an abort can also fail (network cut, process exit); when it does, the abort error is what surfaces (the original upload error is replaced). Configure an [AbortIncompleteMultipartUpload lifecycle rule](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpu-abort-incomplete-mpu-lifecycle-config.html) on the bucket, so incomplete parts do not accumulate storage costs.
+* A non-seekable multipart upload uses 5 MB parts, which limits a single BLOB to about 48.8 GB (the 10,000 parts limit of S3).
+* Some S3-compatible services do not implement multipart uploads completely; validate your service before enabling encryption or pipeline contributors on large BLOBs. (With a custom `ServiceURL`, the client requests checksums only when required, so no default CRC part checksums are sent.)
 
 ## Aws Blob Name Calculator
 

docs/en/framework/infrastructure/blob-storing/encryption.md

@@ -0,0 +1,249 @@
+```json
+//[doc-seo]
+{
+    "Description": "Learn how to encrypt BLOBs at rest in ABP Framework, using container-specific, tenant-specific or global passphrases."
+}
+```
+
+# BLOB Encryption
+
+The BLOB Storing system can **encrypt BLOBs at rest**, transparently, on top of the configured [storage provider](../blob-storing): the BLOB stream is encrypted (AES-256-GCM, authenticated) before it reaches the provider and decrypted while it is read back. The `IBlobProvider` interface stays unchanged, but a provider must handle non-seekable, non-replayable input streams correctly (the built-in providers were adjusted where needed; the MinIO provider still requires a known content length — see the behavioral notes below). The combination is covered by automated tests for the File System provider; other providers consume the same standard stream contract, but validate your provider setup before relying on it in production.
+
+> Read the [BLOB Storing document](../blob-storing) to understand how to use the BLOB storing system. The encryption is part of the [Volo.Abp.BlobStoring](https://www.nuget.org/packages/Volo.Abp.BlobStoring) package; no additional package is needed. It requires a platform with AES-GCM support; it is not available on .NET Standard 2.0 targets (like .NET Framework).
+
+## Enabling Encryption
+
+Encryption is enabled **per container**, with the `UseEncryption` extension method:
+
+**Example: Encrypt the BLOBs of a specific container**
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.UseEncryption();
+    });
+});
+
+// A passphrase must be configured (here globally); see "Resolving the Passphrase" below
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.DefaultPassPhrase = context.Configuration["MyApp:BlobPassPhrase"];
+});
+````
+
+**Example: Encrypt all containers by default**
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.ConfigureDefault(container =>
+    {
+        container.UseEncryption();
+    });
+
+    // A single container can still opt out:
+    options.Containers.Configure<PublicPictureContainer>(container =>
+    {
+        container.DisableEncryption();
+    });
+});
+````
+
+Containers that don't enable encryption are not affected at all.
+
+> `DisableEncryption()` turns the transparent decryption off and also clears this container's **own** passphrase and legacy option. Re-enabling it later with a parameterless `UseEncryption()` restores any values still inherited from the default container configuration; a container-specific passphrase that was cleared has to be passed again. BLOBs that were already stored encrypted are then returned **as stored** (raw `ABPE` ciphertext) while reading, without an error (when the container also uses [pipeline contributors](./pipeline.md), they still run and typically fail on the ciphertext). Re-saving under the old configuration does not help, since the save encrypts again: read the BLOBs **while encryption is still enabled**, export the plain content to a temporary location, apply the configuration change and write the content back.
+
+## Resolving the Passphrase
+
+When encryption is enabled, the passphrase for a **new** BLOB is resolved in the following order:
+
+1. **Container-specific passphrase**: If a passphrase is passed to the `UseEncryption` method, it is always used for that container. Calling `UseEncryption()` again without parameters keeps the configured values, so multiple modules can safely compose the configuration; use `ClearEncryptionPassPhrase()` to remove a configured or inherited container passphrase:
+
+````csharp
+options.Containers.Configure<ProfilePictureContainer>(container =>
+{
+    container.UseEncryption("my-container-passphrase");
+});
+````
+
+2. **Global passphrase**: The `AbpBlobStoringEncryptionOptions.DefaultPassPhrase` is used as the fallback:
+
+````csharp
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.DefaultPassPhrase = "my-global-passphrase";
+});
+````
+
+If encryption is enabled but no passphrase can be resolved, saving and reading encrypted BLOBs fails with an `AbpException` (on .NET Standard 2.0 targets a `PlatformNotSupportedException` is thrown before that, see above).
+
+> Treat passphrases as production secrets: read them from your configuration/secret store instead of hard-coding them, and prefer long, machine-generated values.
+
+The **source** of the passphrase is recorded in the encrypted BLOB, and only that source is used while decrypting it. So, for example, a BLOB written with the global passphrase stays readable after a container-specific passphrase is configured later.
+
+> Keep your passphrases safe. If the passphrase a BLOB was encrypted with is lost or changed, that BLOB can not be decrypted anymore.
+
+### Customizing the Passphrase Resolution
+
+The passphrase resolution is implemented by the `IBlobEncryptionKeyProvider` service. The default implementation (`DefaultBlobEncryptionKeyProvider`) applies the rules above. You can [replace](../../fundamentals/dependency-injection.md) it with your own implementation to read the passphrases from another source, like a vault or another secret store (the provider must be able to return the passphrase itself; hardware-backed non-exportable keys are not supported).
+
+A custom provider can also supply **tenant-specific** passphrases: return `BlobEncryptionKeySource.Tenant` while encrypting and resolve the same tenant's passphrase when it is requested for decryption. The key source recorded in the BLOB header routes each BLOB back to the provider that can decrypt it. The following implementation gives every tenant its own passphrase and keeps the standard rules for the host side:
+
+````csharp
+[Dependency(ReplaceServices = true)]
+public class MyTenantBlobEncryptionKeyProvider : DefaultBlobEncryptionKeyProvider
+{
+    public MyTenantBlobEncryptionKeyProvider(
+        IOptions<AbpBlobStoringEncryptionOptions> options)
+        : base(options)
+    {
+    }
+
+    public override async Task<BlobEncryptionKey> ResolveForEncryptionAsync(
+        BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        // Keep a container-specific passphrase as the highest-priority source
+        var containerPassPhrase = GetContainerPassPhraseOrNull(context.Configuration);
+        if (string.IsNullOrWhiteSpace(containerPassPhrase) && context.TenantId.HasValue)
+        {
+            return new BlobEncryptionKey(
+                BlobEncryptionKeySource.Tenant,
+                await GetTenantPassPhraseAsync(context.TenantId.Value, cancellationToken)
+            );
+        }
+
+        return await base.ResolveForEncryptionAsync(context, cancellationToken);
+    }
+
+    public override async Task<string> ResolveForDecryptionAsync(
+        BlobEncryptionKeySource keySource,
+        BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        if (keySource == BlobEncryptionKeySource.Tenant)
+        {
+            if (!context.TenantId.HasValue)
+            {
+                throw new AbpException(
+                    "The BLOB was encrypted with a tenant-specific passphrase, " +
+                    "but there is no current tenant!");
+            }
+
+            return await GetTenantPassPhraseAsync(context.TenantId.Value, cancellationToken);
+        }
+
+        return await base.ResolveForDecryptionAsync(keySource, context, cancellationToken);
+    }
+
+    private Task<string> GetTenantPassPhraseAsync(
+        Guid tenantId, CancellationToken cancellationToken)
+    {
+        // Read the tenant's passphrase from your secret store. It must return
+        // the same value for the lifetime of the tenant's BLOBs.
+        throw new NotImplementedException();
+    }
+}
+````
+
+Notes on this pattern:
+
+* The multi-tenant BLOB containers already isolate tenants physically (see the [BLOB Storing document](../blob-storing)); tenant-specific passphrases add **cryptographic** isolation on top: one tenant's BLOBs can not be decrypted with another tenant's (or the host's) passphrase, and the tenant identity is part of the authenticated data.
+* The tenant is taken from `context.TenantId` (the tenant the BLOB belongs to), which is correct for both saving and reading — no ambient `ICurrentTenant` lookup is needed.
+* Tenant passphrases only apply to containers with `IsMultiTenant = true` (the default). A shared (`IsMultiTenant = false`) container runs its BLOB operations in the host context (`context.TenantId` is null there), so the sample never selects the tenant source on such a container and falls back to the container/global passphrase.
+
+## BLOBs Stored Before Enabling Encryption
+
+By default, reading a BLOB that does not have the encrypted format fails, so a tampered or corrupted BLOB can not silently bypass the authenticity check. If a container already has plaintext BLOBs from before encryption was enabled, allow reading them explicitly:
+
+````csharp
+options.Containers.Configure<ProfilePictureContainer>(container =>
+{
+    container.UseEncryption(allowLegacyPlainText: true);
+});
+````
+
+With this option, content that does not start with the recognized encrypted format magic is returned as-is, **without any authenticity check** — including an encrypted BLOB whose leading magic bytes were corrupted or stripped. (A BLOB that still starts with the format magic but has a corrupted header is *not* returned as plaintext; it fails as an invalid encrypted format.) Treat it as a short-term migration switch: new BLOBs are always encrypted, and the option should be disabled once the existing BLOBs are migrated (re-saved).
+
+A typical migration of an existing container:
+
+1. Enable encryption with `UseEncryption(allowLegacyPlainText: true)` and deploy. New and updated BLOBs are written encrypted; the existing plaintext BLOBs stay readable.
+2. Re-save the existing BLOBs (the BLOB storing system has no list operation, so iterate the BLOB names from your own application data):
+
+````csharp
+var bytes = await container.GetAllBytesAsync(blobName);
+await container.SaveAsync(blobName, bytes, overrideExisting: true);
+````
+
+3. Remove the `allowLegacyPlainText` option, so reading fails closed again for any content that does not have the encrypted format.
+
+> Legacy plaintext content that itself starts with the `ABPE` format magic can not be distinguished from an encrypted BLOB and fails to be read through the encrypted container. Read it with encryption disabled (or from the raw storage) and re-save it once through the encrypted container to encrypt it. Also note that legacy BLOBs are returned over a non-seekable wrapper stream while this option is enabled (the `Length` stays available when the provider stream knows it).
+
+## Changing a Passphrase
+
+The format does not support key rotation: a BLOB is only readable with the exact passphrase it was written with, and there is no way to keep an old and a new passphrase of the **same source** active at the same time. So changing a passphrase in place makes the BLOBs written with the old one permanently unreadable — migrate the content **before** the change:
+
+* **From the global to a container-specific passphrase**: this direction works without downtime, because the two are different key sources. Configure the new container passphrase; BLOBs recorded with the `Global` source keep decrypting with `DefaultPassPhrase`, while new saves use the container passphrase. Re-save the existing BLOBs (as in the migration steps above) to move them to the new passphrase; the global one can be retired once no BLOB uses it anymore.
+* **Any other change**: while the old passphrase is still configured, read the BLOBs and re-save them into a container using a different key source (or export them to a safe location), then apply the change and save them back. Verify the migrated BLOBs are readable before deleting anything.
+
+## Behavioral Changes for Encrypted Containers
+
+* The stream returned for an encrypted BLOB (from `GetAsync`) is read-only and non-seekable, and its `Length` is not available; read it sequentially (for example with `CopyToAsync`). (The **encrypting** stream that is uploaded does expose its length when the source exposes both its length and position — that is a save-side detail for providers that need the object size; see the format section.)
+* Opening a BLOB throws an `AbpException` when the content does not have a valid encrypted format. **While reading**, a `CryptographicException` is thrown when the content fails authentication (tampered data or a wrong passphrase), and an `AbpException` when a structural corruption is detected (like a missing end-of-stream record on a truncated BLOB).
+* Each returned chunk is individually authenticated as it is read; the completeness of the whole BLOB (the authenticated terminal record, and that nothing was truncated or appended at the end) is verified only when the decryption stream is read to its end. When [content-pipeline contributors](./pipeline.md) are enabled, the framework runs this end verification when the composed stream returned by `GetAsync` reaches EOF, so a contributor that stops at its own length or end marker can not hide a truncated terminal record. (This relies on the decrypting stream implementing `IBlobAuthenticatedEndStream`, which the built-in one does; a custom `CreateDecryptingStreamAsync` override that wraps the stream must forward that interface, or the check is skipped.) A caller that intentionally reads only a prefix (and disposes) gets authentication for the chunks it consumed, not a completeness guarantee for the whole BLOB.
+* The file system provider retries a failed save only while it is replayable: before the target file was opened, or for a seekable overwrite (where it rewinds the source and truncates the target again). A non-replayable encrypting stream that fails after the target was opened throws, and any partially written content fails closed while reading instead of being returned as damaged data (except with `allowLegacyPlainText`, where a fragment shorter than the format magic is returned as legacy plaintext — see above).
+* Some storage providers consume the stream **synchronously** (like the Aliyun provider); they require a source stream that also supports synchronous reads, exactly like they do without encryption.
+* The MinIO provider needs the object size before uploading. It works with encrypted content when the source stream exposes its length (and position); a source whose length can not be determined must be materialized (for example, saved as a byte array) first.
+
+## Performance and Cost
+
+Deriving the encryption key from the passphrase is intentionally expensive (PBKDF2-SHA256), so leaked storage can not be brute-forced cheaply. Understand the cost profile before enabling encryption on hot containers:
+
+* One key derivation runs on **every BLOB save** and on **every encrypted BLOB open** (before the stream is returned). The cost does not depend on the BLOB size — it scales with the number of operations, so many small, frequently read BLOBs amplify it the most.
+* Every BLOB uses its own random salt, so derivation results can not be cached or reused; reading the same BLOB again derives the key again.
+* The default iteration count is 100,000 (tens of milliseconds of CPU per operation, hardware dependent). Measure on your target hardware and concurrency before enabling encryption on high-frequency containers — it is not a microsecond-level transparent overhead.
+* Use a long, machine-generated (at least 128 bits of entropy) value from your secret store as the passphrase in production. For low-entropy, human-chosen passphrases you can raise the iteration count — this increases the offline guessing cost and the per-operation CPU cost by the same factor:
+
+````csharp
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.KdfIterations = 600_000; // allowed range: 100,000 - 600,000
+});
+````
+
+Changing the iteration count only affects newly written BLOBs; existing BLOBs are decrypted with the count recorded in their own header.
+
+## The Encryption Format
+
+* Encryption is authenticated (AES-256-GCM): modified, re-ordered, corrupted or truncated content of a BLOB is detected while reading.
+* Every encrypted BLOB is bound to its storage identity (the *normalized* container name, BLOB name and tenant). Copying or renaming an encrypted BLOB at the storage level makes it unreadable at the new location, which also makes substituting one (validly encrypted) BLOB for another detectable. Re-writing an older version of the same BLOB back to its own location is not detectable at this layer.
+* Because of the identity binding, the following otherwise-legal operations make the affected encrypted BLOBs permanently unreadable: changing the `IsMultiTenant` value of the container (this affects the BLOBs that were saved under a tenant; BLOBs saved in the host context keep the same null tenant identity and stay readable), moving BLOBs between tenants or containers, and switching to a storage provider that normalizes container/BLOB names differently (for example, providers that lowercase container names). The binding is the **logical** identity (the normalized names and the tenant), not the physical location of the provider. Before such a change, read the affected BLOBs under the old configuration and export the plain content — re-saving in place does not help, since the save encrypts again with the old identity — then apply the change and write the content back.
+* The container and BLOB names are part of the authenticated identity, so on an encrypted container they must be valid UTF-16 (a name with unpaired surrogates is rejected with an `AbpException`). Normal names are unaffected.
+* The data is processed in chunks with **constant memory usage**, independent from the BLOB size.
+* Every BLOB is encrypted with its own key, derived (PBKDF2-SHA256) from the passphrase and a random per-BLOB salt.
+* When the source stream exposes both its length and position, the encrypted stream exposes its exact resulting length for providers that require the object size before uploading.
+
+### What Is (Not) Protected
+
+* Only the BLOB **content** is encrypted. Container names, BLOB names and any provider-level metadata stay in plaintext, so the existence of a BLOB is visible in the storage. The size overhead is deterministic (see below), so the exact plaintext length can be recovered from the stored object size.
+* The size overhead is small and deterministic: a 39-byte prefix, plus 20 bytes per 64 KB chunk, plus a 20-byte end-of-stream record (about 0.03% for large BLOBs).
+* Server-side encryption offered by the storage provider (like S3 or Azure Storage encryption) is complementary, not redundant: it uses provider-managed keys at the storage layer, while this feature encrypts with application-managed passphrases before the content leaves your application. They can be combined for defense in depth.
+
+## Troubleshooting
+
+| Error | Cause and solution |
+|---|---|
+| `AbpException`: *The BLOB does not have the encrypted BLOB format...* | The BLOB was saved before encryption was enabled (or by an application without encryption). Use `allowLegacyPlainText: true` during the migration. |
+| `AbpException`: *...no passphrase could be resolved* | Encryption is enabled, but neither a container passphrase nor `DefaultPassPhrase` is configured. |
+| `AbpException`: *...the default key provider does not supply tenant keys* | The BLOB was encrypted by a custom key provider with a tenant-specific passphrase; the same provider must be registered to read it back. |
+| `AbpException`: *...that passphrase is not available anymore* | The passphrase of the key source recorded in the BLOB was removed or cleared from the configuration. Restore it. |
+| `CryptographicException` while reading | Wrong passphrase, tampered/corrupted content, or the BLOB was copied, renamed or moved across containers/tenants at the storage level (see the identity binding above). |
+| `PlatformNotSupportedException` | The application runs on .NET Standard 2.0 (like .NET Framework) or on a platform without AES-GCM support. |
+
+## See Also
+
+* [BLOB Storing](../blob-storing)
+* [BLOB Content Pipeline](./pipeline.md)
+* [Creating a custom BLOB storage provider](./custom-provider.md)

docs/en/framework/infrastructure/blob-storing/index.md

@@ -313,6 +313,44 @@ Configure<AbpBlobStoringOptions>(options =>
 
 > If your application is not multi-tenant, no worry, it works as expected. You don't need to configure the `IsMultiTenant` option.
 
+## Encrypting BLOBs
+
+The BLOB Storing system can **encrypt BLOBs at rest**, transparently, on top of the configured storage provider:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.UseEncryption();
+    });
+});
+
+// A passphrase must be configured; see the encryption document
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.DefaultPassPhrase = context.Configuration["MyApp:BlobPassPhrase"];
+});
+````
+
+The encryption passphrase can be container-specific or **global**, and per-tenant passphrases can be plugged in over the key provider; every BLOB derives its own encryption key from the passphrase. See the [BLOB Encryption document](./encryption.md) for details.
+
+## Transforming BLOB Content
+
+The BLOB content can be passed through a **pipeline of contributors** (compression, watermarking, content validation...) while it is saved and read, without changing the storage provider:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.PipelineContributors.Add<GZipBlobPipelineContributor>();
+    });
+});
+````
+
+See the [BLOB Content Pipeline document](./pipeline.md) for details.
+
 ## Extending the BLOB Storing System
 
 Most of the times, you won't need to customize the BLOB storage system except [creating a custom BLOB storage provider](./custom-provider.md). However, you can replace any service (injected via [dependency injection](../../fundamentals/dependency-injection.md)), if you need. Here, some other services not mentioned above, but you may want to know:
@@ -328,4 +366,6 @@ If you want to create folders and move files between folders, assign permissions
 
 ## See Also
 
+* [BLOB Content Pipeline](./pipeline.md)
+* [BLOB Encryption](./encryption.md)
 * [Creating a custom BLOB storage provider](./custom-provider.md)

docs/en/framework/infrastructure/blob-storing/pipeline.md

@@ -0,0 +1,122 @@
+```json
+//[doc-seo]
+{
+    "Description": "Learn how to transform BLOB content transparently (compression, validation, watermarking...) with pipeline contributors in ABP Framework."
+}
+```
+
+# BLOB Content Pipeline
+
+The BLOB Storing system can pass the BLOB content through a **pipeline of contributors** while it is saved and read. A contributor transforms the content stream transparently, on top of the configured [storage provider](../blob-storing): compression, watermarking, content validation or any other stream transformation can be implemented without changing the storage provider or the application code that works with `IBlobContainer`.
+
+> Read the [BLOB Storing document](../blob-storing) to understand how to use the BLOB storing system. The pipeline is part of the [Volo.Abp.BlobStoring](https://www.nuget.org/packages/Volo.Abp.BlobStoring) package; no additional package is needed.
+
+## Creating a Pipeline Contributor
+
+A pipeline contributor implements the `IBlobPipelineContributor` interface. The following example compresses the BLOBs with GZip:
+
+````csharp
+public class GZipBlobPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public async Task OnSavingAsync(BlobPipelineContext context)
+    {
+        var compressedStream = new MemoryStream();
+        try
+        {
+            using (var gzipStream = new GZipStream(compressedStream, CompressionLevel.Fastest, leaveOpen: true))
+            {
+                await context.BlobStream.CopyToAsync(gzipStream, context.CancellationToken);
+            }
+        }
+        catch
+        {
+            // A stream is only tracked for disposal by the pipeline once it is assigned
+            // to context.BlobStream, so dispose it here if the eager work fails first
+            compressedStream.Dispose();
+            throw;
+        }
+
+        compressedStream.Position = 0;
+        context.BlobStream = compressedStream;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new GZipStream(context.BlobStream, CompressionMode.Decompress);
+        return Task.CompletedTask;
+    }
+}
+````
+
+* `OnSavingAsync` is called before the BLOB reaches the storage provider. Replace `context.BlobStream` with the transformed content; it is also allowed to materialize the content eagerly, like the example does (a lazily transforming, read-only wrapper keeps the memory usage constant instead, which is preferable for large BLOBs).
+* `OnGettingAsync` is called after the BLOB was read from the storage provider, in the reverse direction of `OnSavingAsync`.
+* The `BlobPipelineContext` also provides the normalized container/BLOB names, the container configuration, the tenant id and a scoped `ServiceProvider`. Contributors are resolved from the [dependency injection](../../fundamentals/dependency-injection.md) system (register them like any other service, for example with `ITransientDependency`). While saving, the scope stays alive until the save operation completes; while getting, until the stream returned to the caller is disposed.
+
+### The Stream Ownership Contract
+
+* If a stream (or the DI scope) fails to dispose **after** the storage provider already saved the BLOB, `SaveAsync` still throws that cleanup error even though the data is committed — a retry with the default `overrideExisting: false` would then get a `BlobAlreadyExistsException`.
+* **While saving**, do not dispose the stream you received (notice the `leaveOpen: true` in the example): every stream you assign to `context.BlobStream` is disposed after the save, while the original stream stays owned by the caller. A stream is only tracked from the moment it is assigned, so if you create a stream and then do work that may fail (like the eager copy above) before assigning it, dispose it yourself on the failure path.
+* **While getting**, the stream you set must dispose the stream you received when it is disposed (a `GZipStream` already does that by default), because the composed stream is returned to the caller as a whole.
+
+## Configuring Containers
+
+Contributors are configured **per container**, like the other container options:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.PipelineContributors.Add<GZipBlobPipelineContributor>();
+    });
+});
+````
+
+Configuring the default container applies the contributor to all containers; a named container can add its own contributors on top of them:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.ConfigureDefault(container =>
+    {
+        container.PipelineContributors.Add<GZipBlobPipelineContributor>();
+    });
+
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        // Runs after the GZip contributor while saving
+        container.PipelineContributors.Add<WatermarkPipelineContributor>();
+    });
+});
+````
+
+Think of the composition as **global stages plus container stages**: the contributors of the default container run first while saving, then the own ones of the container (each contributor type runs once). The inherited contributors are kept even when a container overrides its storage provider; set `InheritPipelineContributors` to `false` on a container to opt out of the global stages completely:
+
+````csharp
+options.Containers.Configure<PublicPictureContainer>(container =>
+{
+    container.InheritPipelineContributors = false;
+});
+````
+
+## Execution Order and Encryption
+
+* While **saving**, the contributors run in the configuration order, and the built-in [encryption](./encryption.md) always runs **after** them (immediately before the storage provider).
+* While **getting**, the decryption runs first and the contributors run in the **reverse** order.
+
+So, contributors always work on the plain content, a compressing contributor always compresses before the encryption (encrypted data can not be compressed), and the stored form is always ciphertext when the encryption is enabled.
+
+## Behavioral Notes
+
+* The stream returned for a container with contributors is generally read-only and non-seekable, and its `Length` is only available when the transformation can provide it. See the behavioral notes of the [BLOB Encryption document](./encryption.md) — the same stream semantics apply to the pipeline.
+* When a contributor changes the content size lazily, the final length is unknown to the storage provider; providers that require the object size before uploading need an eagerly materialized (or length-aware) stream.
+* Some storage providers consume the stream **synchronously** (like the Aliyun provider); they require contributor streams that also support synchronous reads, exactly like they do without the pipeline.
+* Containers without contributors are not affected at all.
+
+> **A contributor that transforms the content is part of the persisted data format.** A BLOB is only readable with the same transforming contributors, in the same order, it was saved with: adding, removing or re-ordering **transforming** contributors on a container that already has BLOBs makes the existing content fail to be read (or, for transformations without an own format check, silently return wrong content). A **metadata-only** contributor that neither consumes nor replaces `context.BlobStream` does not change the stored format, so it can be added to a container with existing BLOBs. A contributor that reads the content to validate it must return a pass-through wrapper (it still counts as consuming the stream); not replacing the stream after reading it would leave an empty/truncated stream for the provider. To change transforming contributors, migrate by reading the BLOBs **with the old configuration** and exporting the plain content, applying the change, and then writing the content back; re-saving in place under the old configuration does not change the stored form.
+
+## See Also
+
+* [BLOB Storing](../blob-storing)
+* [BLOB Encryption](./encryption.md)
+* [Creating a custom BLOB storage provider](./custom-provider.md)

framework/src/Volo.Abp.BlobStoring.Aws/Properties/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Volo.Abp.BlobStoring.Aws.Tests")]

framework/src/Volo.Abp.BlobStoring.Aws/Volo/Abp/BlobStoring/Aws/AwsBlobProvider.cs

@@ -1,8 +1,11 @@
 using System;
 using System.IO;
+using System.Linq;
+using System.Threading;
 using System.Threading.Tasks;
 using Amazon.S3;
 using Amazon.S3.Model;
+using Amazon.S3.Transfer;
 using Amazon.S3.Util;
 using Volo.Abp.DependencyInjection;
 
@@ -10,6 +13,10 @@ namespace Volo.Abp.BlobStoring.Aws;
 
 public class AwsBlobProvider : BlobProviderBase, ITransientDependency
 {
+    // Aligned with the TransferUtility threshold under which a non-seekable upload
+    // would be sent as a single (non-retryable) request instead of multipart
+    protected const long MaxBufferedUploadLength = 16 * 1024 * 1024;
+
     protected IAwsBlobNameCalculator AwsBlobNameCalculator { get; }
     protected IAmazonS3ClientFactory AmazonS3ClientFactory { get; }
     protected IBlobNormalizeNamingService BlobNormalizeNamingService { get; }
@@ -43,13 +50,30 @@ public class AwsBlobProvider : BlobProviderBase, ITransientDependency
                 await CreateContainerIfNotExists(amazonS3Client, containerName);
             }
 
-            await amazonS3Client.PutObjectAsync(new PutObjectRequest
+            if (!RequiresRetrySafeUpload(args))
             {
-                BucketName = containerName,
-                Key = blobName,
-                InputStream = args.BlobStream,
-                DisablePayloadSigning = configuration.DisablePayloadSigning
-            });
+                await PutObjectAsync(amazonS3Client, containerName, blobName, args.BlobStream, configuration, args.CancellationToken);
+                return;
+            }
+
+            // The SDK can not retry the upload of a non-seekable stream (like an encrypting
+            // stream). A small source with a known length is buffered in memory and uploaded
+            // as a retryable PutObject; anything larger (or with an unknown length) goes
+            // through a TransferUtility multipart upload, which buffers and retries part by part
+            var remainingLength = GetRemainingLengthOrNull(args.BlobStream);
+            if (remainingLength != null && remainingLength <= MaxBufferedUploadLength)
+            {
+                using (var bufferedStream = new MemoryStream((int)remainingLength.Value))
+                {
+                    await args.BlobStream.CopyToAsync(bufferedStream, 81920, args.CancellationToken);
+                    bufferedStream.Position = 0;
+                    await PutObjectAsync(amazonS3Client, containerName, blobName, bufferedStream, configuration, args.CancellationToken);
+                }
+
+                return;
+            }
+
+            await UploadMultipartAsync(amazonS3Client, containerName, blobName, args.BlobStream, configuration, args.CancellationToken);
         }
     }
 
@@ -108,6 +132,95 @@ public class AwsBlobProvider : BlobProviderBase, ITransientDependency
         }
     }
 
+    /// <summary>
+    /// The retry-safe (buffered/multipart) upload only applies to non-seekable streams
+    /// of containers using the encryption or the content pipeline; other containers
+    /// keep the plain PutObject behavior they always had.
+    /// </summary>
+    protected virtual bool RequiresRetrySafeUpload(BlobProviderSaveArgs args)
+    {
+        if (args.BlobStream.CanSeek)
+        {
+            return false;
+        }
+
+        return args.Configuration.IsEncryptionEnabled() ||
+               args.Configuration.GetEffectivePipelineContributors().Any();
+    }
+
+    protected virtual long? GetRemainingLengthOrNull(Stream stream)
+    {
+        try
+        {
+            var remainingLength = stream.Length - stream.Position;
+            return remainingLength >= 0 ? remainingLength : null;
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            // The length is optional; a probe failure must not fail the save
+            return null;
+        }
+    }
+
+    protected virtual async Task PutObjectAsync(
+        AmazonS3Client amazonS3Client,
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration,
+        CancellationToken cancellationToken)
+    {
+        await amazonS3Client.PutObjectAsync(CreatePutObjectRequest(containerName, blobName, blobStream, configuration), cancellationToken);
+    }
+
+    protected virtual PutObjectRequest CreatePutObjectRequest(
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration)
+    {
+        return new PutObjectRequest
+        {
+            BucketName = containerName,
+            Key = blobName,
+            InputStream = blobStream,
+            AutoCloseStream = false,
+            DisablePayloadSigning = configuration.DisablePayloadSigning
+        };
+    }
+
+    protected virtual async Task UploadMultipartAsync(
+        AmazonS3Client amazonS3Client,
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration,
+        CancellationToken cancellationToken)
+    {
+        using (var transferUtility = new TransferUtility(amazonS3Client))
+        {
+            await transferUtility.UploadAsync(CreateMultipartUploadRequest(containerName, blobName, blobStream, configuration), cancellationToken);
+        }
+    }
+
+    protected virtual TransferUtilityUploadRequest CreateMultipartUploadRequest(
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration)
+    {
+        return new TransferUtilityUploadRequest
+        {
+            BucketName = containerName,
+            Key = blobName,
+            // The unseekable multipart path of the SDK ignores AutoCloseStream
+            // and disposes the input, so the ownership is protected by a wrapper
+            InputStream = new LeaveOpenStreamWrapper(blobStream),
+            AutoCloseStream = false,
+            DisablePayloadSigning = configuration.DisablePayloadSigning
+        };
+    }
+
     protected virtual async Task<AmazonS3Client> GetAmazonS3Client(BlobProviderArgs args)
     {
         var configuration = args.Configuration.GetAwsConfiguration();

framework/src/Volo.Abp.BlobStoring.Aws/Volo/Abp/BlobStoring/Aws/AwsBlobProviderConfiguration.cs

@@ -94,7 +94,7 @@ public class AwsBlobProviderConfiguration
     }
 
     /// <summary>
-    /// When true, payload signing is disabled on PutObject upload requests so the SDK sends
+    /// When true, payload signing is disabled on PutObject and UploadPart upload requests so the SDK sends
     /// <c>x-amz-content-sha256: UNSIGNED-PAYLOAD</c> instead of the streaming chunked signature
     /// (<c>STREAMING-AWS4-HMAC-SHA256-PAYLOAD</c>) that AWS SDK v4 uses by default. Required for
     /// Cloudflare R2 and other S3-compatible services that do not implement streaming signing.

framework/src/Volo.Abp.BlobStoring.Aws/Volo/Abp/BlobStoring/Aws/LeaveOpenStreamWrapper.cs

@@ -0,0 +1,90 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring.Aws;
+
+/// <summary>
+/// The unseekable multipart path of the AWS SDK ignores AutoCloseStream and
+/// disposes its input; this wrapper protects the ownership of the wrapped stream.
+/// </summary>
+internal sealed class LeaveOpenStreamWrapper : Stream
+{
+    private readonly Stream _inner;
+
+    public LeaveOpenStreamWrapper(Stream inner)
+    {
+        _inner = inner;
+    }
+
+    public override bool CanRead => _inner.CanRead;
+    public override bool CanSeek => _inner.CanSeek;
+    public override bool CanWrite => false;
+
+    // The SDK computes the optional content length from Length/Position, but only
+    // handles NotSupportedException; translate an IOException of a probe, so an
+    // unknown length stays "unknown" instead of failing the upload
+    public override long Length
+    {
+        get
+        {
+            try
+            {
+                return _inner.Length;
+            }
+            catch (IOException ex)
+            {
+                throw new NotSupportedException("The length of the stream is not available!", ex);
+            }
+        }
+    }
+
+    public override long Position
+    {
+        get
+        {
+            try
+            {
+                return _inner.Position;
+            }
+            catch (IOException ex)
+            {
+                throw new NotSupportedException("The position of the stream is not available!", ex);
+            }
+        }
+        set => _inner.Position = value;
+    }
+
+    public override void Flush()
+    {
+    }
+
+    public override int Read(byte[] buffer, int offset, int count) => _inner.Read(buffer, offset, count);
+
+    public override Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+#if NETSTANDARD2_0
+        return _inner.ReadAsync(buffer, offset, count, cancellationToken);
+#else
+        // The SDK reads over this (old) overload; dispatch it over the modern one,
+        // so a source that only implements ReadAsync(Memory<byte>) keeps working
+        return _inner.ReadAsync(buffer.AsMemory(offset, count), cancellationToken).AsTask();
+#endif
+    }
+
+#if !NETSTANDARD2_0
+    public override int Read(Span<byte> buffer) => _inner.Read(buffer);
+
+    public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+    {
+        return _inner.ReadAsync(buffer, cancellationToken);
+    }
+#endif
+
+    public override long Seek(long offset, SeekOrigin origin) => _inner.Seek(offset, origin);
+    public override void SetLength(long value) => throw new NotSupportedException();
+    public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+    // Disposing the wrapper must not dispose the wrapped stream
+}

framework/src/Volo.Abp.BlobStoring.FileSystem/Volo/Abp/BlobStoring/FileSystem/FileSystemBlobProvider.cs

@@ -31,12 +31,36 @@ public class FileSystemBlobProvider : BlobProviderBase, ITransientDependency
             ? FileMode.Create
             : FileMode.CreateNew;
 
-        await Policy.Handle<IOException>()
+        // A failure is only retried while it is replayable: before OpenFileStream returns
+        // (the source is untouched), or for a seekable overwrite (the source can seek back
+        // and FileMode.Create truncates the partial content). Otherwise a retry would
+        // replay a half-consumed source or hit the file a failed CreateNew attempt left behind.
+        long sourcePosition;
+        try
+        {
+            sourcePosition = args.BlobStream.CanSeek && fileMode == FileMode.Create ? args.BlobStream.Position : -1;
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            // A failing position probe degrades to a single, non-replayable attempt
+            sourcePosition = -1;
+        }
+
+        var targetOpened = false;
+
+        await Policy.Handle<IOException>(_ => sourcePosition >= 0 || !targetOpened)
             .WaitAndRetryAsync(2, retryCount => TimeSpan.FromSeconds(retryCount))
             .ExecuteAsync(async () =>
             {
-                using (var fileStream = File.Open(filePath, fileMode, FileAccess.Write))
+                if (sourcePosition >= 0)
                 {
+                    args.BlobStream.Seek(sourcePosition, SeekOrigin.Begin);
+                }
+
+                using (var fileStream = OpenFileStream(filePath, fileMode))
+                {
+                    targetOpened = true;
+
                     await args.BlobStream.CopyToAsync(
                         fileStream,
                         args.CancellationToken
@@ -73,6 +97,11 @@ public class FileSystemBlobProvider : BlobProviderBase, ITransientDependency
             .ExecuteAsync(() => Task.FromResult(File.OpenRead(filePath)));
     }
 
+    protected virtual Stream OpenFileStream(string filePath, FileMode fileMode)
+    {
+        return File.Open(filePath, fileMode, FileAccess.Write);
+    }
+
     protected virtual Task<bool> ExistsAsync(string filePath)
     {
         return Task.FromResult(File.Exists(filePath));

framework/src/Volo.Abp.BlobStoring/Properties/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Volo.Abp.BlobStoring.Tests")]

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/AbpBlobStoringEncryptionOptions.cs

@@ -0,0 +1,21 @@
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Global options of the BLOB encryption; enable it per container with the
+/// <see cref="BlobContainerConfigurationEncryptionExtensions.UseEncryption"/> extension method.
+/// </summary>
+public class AbpBlobStoringEncryptionOptions
+{
+    /// <summary>
+    /// The global passphrase, used when no container-specific passphrase is available.
+    /// Default: null (encryption must be explicitly keyed).
+    /// </summary>
+    public string? DefaultPassPhrase { get; set; }
+
+    /// <summary>
+    /// PBKDF2 iteration count for newly encrypted BLOBs (existing BLOBs use the count
+    /// in their own header). Higher values raise both the offline guessing cost and
+    /// the CPU cost of every save/read. Allowed: 100,000 - 600,000. Default: 100,000.
+    /// </summary>
+    public int KdfIterations { get; set; } = 100_000;
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobContainer.cs

@@ -1,7 +1,11 @@
-using System;
+using System;
+using System.Collections.Generic;
 using System.IO;
+using System.Linq;
+using System.Runtime.ExceptionServices;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
 using Volo.Abp.MultiTenancy;
 using Volo.Abp.Threading;
 
@@ -116,16 +120,87 @@ public class BlobContainer : IBlobContainer
         {
             var blobNormalizeNaming = BlobNormalizeNamingService.NormalizeNaming(Configuration, ContainerName, name);
 
-            await Provider.SaveAsync(
-                new BlobProviderSaveArgs(
-                    blobNormalizeNaming.ContainerName!,
-                    Configuration,
-                    blobNormalizeNaming.BlobName!,
-                    stream,
-                    overrideExisting,
-                    CancellationTokenProvider.FallbackToProvider(cancellationToken)
-                )
-            );
+            var fallbackCancellationToken = CancellationTokenProvider.FallbackToProvider(cancellationToken);
+            var contributorTypes = Configuration.GetEffectivePipelineContributors().ToList();
+
+            // Every stream the pipeline creates is disposed after the save (disposing the
+            // encrypting wrapper also zeroes the derived key); the caller keeps the original
+            var pipelineStreams = new List<Stream>();
+            AsyncServiceScope? contributorScope = null;
+            var completed = false;
+            try
+            {
+                if (contributorTypes.Count > 0)
+                {
+                    contributorScope = ServiceProvider.CreateAsyncScope();
+                    var context = new BlobPipelineContext(
+                        contributorScope.Value.ServiceProvider,
+                        blobNormalizeNaming.ContainerName!,
+                        blobNormalizeNaming.BlobName!,
+                        Configuration,
+                        GetTenantIdOrNull(),
+                        stream,
+                        fallbackCancellationToken
+                    );
+
+                    context.CreatedStreams = pipelineStreams;
+                    await RunPipelineAsync(context, contributorTypes, saving: true);
+                    stream = context.BlobStream;
+                }
+
+                if (BlobEncryptionConfiguration.IsEnabled(Configuration))
+                {
+                    stream = await CreateEncryptingStreamAsync(blobNormalizeNaming, stream, fallbackCancellationToken);
+                    pipelineStreams.Add(stream);
+                }
+
+                await Provider.SaveAsync(
+                    new BlobProviderSaveArgs(
+                        blobNormalizeNaming.ContainerName!,
+                        Configuration,
+                        blobNormalizeNaming.BlobName!,
+                        stream,
+                        overrideExisting,
+                        fallbackCancellationToken
+                    )
+                );
+
+                completed = true;
+            }
+            finally
+            {
+                // Best-effort cleanup: a failing Dispose must not prevent releasing the
+                // remaining streams/scope or hide the exception that is already propagating
+                Exception? disposeException = null;
+                for (var i = pipelineStreams.Count - 1; i >= 0; i--)
+                {
+                    try
+                    {
+                        await DisposeStreamAsync(pipelineStreams[i]);
+                    }
+                    catch (Exception ex)
+                    {
+                        disposeException ??= ex;
+                    }
+                }
+
+                if (contributorScope != null)
+                {
+                    try
+                    {
+                        await contributorScope.Value.DisposeAsync();
+                    }
+                    catch (Exception ex)
+                    {
+                        disposeException ??= ex;
+                    }
+                }
+
+                if (completed && disposeException != null)
+                {
+                    ExceptionDispatchInfo.Capture(disposeException).Throw();
+                }
+            }
         }
     }
 
@@ -194,14 +269,296 @@ public class BlobContainer : IBlobContainer
             var blobNormalizeNaming =
                 BlobNormalizeNamingService.NormalizeNaming(Configuration, ContainerName, name);
 
-            return await Provider.GetOrNullAsync(
+            var fallbackCancellationToken = CancellationTokenProvider.FallbackToProvider(cancellationToken);
+
+            var stream = await Provider.GetOrNullAsync(
                 new BlobProviderGetArgs(
                     blobNormalizeNaming.ContainerName!,
                     Configuration,
                     blobNormalizeNaming.BlobName!,
-                    CancellationTokenProvider.FallbackToProvider(cancellationToken)
+                    fallbackCancellationToken
                 )
             );
+
+            if (stream == null)
+            {
+                return null;
+            }
+
+            // The provider stream is now owned by the container: reading the configuration
+            // (a mis-typed value can throw) must not leak it
+            List<Type> contributorTypes;
+            bool encryptionEnabled;
+            try
+            {
+                contributorTypes = Configuration.GetEffectivePipelineContributors().ToList();
+                encryptionEnabled = BlobEncryptionConfiguration.IsEnabled(Configuration);
+            }
+            catch
+            {
+                await TryDisposeStreamAsync(stream);
+                throw;
+            }
+
+            // Captured so the pipeline can verify the decryption reached its authenticated
+            // end (the terminal record) when the composed stream reaches EOF, even if a
+            // contributor stops reading the decrypted content early. A custom
+            // CreateDecryptingStreamAsync override that wraps the stream should implement
+            // IBlobAuthenticatedEndStream (and forward), or this verification is skipped.
+            IBlobAuthenticatedEndStream? authenticatedEndSource = null;
+            if (encryptionEnabled)
+            {
+                // The method owns the provider stream: it is disposed there on any failure
+                stream = await CreateDecryptingStreamAsync(blobNormalizeNaming, stream, fallbackCancellationToken);
+                authenticatedEndSource = stream as IBlobAuthenticatedEndStream;
+            }
+
+            if (contributorTypes.Count == 0)
+            {
+                // Without contributors the caller reads the decrypting stream directly, so
+                // reading it to its end verifies the terminal record on its own
+                return stream;
+            }
+
+            // Contributors run in the reverse order after the decryption; the scope stays
+            // alive until the returned (lazily transforming) stream is disposed. Resolve the
+            // tenant id once, before the scope is created, so nothing between scope creation
+            // and the successful return can throw and leak the scope or the provider stream
+            Guid? tenantId;
+            try
+            {
+                tenantId = GetTenantIdOrNull();
+            }
+            catch
+            {
+                await TryDisposeStreamAsync(stream);
+                throw;
+            }
+
+            contributorTypes.Reverse();
+            AsyncServiceScope contributorScope;
+            try
+            {
+                contributorScope = ServiceProvider.CreateAsyncScope();
+            }
+            catch
+            {
+                await TryDisposeStreamAsync(stream);
+                throw;
+            }
+
+            var context = new BlobPipelineContext(
+                contributorScope.ServiceProvider,
+                blobNormalizeNaming.ContainerName!,
+                blobNormalizeNaming.BlobName!,
+                Configuration,
+                tenantId,
+                stream,
+                fallbackCancellationToken
+            );
+
+            try
+            {
+                await RunPipelineAsync(context, contributorTypes, saving: false);
+
+                return new BlobPipelineScopeStream(context.BlobStream, contributorScope, CurrentTenant, tenantId, authenticatedEndSource);
+            }
+            catch
+            {
+                // Best-effort cleanup that keeps the original exception: the current
+                // context stream owns the whole chain down to the provider stream
+                await TryDisposeStreamAsync(context.BlobStream);
+
+                try
+                {
+                    await contributorScope.DisposeAsync();
+                }
+                catch
+                {
+                    // ignored
+                }
+
+                throw;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Runs the pipeline contributors on the context stream. While saving, the context
+    /// collects every stream a contributor creates (at assignment, so intermediate
+    /// replacements within one contributor call are not lost) to be disposed by the
+    /// caller; while reading, the composed stream is returned to the caller as a whole,
+    /// so each wrapper owns the stream it received.
+    /// </summary>
+    protected virtual async Task RunPipelineAsync(
+        BlobPipelineContext context,
+        IReadOnlyList<Type> contributorTypes,
+        bool saving)
+    {
+        foreach (var contributorType in contributorTypes)
+        {
+            var contributor = (IBlobPipelineContributor)context.ServiceProvider.GetRequiredService(contributorType);
+
+            if (saving)
+            {
+                await contributor.OnSavingAsync(context);
+            }
+            else
+            {
+                await contributor.OnGettingAsync(context);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Wraps the stream for encryption. The caller keeps the ownership of
+    /// <paramref name="stream"/>; the wrapper is disposed after the provider call.
+    /// </summary>
+    protected virtual async Task<Stream> CreateEncryptingStreamAsync(BlobNormalizeNaming blobNormalizeNaming, Stream stream, CancellationToken cancellationToken)
+    {
+        // The key is fully resolved before returning, so the scope can be released here
+        var scope = ServiceProvider.CreateAsyncScope();
+        Stream? encryptingStream = null;
+        var completed = false;
+        try
+        {
+            encryptingStream = await scope.ServiceProvider
+                .GetRequiredService<IBlobEncryptionCodec>()
+                .CreateEncryptingStreamAsync(
+                    Configuration,
+                    blobNormalizeNaming.ContainerName!,
+                    blobNormalizeNaming.BlobName!,
+                    GetTenantIdOrNull(),
+                    stream,
+                    cancellationToken
+                );
+            completed = true;
+        }
+        finally
+        {
+            try
+            {
+                await scope.DisposeAsync();
+            }
+            catch
+            {
+                // A failing scope dispose must not leak the created stream (it zeroes
+                // the key) and must not replace an exception already propagating
+                if (encryptingStream != null)
+                {
+                    await TryDisposeStreamAsync(encryptingStream);
+                }
+
+                if (completed)
+                {
+                    throw;
+                }
+            }
+        }
+
+        return encryptingStream!;
+    }
+
+    /// <summary>
+    /// Wraps the provider stream for decryption. The method owns <paramref name="stream"/>:
+    /// the returned stream disposes it, and it is also disposed when this method fails.
+    /// Opening throws <see cref="AbpException"/> for format violations; reading throws
+    /// <see cref="System.Security.Cryptography.CryptographicException"/> on failed authentication.
+    /// The returned stream implements <see cref="IBlobAuthenticatedEndStream"/>, which the
+    /// content pipeline uses to verify the authenticated end on EOF. An override that wraps
+    /// the returned stream should implement that interface too (and forward), otherwise the
+    /// pipeline can not run the end verification for this container.
+    /// </summary>
+    protected virtual async Task<Stream> CreateDecryptingStreamAsync(BlobNormalizeNaming blobNormalizeNaming, Stream stream, CancellationToken cancellationToken)
+    {
+        AsyncServiceScope scope;
+        try
+        {
+            scope = ServiceProvider.CreateAsyncScope();
+        }
+        catch
+        {
+            await TryDisposeStreamAsync(stream);
+            throw;
+        }
+
+        Stream? decryptingStream = null;
+        var completed = false;
+        try
+        {
+            decryptingStream = await scope.ServiceProvider
+                .GetRequiredService<IBlobEncryptionCodec>()
+                .CreateDecryptingStreamAsync(
+                    Configuration,
+                    blobNormalizeNaming.ContainerName!,
+                    blobNormalizeNaming.BlobName!,
+                    GetTenantIdOrNull(),
+                    stream,
+                    cancellationToken
+                );
+            completed = true;
+        }
+        catch
+        {
+            // Best-effort cleanup that keeps the original exception
+            await TryDisposeStreamAsync(stream);
+            throw;
+        }
+        finally
+        {
+            try
+            {
+                await scope.DisposeAsync();
+            }
+            catch
+            {
+                // A failing scope dispose must not leak the created stream (it zeroes
+                // the key and disposes the provider stream — exactly once, since the
+                // caller does not dispose after this method) and must not replace an
+                // exception already propagating
+                if (decryptingStream != null)
+                {
+                    await TryDisposeStreamAsync(decryptingStream);
+                }
+
+                if (completed)
+                {
+                    throw;
+                }
+            }
+        }
+
+        return decryptingStream!;
+    }
+
+    protected virtual async Task DisposeStreamAsync(Stream stream)
+    {
+#if NETSTANDARD2_0
+        // Stream has no DisposeAsync on netstandard2.0, but a stream may still implement
+        // IAsyncDisposable (via Microsoft.Bcl.AsyncInterfaces) for its async-only cleanup
+        if (stream is IAsyncDisposable asyncDisposable)
+        {
+            await asyncDisposable.DisposeAsync();
+        }
+        else
+        {
+            stream.Dispose();
+        }
+#else
+        // Also covers wrappers that only implement DisposeAsync
+        await stream.DisposeAsync();
+#endif
+    }
+
+    protected virtual async Task TryDisposeStreamAsync(Stream stream)
+    {
+        try
+        {
+            await DisposeStreamAsync(stream);
+        }
+        catch
+        {
+            // ignored: best-effort cleanup during exception handling
         }
     }
 

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobContainerConfiguration.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using JetBrains.Annotations;
 using Volo.Abp.Collections;
 
@@ -32,6 +33,19 @@ public class BlobContainerConfiguration
 
     public ITypeList<IBlobNamingNormalizer> NamingNormalizers { get; }
 
+    /// <summary>
+    /// The <see cref="IBlobPipelineContributor"/> implementations transforming
+    /// the content of this container while it is saved and read.
+    /// </summary>
+    public ITypeList<IBlobPipelineContributor> PipelineContributors { get; }
+
+    /// <summary>
+    /// Set false to stop inheriting the pipeline contributors of the default
+    /// container configuration, so only the own <see cref="PipelineContributors"/>
+    /// of this container run. Default: true.
+    /// </summary>
+    public bool InheritPipelineContributors { get; set; } = true;
+
     [NotNull] private readonly Dictionary<string, object?> _properties;
 
     private readonly BlobContainerConfiguration? _fallbackConfiguration;
@@ -39,6 +53,7 @@ public class BlobContainerConfiguration
     public BlobContainerConfiguration(BlobContainerConfiguration? fallbackConfiguration = null)
     {
         NamingNormalizers = new TypeList<IBlobNamingNormalizer>();
+        PipelineContributors = new TypeList<IBlobPipelineContributor>();
         _fallbackConfiguration = fallbackConfiguration;
         _properties = new Dictionary<string, object?>();
     }
@@ -57,6 +72,26 @@ public class BlobContainerConfiguration
         return NamingNormalizers;
     }
 
+    /// <summary>
+    /// Returns the pipeline contributors in effect for this container: the contributors
+    /// of the fallback (default) configuration first, then the own ones (each contributor
+    /// type runs once). Contributors are provider-independent content transformations,
+    /// so overriding <see cref="ProviderType"/> does not reset the inherited ones; use
+    /// <see cref="InheritPipelineContributors"/> to opt out of the inherited ones.
+    /// </summary>
+    public IEnumerable<Type> GetEffectivePipelineContributors()
+    {
+        if (_fallbackConfiguration == null || !InheritPipelineContributors)
+        {
+            return PipelineContributors.Distinct();
+        }
+
+        return _fallbackConfiguration
+            .GetEffectivePipelineContributors()
+            .Concat(PipelineContributors)
+            .Distinct();
+    }
+
     public T? GetConfigurationOrDefault<T>(string name, T? defaultValue = default)
     {
         return (T?)GetConfigurationOrNull(name, defaultValue);

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobContainerConfigurationEncryptionExtensions.cs

@@ -0,0 +1,99 @@
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+public static class BlobContainerConfigurationEncryptionExtensions
+{
+    /// <summary>
+    /// Enables encryption for the BLOBs of this container. Calling it again is safe:
+    /// omitted parameters keep the already configured (or inherited) values,
+    /// so multiple modules can compose the configuration.
+    /// </summary>
+    /// <param name="containerConfiguration">The container configuration.</param>
+    /// <param name="passPhrase">
+    /// Optional container-specific passphrase. Without one, the passphrase is resolved
+    /// by the <see cref="IBlobEncryptionKeyProvider"/>. Use
+    /// <see cref="ClearEncryptionPassPhrase"/> to remove a configured passphrase.
+    /// </param>
+    /// <param name="allowLegacyPlainText">
+    /// Allows reading BLOBs stored as plaintext before encryption was enabled:
+    /// content without the encrypted format header is then returned as-is,
+    /// <b>without any authenticity check</b>. Keep it disabled (default) unless
+    /// the container really has such BLOBs.
+    /// </param>
+    public static BlobContainerConfiguration UseEncryption(
+        [NotNull] this BlobContainerConfiguration containerConfiguration,
+        string? passPhrase = null,
+        bool? allowLegacyPlainText = null)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        // Validate all arguments before touching the configuration, so a failed
+        // call does not leave it partially modified
+        if (passPhrase != null)
+        {
+            Check.NotNullOrWhiteSpace(passPhrase, nameof(passPhrase));
+        }
+
+        containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.Enabled, true);
+
+        if (allowLegacyPlainText.HasValue)
+        {
+            containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.AllowLegacyPlainText, allowLegacyPlainText.Value);
+        }
+
+        if (passPhrase != null)
+        {
+            containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.PassPhrase, passPhrase);
+        }
+
+        return containerConfiguration;
+    }
+
+    /// <summary>
+    /// Indicates whether encryption is enabled for this container (own or inherited
+    /// configuration). Storage providers can use it to detect a transformed content stream.
+    /// </summary>
+    public static bool IsEncryptionEnabled([NotNull] this BlobContainerConfiguration containerConfiguration)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        return BlobEncryptionConfiguration.IsEnabled(containerConfiguration);
+    }
+
+    /// <summary>
+    /// Removes the container passphrase (including an inherited one), so the
+    /// <see cref="IBlobEncryptionKeyProvider"/> resolves the passphrase again.
+    /// BLOBs encrypted with the removed passphrase can not be read anymore.
+    /// </summary>
+    public static BlobContainerConfiguration ClearEncryptionPassPhrase(
+        [NotNull] this BlobContainerConfiguration containerConfiguration)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        // An explicit empty value shadows a passphrase inherited from the
+        // default (fallback) container configuration.
+        containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.PassPhrase, string.Empty);
+
+        return containerConfiguration;
+    }
+
+    /// <summary>
+    /// Disables encryption for this container (even when inherited from the default
+    /// configuration) and removes its own passphrase/legacy options. Existing encrypted
+    /// BLOBs are then returned as stored (still encrypted bytes) while reading — unless
+    /// the container also has pipeline contributors, which still run and typically fail
+    /// on the ciphertext.
+    /// </summary>
+    public static BlobContainerConfiguration DisableEncryption(
+        [NotNull] this BlobContainerConfiguration containerConfiguration)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.Enabled, false);
+        containerConfiguration.ClearConfiguration(BlobEncryptionConfigurationNames.PassPhrase);
+        containerConfiguration.ClearConfiguration(BlobEncryptionConfigurationNames.AllowLegacyPlainText);
+
+        return containerConfiguration;
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionCodec.cs

@@ -0,0 +1,693 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Implements the encrypted BLOB format (version 1) using AES-256-GCM.
+/// Not available on .NET Standard 2.0 (no AES-GCM).
+/// <para>
+/// Format: "ABPE" magic (4) + format version (1) + header (34: algorithm 1,
+/// key source 1, KDF iterations 4, random per-BLOB KDF salt 16, chunk size 4,
+/// base nonce 8), followed by authenticated chunk records (4-byte big-endian
+/// cipher length, cipher chunk, 16-byte tag) and an authenticated zero-length
+/// terminal record. The whole prefix, the storage identity (container, BLOB
+/// name, tenant) and the chunk index are bound to every chunk as associated
+/// data; the per-BLOB salt gives every BLOB its own derived key.
+/// </para>
+/// </summary>
+public class BlobEncryptionCodec : IBlobEncryptionCodec, ITransientDependency
+{
+    internal static readonly byte[] Magic = { (byte)'A', (byte)'B', (byte)'P', (byte)'E' };
+
+    internal const byte FormatVersion = 1;
+    internal const byte AlgorithmAesGcm = 1;
+    internal const int MinKdfIterations = 100_000;
+    internal const int MaxKdfIterations = 600_000; // reader cap: bounded headroom above the writer constant
+    internal const int KdfSaltSize = 16;
+    internal const int ChunkSize = 64 * 1024;
+    internal const int MaxChunkSize = 1024 * 1024; // reader cap: bounds allocations driven by the (pre-authentication) header
+    internal const int BaseNonceSize = 8;
+    internal const int HeaderSize = 34; // algorithm(1) + keySource(1) + iterations(4) + salt(16) + chunkSize(4) + baseNonce(8)
+    internal const int ChunkLengthPrefixSize = 4;
+    internal const int GcmNonceSize = 12;
+    internal const int GcmTagSize = 16;
+
+    // Rejects invalid UTF-16 instead of silently replacing it: the default encoder
+    // folds different unpaired surrogates into the same replacement bytes, which
+    // would let two different names produce the same authenticated identity
+    private static readonly Encoding StrictUtf8 = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false, throwOnInvalidBytes: true);
+
+    protected IBlobEncryptionKeyProvider KeyProvider { get; }
+
+    protected AbpBlobStoringEncryptionOptions Options { get; }
+
+    public BlobEncryptionCodec(
+        IBlobEncryptionKeyProvider keyProvider,
+        IOptions<AbpBlobStoringEncryptionOptions> options)
+    {
+        KeyProvider = keyProvider;
+        Options = options.Value;
+    }
+
+    /// <inheritdoc />
+    // The key is fully resolved before the stream is returned, so the resolution scope can be released.
+    public virtual async Task<Stream> CreateEncryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream plainStream,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(configuration, nameof(configuration));
+        Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        Check.NotNull(plainStream, nameof(plainStream));
+
+#if NETSTANDARD2_0
+        // Fail before any output is produced, so no partial (corrupted) data is ever written.
+        throw new PlatformNotSupportedException("BLOB encryption requires AES-GCM, which is not available on .NET Standard 2.0!");
+#else
+#if NET8_0_OR_GREATER
+        if (!AesGcm.IsSupported)
+        {
+            throw new PlatformNotSupportedException("AES-GCM is not supported on this platform!");
+        }
+#else
+        // netstandard2.1 has no AesGcm.IsSupported; constructing an instance is the only
+        // probe that fails here instead of after the provider has opened the target
+        using (CreateAesGcm(new byte[32]))
+        {
+        }
+#endif
+        var kdfIterations = Options.KdfIterations;
+        if (kdfIterations < MinKdfIterations || kdfIterations > MaxKdfIterations)
+        {
+            throw new AbpException(
+                $"{nameof(AbpBlobStoringEncryptionOptions)}.{nameof(AbpBlobStoringEncryptionOptions.KdfIterations)} " +
+                $"must be between {MinKdfIterations} and {MaxKdfIterations}!");
+        }
+
+        var key = await KeyProvider.ResolveForEncryptionAsync(
+            new BlobEncryptionKeyContext(configuration, containerName, blobName, tenantId),
+            cancellationToken);
+
+        var salt = new byte[KdfSaltSize];
+        var baseNonce = new byte[BaseNonceSize];
+        using (var random = RandomNumberGenerator.Create())
+        {
+            random.GetBytes(salt);
+            random.GetBytes(baseNonce);
+        }
+
+        var header = BuildHeader(key.Source, kdfIterations, salt, ChunkSize, baseNonce);
+        var blobPrefix = CreateBlobPrefix(header);
+        // The AAD can reject invalid names; build it before deriving the key, so
+        // no derived key is left un-zeroed on the rejection path
+        var associatedDataPrefix = BuildAssociatedDataPrefix(blobPrefix, containerName, blobName, tenantId);
+        var encryptedLength = TryCalculateEncryptedLength(plainStream, ChunkSize);
+        var keyBytes = DeriveKeyBytesOrThrowIfCancelled(key.PassPhrase, salt, kdfIterations, cancellationToken);
+
+        return new ChunkedEncryptingReadStream(
+            plainStream,
+            blobPrefix,
+            associatedDataPrefix,
+            keyBytes,
+            baseNonce,
+            ChunkSize,
+            encryptedLength
+        );
+#endif
+    }
+
+    /// <inheritdoc />
+    public virtual async Task<Stream> CreateDecryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream cipherStream,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(configuration, nameof(configuration));
+        Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        Check.NotNull(cipherStream, nameof(cipherStream));
+
+        var prefix = await ReadUpToAsync(cipherStream, Magic.Length + 1, cancellationToken);
+        if (!StartsWithMagic(prefix))
+        {
+            if (BlobEncryptionConfiguration.IsLegacyPlainTextAllowed(configuration))
+            {
+                return new PrefixingReadStream(prefix, cipherStream);
+            }
+
+            throw new AbpException(
+                "The BLOB does not have the encrypted BLOB format. If it was stored before encryption " +
+                "was enabled for the container, enable reading legacy plaintext BLOBs explicitly " +
+                "(see the UseEncryption extension method). Otherwise the BLOB is corrupted or tampered."
+            );
+        }
+
+        // The full magic already identifies the encrypted format: content truncated
+        // right after it must fail as corrupted, not fall back to legacy plaintext
+        if (prefix.Length < Magic.Length + 1)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: missing format version!");
+        }
+
+        if (prefix[Magic.Length] != FormatVersion)
+        {
+            throw new AbpException($"Unsupported encrypted BLOB format version: {prefix[Magic.Length]}!");
+        }
+
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("BLOB decryption requires AES-GCM, which is not available on .NET Standard 2.0!");
+#else
+#if NET8_0_OR_GREATER
+        if (!AesGcm.IsSupported)
+        {
+            throw new PlatformNotSupportedException("AES-GCM is not supported on this platform!");
+        }
+#else
+        // netstandard2.1 has no AesGcm.IsSupported; constructing an instance is the only
+        // probe that fails here instead of after the key is resolved and derived
+        using (CreateAesGcm(new byte[32]))
+        {
+        }
+#endif
+        var header = await ReadExactlyAsync(cipherStream, HeaderSize, cancellationToken);
+        if (header == null)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: missing header!");
+        }
+
+        if (header[0] != AlgorithmAesGcm)
+        {
+            throw new AbpException($"Unsupported encrypted BLOB algorithm: {header[0]}!");
+        }
+
+        var keySource = header[1];
+        if (keySource < (byte)BlobEncryptionKeySource.Container || keySource > (byte)BlobEncryptionKeySource.Global)
+        {
+            throw new AbpException($"Unknown BLOB encryption key source: {keySource}!");
+        }
+
+        var iterations = ReadInt32BigEndian(header, 2);
+        if (iterations < MinKdfIterations || iterations > MaxKdfIterations)
+        {
+            // Accepting fewer iterations than any legitimate writer ever used would let
+            // attacker-crafted content turn reads into a cheap passphrase-guessing oracle
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid KDF iteration count!");
+        }
+
+        var salt = new byte[KdfSaltSize];
+        Array.Copy(header, 6, salt, 0, KdfSaltSize);
+
+        var chunkSize = ReadInt32BigEndian(header, 22);
+        if (chunkSize <= 0 || chunkSize > MaxChunkSize)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid chunk size!");
+        }
+
+        var baseNonce = new byte[BaseNonceSize];
+        Array.Copy(header, 26, baseNonce, 0, BaseNonceSize);
+
+        var blobPrefix = new byte[Magic.Length + 1 + HeaderSize];
+        Array.Copy(prefix, 0, blobPrefix, 0, Magic.Length + 1);
+        Array.Copy(header, 0, blobPrefix, Magic.Length + 1, HeaderSize);
+        // The AAD can reject invalid names; build it before deriving the key, so
+        // no derived key is left un-zeroed on the rejection path
+        var associatedDataPrefix = BuildAssociatedDataPrefix(blobPrefix, containerName, blobName, tenantId);
+
+        var passPhrase = await KeyProvider.ResolveForDecryptionAsync(
+            (BlobEncryptionKeySource)keySource,
+            new BlobEncryptionKeyContext(configuration, containerName, blobName, tenantId),
+            cancellationToken
+        );
+        var keyBytes = DeriveKeyBytesOrThrowIfCancelled(passPhrase, salt, iterations, cancellationToken);
+
+        return new ChunkedDecryptingReadStream(
+            cipherStream,
+            associatedDataPrefix,
+            keyBytes,
+            baseNonce,
+            chunkSize
+        );
+#endif
+    }
+
+    internal static byte[] BuildHeader(BlobEncryptionKeySource keySource, int iterations, byte[] salt, int chunkSize, byte[] baseNonce)
+    {
+        var header = new byte[HeaderSize];
+        header[0] = AlgorithmAesGcm;
+        header[1] = (byte)keySource;
+        WriteInt32BigEndian(header, 2, iterations);
+        Array.Copy(salt, 0, header, 6, KdfSaltSize);
+        WriteInt32BigEndian(header, 22, chunkSize);
+        Array.Copy(baseNonce, 0, header, 26, BaseNonceSize);
+        return header;
+    }
+
+    // Length-prefixed identity fields: a validly encrypted BLOB can not be read
+    // from another BLOB name, container or tenant.
+    internal static byte[] BuildAssociatedDataPrefix(byte[] blobPrefix, string containerName, string blobName, Guid? tenantId)
+    {
+        byte[] containerNameBytes;
+        byte[] blobNameBytes;
+        try
+        {
+            containerNameBytes = StrictUtf8.GetBytes(containerName);
+            blobNameBytes = StrictUtf8.GetBytes(blobName);
+        }
+        catch (EncoderFallbackException ex)
+        {
+            throw new AbpException("The container/BLOB name contains invalid characters (unpaired surrogates), so it can not be bound to the encrypted content!", ex);
+        }
+        var tenantIdBytes = tenantId?.ToByteArray() ?? Array.Empty<byte>();
+
+        var prefix = new byte[blobPrefix.Length + 4 + containerNameBytes.Length + 4 + blobNameBytes.Length + 4 + tenantIdBytes.Length];
+        var offset = 0;
+
+        Array.Copy(blobPrefix, 0, prefix, offset, blobPrefix.Length);
+        offset += blobPrefix.Length;
+
+        offset = WriteLengthPrefixed(prefix, offset, containerNameBytes);
+        offset = WriteLengthPrefixed(prefix, offset, blobNameBytes);
+        WriteLengthPrefixed(prefix, offset, tenantIdBytes);
+
+        return prefix;
+    }
+
+    private static int WriteLengthPrefixed(byte[] buffer, int offset, byte[] bytes)
+    {
+        WriteInt32BigEndian(buffer, offset, bytes.Length);
+        Array.Copy(bytes, 0, buffer, offset + 4, bytes.Length);
+        return offset + 4 + bytes.Length;
+    }
+
+    internal static byte[] CreateBlobPrefix(byte[] header)
+    {
+        var prefix = new byte[Magic.Length + 1 + header.Length];
+        Magic.CopyTo(prefix, 0);
+        prefix[Magic.Length] = FormatVersion;
+        Array.Copy(header, 0, prefix, Magic.Length + 1, header.Length);
+        return prefix;
+    }
+
+    // The synchronous PBKDF2 can not observe the token itself; check before the
+    // (expensive) derivation and once more after it, so a cancellation during the
+    // derivation is not lost
+    private static byte[] DeriveKeyBytesOrThrowIfCancelled(string passPhrase, byte[] salt, int iterations, CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        var keyBytes = DeriveKeyBytes(passPhrase, salt, iterations);
+
+        if (cancellationToken.IsCancellationRequested)
+        {
+#if !NETSTANDARD2_0
+            CryptographicOperations.ZeroMemory(keyBytes);
+#endif
+            cancellationToken.ThrowIfCancellationRequested();
+        }
+
+        return keyBytes;
+    }
+
+    internal static byte[] DeriveKeyBytes(string passPhrase, byte[] salt, int iterations)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("BLOB encryption requires AES-GCM, which is not available on .NET Standard 2.0!");
+#else
+        // Encode the passphrase to bytes with strict UTF-8 explicitly, so every target
+        // framework derives the same key and an invalid passphrase (unpaired surrogates)
+        // is rejected the same way — the string overloads differ across frameworks (net8+
+        // throws on invalid UTF-16, netstandard2.1 silently replaces it)
+        byte[] passwordBytes;
+        try
+        {
+            passwordBytes = StrictUtf8.GetBytes(passPhrase);
+        }
+        catch (EncoderFallbackException ex)
+        {
+            throw new AbpException("The BLOB encryption passphrase contains invalid characters (unpaired surrogates)!", ex);
+        }
+
+        try
+        {
+#if NET8_0_OR_GREATER
+            return Rfc2898DeriveBytes.Pbkdf2(passwordBytes, salt, iterations, HashAlgorithmName.SHA256, 32);
+#else
+            using var password = new Rfc2898DeriveBytes(passwordBytes, salt, iterations, HashAlgorithmName.SHA256);
+            return password.GetBytes(32);
+#endif
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(passwordBytes);
+        }
+#endif
+    }
+
+    // One AES-GCM instance is bound to the per-BLOB key and reused for every chunk, so a
+    // stream sets up the key schedule once instead of per chunk. Typed as IDisposable so the
+    // streams that hold it still compile on netstandard2.0 (where creation throws first).
+    internal static IDisposable CreateChunkCipher(byte[] keyBytes)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        return CreateAesGcm(keyBytes);
+#endif
+    }
+
+    internal static byte[] EncryptChunk(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex, byte[] plainChunk, int plainChunkLength)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            return EncryptChunkCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex), plainChunk, plainChunkLength);
+        }
+    }
+
+    // The cipher, associated data and nonce are passed in fully built so the streams can reuse
+    // one of each and only rewrite the trailing chunk index, instead of reconstructing the
+    // AES-GCM key schedule and reallocating the whole identity (which grows with the
+    // container/BLOB name) for every chunk
+    internal static byte[] EncryptChunkCore(IDisposable cipher, byte[] associatedData, byte[] nonce, byte[] plainChunk, int plainChunkLength)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        var record = new byte[ChunkLengthPrefixSize + plainChunkLength + GcmTagSize];
+        WriteInt32BigEndian(record, 0, plainChunkLength);
+
+        ((AesGcm)cipher).Encrypt(
+            nonce,
+            plainChunk.AsSpan(0, plainChunkLength),
+            record.AsSpan(ChunkLengthPrefixSize, plainChunkLength),
+            record.AsSpan(ChunkLengthPrefixSize + plainChunkLength, GcmTagSize),
+            associatedData
+        );
+
+        return record;
+#endif
+    }
+
+    internal static byte[] DecryptChunk(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex, byte[] cipherChunk, byte[] tag)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            return DecryptChunkCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex), cipherChunk, tag);
+        }
+    }
+
+    internal static byte[] DecryptChunkCore(IDisposable cipher, byte[] associatedData, byte[] nonce, byte[] cipherChunk, byte[] tag)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        var plainChunk = new byte[cipherChunk.Length];
+        // Throws CryptographicException if the authentication tag is invalid.
+        ((AesGcm)cipher).Decrypt(nonce, cipherChunk, tag, plainChunk, associatedData);
+
+        return plainChunk;
+#endif
+    }
+
+    // The authenticated terminal record makes truncation of complete chunks detectable
+    internal static byte[] CreateTerminalRecord(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            return CreateTerminalRecordCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex));
+        }
+    }
+
+    internal static byte[] CreateTerminalRecordCore(IDisposable cipher, byte[] associatedData, byte[] nonce)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        var record = new byte[ChunkLengthPrefixSize + GcmTagSize];
+        ((AesGcm)cipher).Encrypt(
+            nonce,
+            Array.Empty<byte>(),
+            Array.Empty<byte>(),
+            record.AsSpan(ChunkLengthPrefixSize, GcmTagSize),
+            associatedData
+        );
+
+        return record;
+#endif
+    }
+
+    internal static void VerifyTerminalRecord(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex, byte[] tag)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            VerifyTerminalRecordCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex), tag);
+        }
+    }
+
+    internal static void VerifyTerminalRecordCore(IDisposable cipher, byte[] associatedData, byte[] nonce, byte[] tag)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        // Throws CryptographicException if the tag is invalid.
+        ((AesGcm)cipher).Decrypt(nonce, Array.Empty<byte>(), tag, Array.Empty<byte>(), associatedData);
+#endif
+    }
+
+    // Nonce = 8-byte random base + 4-byte chunk index; the per-BLOB key (random salt)
+    // makes cross-BLOB reuse harmless and the index keeps it unique within the BLOB.
+    internal static byte[] CreateChunkNonce(byte[] baseNonce, int chunkIndex)
+    {
+        if (chunkIndex < 0)
+        {
+            // A wrapped chunk index would repeat a nonce for the same key, which breaks AES-GCM.
+            throw new AbpException("The data is too large: the maximum chunk count has been exceeded!");
+        }
+
+        var nonce = new byte[GcmNonceSize];
+        Array.Copy(baseNonce, 0, nonce, 0, BaseNonceSize);
+        WriteInt32BigEndian(nonce, BaseNonceSize, chunkIndex);
+        return nonce;
+    }
+
+    internal static byte[] CreateChunkAssociatedData(byte[] associatedDataPrefix, int chunkIndex)
+    {
+        var associatedData = new byte[associatedDataPrefix.Length + 4];
+        Array.Copy(associatedDataPrefix, 0, associatedData, 0, associatedDataPrefix.Length);
+        WriteInt32BigEndian(associatedData, associatedDataPrefix.Length, chunkIndex);
+        return associatedData;
+    }
+
+    // A stream builds one nonce and one associated-data buffer with these, then rewrites only
+    // the trailing chunk index per chunk with WriteChunkIndex; both hold the index as their
+    // last 4 bytes, so the fixed prefix is copied once instead of once per chunk
+    internal static byte[] CreateReusableChunkNonce(byte[] baseNonce)
+    {
+        var nonce = new byte[GcmNonceSize];
+        Array.Copy(baseNonce, 0, nonce, 0, BaseNonceSize);
+        return nonce;
+    }
+
+    internal static byte[] CreateReusableAssociatedData(byte[] associatedDataPrefix)
+    {
+        var associatedData = new byte[associatedDataPrefix.Length + 4];
+        Array.Copy(associatedDataPrefix, 0, associatedData, 0, associatedDataPrefix.Length);
+        return associatedData;
+    }
+
+    internal static void WriteChunkIndex(byte[] nonceOrAssociatedData, int chunkIndex)
+    {
+        if (chunkIndex < 0)
+        {
+            // A wrapped chunk index would repeat a nonce for the same key, which breaks AES-GCM.
+            throw new AbpException("The data is too large: the maximum chunk count has been exceeded!");
+        }
+
+        WriteInt32BigEndian(nonceOrAssociatedData, nonceOrAssociatedData.Length - 4, chunkIndex);
+    }
+
+    internal static int GetCipherChunkSize(byte[] lengthPrefix, int maxCipherChunkSize)
+    {
+        if (lengthPrefix.Length == 0)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: missing terminal record!");
+        }
+
+        if (lengthPrefix.Length < ChunkLengthPrefixSize)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: truncated chunk!");
+        }
+
+        var cipherChunkSize = ReadInt32BigEndian(lengthPrefix, 0);
+        if (cipherChunkSize < 0 || cipherChunkSize > maxCipherChunkSize)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid chunk length!");
+        }
+
+        return cipherChunkSize;
+    }
+
+    internal static byte[]? ReadExactly(Stream stream, int count)
+    {
+        var buffer = ReadUpTo(stream, count);
+        return buffer.Length == count ? buffer : null;
+    }
+
+    internal static byte[] ReadUpTo(Stream stream, int count)
+    {
+        var buffer = new byte[count];
+        var totalReadCount = 0;
+        while (totalReadCount < count)
+        {
+            var readCount = stream.Read(buffer, totalReadCount, count - totalReadCount);
+            if (readCount == 0)
+            {
+                break;
+            }
+
+            totalReadCount += readCount;
+        }
+
+        if (totalReadCount == count)
+        {
+            return buffer;
+        }
+
+        var result = new byte[totalReadCount];
+        Array.Copy(buffer, 0, result, 0, totalReadCount);
+        return result;
+    }
+
+    internal static async Task<byte[]?> ReadExactlyAsync(Stream stream, int count, CancellationToken cancellationToken = default)
+    {
+        var buffer = await ReadUpToAsync(stream, count, cancellationToken);
+        return buffer.Length == count ? buffer : null;
+    }
+
+    internal static async Task<byte[]> ReadUpToAsync(Stream stream, int count, CancellationToken cancellationToken = default)
+    {
+        var buffer = new byte[count];
+        var totalReadCount = 0;
+        while (totalReadCount < count)
+        {
+#if NETSTANDARD2_0
+            var readCount = await stream.ReadAsync(buffer, totalReadCount, count - totalReadCount, cancellationToken);
+#else
+            // The modern overload dispatches correctly for streams that only
+            // implement ReadAsync(Memory<byte>)
+            var readCount = await stream.ReadAsync(buffer.AsMemory(totalReadCount, count - totalReadCount), cancellationToken);
+#endif
+            if (readCount == 0)
+            {
+                break;
+            }
+
+            totalReadCount += readCount;
+        }
+
+        if (totalReadCount == count)
+        {
+            return buffer;
+        }
+
+        var result = new byte[totalReadCount];
+        Array.Copy(buffer, 0, result, 0, totalReadCount);
+        return result;
+    }
+
+    private static bool StartsWithMagic(byte[] prefix)
+    {
+        if (prefix.Length < Magic.Length)
+        {
+            return false;
+        }
+
+        for (var i = 0; i < Magic.Length; i++)
+        {
+            if (prefix[i] != Magic[i])
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static long? TryCalculateEncryptedLength(Stream plainStream, int chunkSize)
+    {
+        // Not gated on CanSeek: a forward-only stream can still report Length/Position.
+        // Both are required: without Position the remaining length is unknown (the stream
+        // may already be partially consumed), and guessing it would report a wrong
+        // ciphertext length and cause a short write on length-strict providers.
+        try
+        {
+            var plainLength = plainStream.Length - plainStream.Position;
+            if (plainLength < 0)
+            {
+                return null;
+            }
+
+            var fullChunkCount = plainLength / chunkSize;
+            var chunkRecordCount = fullChunkCount + (plainLength % chunkSize > 0 ? 1 : 0) + 1; // +1: terminal record
+
+            // The chunk index (including the terminal record) is a 32-bit value; fail
+            // before any output instead of after writing terabytes of ciphertext
+            if (chunkRecordCount - 1 > int.MaxValue)
+            {
+                throw new AbpException("The content is too large for the encrypted BLOB format (chunk index overflow)!");
+            }
+
+            checked
+            {
+                return Magic.Length + 1L + HeaderSize + plainLength +
+                       chunkRecordCount * (ChunkLengthPrefixSize + GcmTagSize);
+            }
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            // The length is optional; a probe failure must not fail the save
+            return null;
+        }
+        catch (OverflowException)
+        {
+            return null;
+        }
+    }
+
+#if !NETSTANDARD2_0
+    private static AesGcm CreateAesGcm(byte[] keyBytes)
+    {
+#if NET8_0_OR_GREATER
+        return new AesGcm(keyBytes, GcmTagSize);
+#else
+        return new AesGcm(keyBytes);
+#endif
+    }
+#endif
+
+    private static void WriteInt32BigEndian(byte[] buffer, int offset, int value)
+    {
+        buffer[offset] = (byte)(value >> 24);
+        buffer[offset + 1] = (byte)(value >> 16);
+        buffer[offset + 2] = (byte)(value >> 8);
+        buffer[offset + 3] = (byte)value;
+    }
+
+    private static int ReadInt32BigEndian(byte[] buffer, int offset)
+    {
+        return (buffer[offset] << 24) | (buffer[offset + 1] << 16) | (buffer[offset + 2] << 8) | buffer[offset + 3];
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionConfiguration.cs

@@ -0,0 +1,25 @@
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Reads the encryption values of a container configuration (set by the
+/// UseEncryption/DisableEncryption extension methods, inherited over the fallback chain).
+/// </summary>
+internal static class BlobEncryptionConfiguration
+{
+    public static bool IsEnabled(BlobContainerConfiguration configuration)
+    {
+        return configuration.GetConfigurationOrDefault(BlobEncryptionConfigurationNames.Enabled, false);
+    }
+
+    public static string? GetPassPhraseOrNull(BlobContainerConfiguration configuration)
+    {
+        // An explicit empty value shadows an inherited passphrase (see UseEncryption).
+        var passPhrase = configuration.GetConfigurationOrDefault<string?>(BlobEncryptionConfigurationNames.PassPhrase);
+        return string.IsNullOrWhiteSpace(passPhrase) ? null : passPhrase;
+    }
+
+    public static bool IsLegacyPlainTextAllowed(BlobContainerConfiguration configuration)
+    {
+        return configuration.GetConfigurationOrDefault(BlobEncryptionConfigurationNames.AllowLegacyPlainText, false);
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionConfigurationNames.cs

@@ -0,0 +1,8 @@
+namespace Volo.Abp.BlobStoring;
+
+public static class BlobEncryptionConfigurationNames
+{
+    public const string Enabled = "BlobEncryption.Enabled";
+    public const string PassPhrase = "BlobEncryption.PassPhrase";
+    public const string AllowLegacyPlainText = "BlobEncryption.AllowLegacyPlainText";
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKey.cs

@@ -0,0 +1,39 @@
+using System;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// The passphrase resolved for encrypting a BLOB, together with its source.
+/// </summary>
+public class BlobEncryptionKey
+{
+    /// <summary>
+    /// The source the passphrase was resolved from; it is recorded in the encrypted
+    /// BLOB and routes the BLOB back to the same source while decrypting.
+    /// </summary>
+    public BlobEncryptionKeySource Source { get; }
+
+    /// <summary>
+    /// The passphrase the encryption key of the BLOB is derived from.
+    /// </summary>
+    [NotNull]
+    public string PassPhrase { get; }
+
+    /// <summary>
+    /// Creates the resolved key; <paramref name="source"/> must be a defined
+    /// <see cref="BlobEncryptionKeySource"/> value and the passphrase non-empty.
+    /// </summary>
+    public BlobEncryptionKey(BlobEncryptionKeySource source, [NotNull] string passPhrase)
+    {
+        if (source < BlobEncryptionKeySource.Container || source > BlobEncryptionKeySource.Global)
+        {
+            // The source is stored in the BLOB header and validated while reading;
+            // an unknown value would make the BLOB permanently unreadable.
+            throw new ArgumentException($"Unknown BLOB encryption key source: {source}!", nameof(source));
+        }
+
+        Source = source;
+        PassPhrase = Check.NotNullOrWhiteSpace(passPhrase, nameof(passPhrase));
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKeyContext.cs

@@ -0,0 +1,51 @@
+using System;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// The identity of the BLOB an encryption key is resolved for. It lets a custom
+/// <see cref="IBlobEncryptionKeyProvider"/> select the key by the container, the
+/// BLOB name or the tenant — not only by the container configuration.
+/// </summary>
+public class BlobEncryptionKeyContext
+{
+    /// <summary>
+    /// The configuration of the container the BLOB belongs to (with the container
+    /// passphrase, if one was set with <c>UseEncryption</c>).
+    /// </summary>
+    [NotNull]
+    public BlobContainerConfiguration Configuration { get; }
+
+    /// <summary>
+    /// The normalized container name.
+    /// </summary>
+    [NotNull]
+    public string ContainerName { get; }
+
+    /// <summary>
+    /// The normalized BLOB name.
+    /// </summary>
+    [NotNull]
+    public string BlobName { get; }
+
+    /// <summary>
+    /// The tenant of the BLOB operation (null for the host or a shared container).
+    /// </summary>
+    public Guid? TenantId { get; }
+
+    /// <summary>
+    /// Creates the context; the names are expected in their normalized form.
+    /// </summary>
+    public BlobEncryptionKeyContext(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId)
+    {
+        Configuration = Check.NotNull(configuration, nameof(configuration));
+        ContainerName = Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        BlobName = Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        TenantId = tenantId;
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKeySource.cs

@@ -0,0 +1,27 @@
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Identifies where the encryption passphrase of a BLOB comes from. The value is
+/// stored in the BLOB header, so decryption uses the same source again even if
+/// other sources are configured later.
+/// </summary>
+public enum BlobEncryptionKeySource : byte
+{
+    /// <summary>
+    /// The container-specific passphrase, set with
+    /// <see cref="BlobContainerConfigurationEncryptionExtensions.UseEncryption"/>.
+    /// </summary>
+    Container = 1,
+
+    /// <summary>
+    /// A tenant-specific passphrase, provided by a custom
+    /// <see cref="IBlobEncryptionKeyProvider"/>; unused by the default provider.
+    /// </summary>
+    Tenant = 2,
+
+    /// <summary>
+    /// The global passphrase, from
+    /// <see cref="AbpBlobStoringEncryptionOptions.DefaultPassPhrase"/>.
+    /// </summary>
+    Global = 3
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobPipelineContext.cs

@@ -0,0 +1,121 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using JetBrains.Annotations;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// The context an <see cref="IBlobPipelineContributor"/> works on. A contributor
+/// transforms the content by replacing <see cref="BlobStream"/> with a wrapper;
+/// see <see cref="IBlobPipelineContributor"/> for the stream ownership contract.
+/// </summary>
+public class BlobPipelineContext : IServiceProviderAccessor
+{
+    /// <summary>
+    /// The scoped service provider of the pipeline. While saving, the scope stays
+    /// alive until the save operation completes; while getting, until the stream
+    /// returned to the caller is disposed — so lazily transforming wrappers can
+    /// keep using their scoped services.
+    /// </summary>
+    [NotNull]
+    public IServiceProvider ServiceProvider { get; }
+
+    /// <summary>
+    /// The normalized container name.
+    /// </summary>
+    [NotNull]
+    public string ContainerName { get; }
+
+    /// <summary>
+    /// The normalized BLOB name.
+    /// </summary>
+    [NotNull]
+    public string BlobName { get; }
+
+    /// <summary>
+    /// The configuration of the container the BLOB belongs to.
+    /// </summary>
+    [NotNull]
+    public BlobContainerConfiguration Configuration { get; }
+
+    /// <summary>
+    /// The tenant of the BLOB operation (null for the host or a shared container).
+    /// </summary>
+    public Guid? TenantId { get; }
+
+    /// <summary>
+    /// The cancellation token of the BLOB operation. Pass it to any I/O the contributor
+    /// performs while <see cref="IBlobPipelineContributor.OnSavingAsync"/> /
+    /// <see cref="IBlobPipelineContributor.OnGettingAsync"/> runs. A lazy read wrapper
+    /// returned from <c>OnGettingAsync</c> must instead honor the token passed to each of
+    /// its own <c>Read</c>/<c>ReadAsync</c> calls (this token is captured once at
+    /// <c>GetAsync</c> time and is not updated per read).
+    /// </summary>
+    public CancellationToken CancellationToken { get; }
+
+    /// <summary>
+    /// The content stream. Replace it with a (typically lazily transforming,
+    /// read-only) wrapper to transform the content.
+    /// </summary>
+    [NotNull]
+    public Stream BlobStream {
+        get => _blobStream;
+        set
+        {
+            _blobStream = Check.NotNull(value, nameof(value));
+            TrackCreatedStream(value);
+        }
+    }
+    private Stream _blobStream;
+
+    private readonly Stream _initialStream;
+
+    // While saving, every stream the pipeline creates is collected here (at
+    // assignment, so intermediate replacements within one contributor call are
+    // not lost) to be disposed after the save; the initial (caller-owned)
+    // stream is never collected. Null while getting.
+    internal List<Stream>? CreatedStreams { get; set; }
+
+    /// <summary>
+    /// Creates the context; the names are expected in their normalized form and
+    /// <paramref name="blobStream"/> is the initial (untransformed) content.
+    /// </summary>
+    public BlobPipelineContext(
+        [NotNull] IServiceProvider serviceProvider,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        [NotNull] BlobContainerConfiguration configuration,
+        Guid? tenantId,
+        [NotNull] Stream blobStream,
+        CancellationToken cancellationToken = default)
+    {
+        ServiceProvider = Check.NotNull(serviceProvider, nameof(serviceProvider));
+        ContainerName = Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        BlobName = Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        Configuration = Check.NotNull(configuration, nameof(configuration));
+        TenantId = tenantId;
+        _initialStream = _blobStream = Check.NotNull(blobStream, nameof(blobStream));
+        CancellationToken = cancellationToken;
+    }
+
+    private void TrackCreatedStream(Stream stream)
+    {
+        if (CreatedStreams == null || ReferenceEquals(stream, _initialStream))
+        {
+            return;
+        }
+
+        foreach (var existingStream in CreatedStreams)
+        {
+            if (ReferenceEquals(existingStream, stream))
+            {
+                return;
+            }
+        }
+
+        CreatedStreams.Add(stream);
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobPipelineScopeStream.cs

@@ -0,0 +1,488 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.MultiTenancy;
+using Volo.Abp.Threading;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Keeps the service scope and the tenant context of the pipeline contributors
+/// until the returned (lazily transforming) stream is disposed: every member the
+/// wrappers may run work in — including the disposal of the scope itself — executes
+/// in the tenant the BLOB belongs to, not in the ambient tenant of the caller.
+/// </summary>
+internal sealed class BlobPipelineScopeStream : Stream
+{
+    private readonly Stream _inner;
+    private readonly AsyncServiceScope _scope;
+    private readonly ICurrentTenant _currentTenant;
+    private readonly Guid? _tenantId;
+    private readonly IBlobAuthenticatedEndStream? _authenticatedEndSource;
+    private bool _authenticatedEndChecked;
+    private bool _faulted;
+    private bool _disposed;
+
+    public BlobPipelineScopeStream(
+        Stream inner,
+        AsyncServiceScope scope,
+        ICurrentTenant currentTenant,
+        Guid? tenantId,
+        IBlobAuthenticatedEndStream? authenticatedEndSource = null)
+    {
+        _inner = inner;
+        _scope = scope;
+        _currentTenant = currentTenant;
+        _tenantId = tenantId;
+        // When encryption is enabled, this is the innermost decrypting stream. Its
+        // terminal record is verified when this composed stream reaches EOF, so a
+        // contributor that stops before the content ends can not hide a truncation.
+        _authenticatedEndSource = authenticatedEndSource;
+    }
+
+    public override bool CanRead
+    {
+        get
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.CanRead;
+            }
+        }
+    }
+
+    private void EnsureNotDisposed()
+    {
+        if (_disposed)
+        {
+            throw new ObjectDisposedException(GetType().FullName);
+        }
+    }
+
+    public override bool CanSeek
+    {
+        get
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.CanSeek;
+            }
+        }
+    }
+
+    public override bool CanWrite => false;
+
+    public override bool CanTimeout
+    {
+        get
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.CanTimeout;
+            }
+        }
+    }
+
+    public override int ReadTimeout
+    {
+        get
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.ReadTimeout;
+            }
+        }
+        set
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                _inner.ReadTimeout = value;
+            }
+        }
+    }
+
+    public override long Length
+    {
+        get
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.Length;
+            }
+        }
+    }
+
+    public override long Position
+    {
+        get
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.Position;
+            }
+        }
+        set
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                _inner.Position = value;
+            }
+        }
+    }
+
+    public override void Flush()
+    {
+        EnsureNotDisposed();
+        using (_currentTenant.Change(_tenantId))
+        {
+            _inner.Flush();
+        }
+    }
+
+    public override async Task FlushAsync(CancellationToken cancellationToken)
+    {
+        EnsureNotDisposed();
+        using (_currentTenant.Change(_tenantId))
+        {
+            await _inner.FlushAsync(cancellationToken);
+        }
+    }
+
+    public override int Read(byte[] buffer, int offset, int count)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+                read = _inner.Read(buffer, offset, count);
+            }
+            catch
+            {
+                // A failed read faults permanently, so a retry layer can not silently continue
+                // from a position where an inner contributor already consumed bytes
+                _faulted = true;
+                throw;
+            }
+
+            VerifyAuthenticatedEndIfNeeded(read, count);
+            return read;
+        }
+    }
+
+    public override async Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        // A token cancelled before any I/O leaves the stream untouched (and healthy for a
+        // retry); once a read has started, any failure faults it permanently
+        cancellationToken.ThrowIfCancellationRequested();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+#if NETSTANDARD2_0
+                read = await _inner.ReadAsync(buffer, offset, count, cancellationToken);
+#else
+                // Dispatch over the modern overload, so a wrapper that only implements
+                // ReadAsync(Memory<byte>) also works for callers of the old overload
+                read = await _inner.ReadAsync(buffer.AsMemory(offset, count), cancellationToken);
+#endif
+            }
+            catch
+            {
+                _faulted = true;
+                throw;
+            }
+
+            await VerifyAuthenticatedEndIfNeededAsync(read, count, cancellationToken);
+            return read;
+        }
+    }
+
+    // Runs when the composed stream reaches EOF on a real (non-zero-count) read. A
+    // legitimate partial read (stopping early and disposing) never reaches EOF, so it
+    // is not affected. A failed check faults the stream permanently, so a read-retry
+    // layer can not swallow the integrity error and later see a normal EOF.
+    private void VerifyAuthenticatedEndIfNeeded(int read, int count)
+    {
+        if (read != 0 || count == 0 || _authenticatedEndChecked || _authenticatedEndSource == null)
+        {
+            return;
+        }
+
+        try
+        {
+            _authenticatedEndSource.EnsureReadToAuthenticatedEnd();
+            _authenticatedEndChecked = true;
+        }
+        catch
+        {
+            // The check ran and failed on integrity: mark it done and fault permanently
+            _authenticatedEndChecked = true;
+            _faulted = true;
+            throw;
+        }
+    }
+
+    private async ValueTask VerifyAuthenticatedEndIfNeededAsync(int read, int count, CancellationToken cancellationToken)
+    {
+        if (read != 0 || count == 0 || _authenticatedEndChecked || _authenticatedEndSource == null)
+        {
+            return;
+        }
+
+        // A token cancelled before the check runs leaves it un-run and the stream healthy, so
+        // a retry with a live token can still verify the end
+        cancellationToken.ThrowIfCancellationRequested();
+        try
+        {
+            await _authenticatedEndSource.EnsureReadToAuthenticatedEndAsync(cancellationToken);
+            _authenticatedEndChecked = true;
+        }
+        catch (OperationCanceledException)
+        {
+            // The decrypting stream owns the consumption state and faults itself on a mid-read
+            // cancellation; a cancellation it lets through without faulting (for example the
+            // token trips in the gap after the check above) leaves it healthy, so the outer
+            // must not fault either — a retry with a live token can still verify the end
+            throw;
+        }
+        catch
+        {
+            // A real integrity failure is permanent, so a read-retry layer can not swallow it
+            // and later see a normal EOF
+            _authenticatedEndChecked = true;
+            _faulted = true;
+            throw;
+        }
+    }
+
+    private void EnsureNotFaulted()
+    {
+        if (_faulted)
+        {
+            throw new AbpException("The stream can not be read anymore, because a previous read operation has failed!");
+        }
+    }
+
+#if !NETSTANDARD2_0
+    // Forwarded so a wrapper that only implements the modern overloads is not
+    // degraded to the byte[] fallback of the base class
+    public override int Read(Span<byte> buffer)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+                read = _inner.Read(buffer);
+            }
+            catch
+            {
+                _faulted = true;
+                throw;
+            }
+
+            VerifyAuthenticatedEndIfNeeded(read, buffer.Length);
+            return read;
+        }
+    }
+
+    public override async ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        cancellationToken.ThrowIfCancellationRequested();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+                read = await _inner.ReadAsync(buffer, cancellationToken);
+            }
+            catch
+            {
+                _faulted = true;
+                throw;
+            }
+
+            await VerifyAuthenticatedEndIfNeededAsync(read, buffer.Length, cancellationToken);
+            return read;
+        }
+    }
+#endif
+
+    public override long Seek(long offset, SeekOrigin origin)
+    {
+        EnsureNotDisposed();
+        using (_currentTenant.Change(_tenantId))
+        {
+            return _inner.Seek(offset, origin);
+        }
+    }
+
+    public override void SetLength(long value)
+    {
+        throw new NotSupportedException();
+    }
+
+    public override void Write(byte[] buffer, int offset, int count)
+    {
+        throw new NotSupportedException();
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && !_disposed)
+        {
+            _disposed = true;
+
+            // The tenant context is best-effort: failing to enter it must not skip the
+            // resource release (which would leak the provider stream, the scope and the
+            // derived key), and a later dispose can not recover it since _disposed is set
+            IDisposable? tenantChange = null;
+            try
+            {
+                tenantChange = _currentTenant.Change(_tenantId);
+            }
+            catch
+            {
+                // ignored: release the resources below without the tenant context
+            }
+
+            try
+            {
+                DisposeInnerAndScope();
+            }
+            finally
+            {
+                tenantChange?.Dispose();
+            }
+        }
+
+        base.Dispose(disposing);
+    }
+
+    private void DisposeInnerAndScope()
+    {
+        try
+        {
+#if NETSTANDARD2_0
+            // Stream has no DisposeAsync on netstandard2.0, but the inner stream
+            // may still implement IAsyncDisposable for its async-only cleanup
+            if (_inner is IAsyncDisposable innerAsyncDisposable)
+            {
+                AsyncHelper.RunSync(() => innerAsyncDisposable.DisposeAsync().AsTask());
+            }
+            else
+            {
+                _inner.Dispose();
+            }
+#else
+            // Also covers wrappers that only implement DisposeAsync
+            AsyncHelper.RunSync(() => _inner.DisposeAsync().AsTask());
+#endif
+        }
+        catch
+        {
+            // The stream failure is the root cause; a scope dispose
+            // failure on top of it must not replace it
+            try
+            {
+                AsyncHelper.RunSync(() => _scope.DisposeAsync().AsTask());
+            }
+            catch
+            {
+                // ignored
+            }
+
+            throw;
+        }
+
+        // A synchronous scope dispose throws when a scoped service only
+        // implements IAsyncDisposable, so always release it asynchronously
+        AsyncHelper.RunSync(() => _scope.DisposeAsync().AsTask());
+    }
+
+#if !NETSTANDARD2_0
+    public override async ValueTask DisposeAsync()
+    {
+        if (!_disposed)
+        {
+            _disposed = true;
+
+            IDisposable? tenantChange = null;
+            try
+            {
+                tenantChange = _currentTenant.Change(_tenantId);
+            }
+            catch
+            {
+                // ignored: release the resources below without the tenant context
+            }
+
+            try
+            {
+                await DisposeInnerAndScopeAsync();
+            }
+            finally
+            {
+                tenantChange?.Dispose();
+            }
+        }
+
+        await base.DisposeAsync();
+    }
+
+    private async ValueTask DisposeInnerAndScopeAsync()
+    {
+        try
+        {
+            await _inner.DisposeAsync();
+        }
+        catch
+        {
+            try
+            {
+                await _scope.DisposeAsync();
+            }
+            catch
+            {
+                // ignored: the stream failure is the root cause
+            }
+
+            throw;
+        }
+
+        await _scope.DisposeAsync();
+    }
+#endif
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/ChunkedCryptoReadStream.cs

@@ -0,0 +1,181 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// A read-only, non-seekable stream that serves output produced chunk by chunk.
+/// </summary>
+internal abstract class ChunkedCryptoReadStream : SequentialReadStream
+{
+    private readonly long? _length;
+    private byte[]? _outputBuffer;
+    private int _outputBufferPosition;
+    private long _position;
+    private bool _finished;
+
+    protected ChunkedCryptoReadStream(long? length = null)
+    {
+        _length = length;
+    }
+
+    public override long Length => _length ?? throw new NotSupportedException();
+
+    // Some storage SDKs (like AWS S3) compute the upload size as Length - Position,
+    // so the getter reports the number of bytes served so far instead of throwing.
+    public override long Position
+    {
+        get => _position;
+        set => throw new NotSupportedException();
+    }
+
+    protected sealed override int ReadCore(byte[] buffer, int offset, int count)
+    {
+        while (true)
+        {
+            var copiedCount = TryCopyFromOutputBuffer(buffer, offset, count);
+            if (copiedCount > 0 || _finished)
+            {
+                return copiedCount;
+            }
+
+            SetOutputBuffer(ProduceNext());
+        }
+    }
+
+    protected sealed override async Task<int> ReadCoreAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        while (true)
+        {
+            var copiedCount = TryCopyFromOutputBuffer(buffer, offset, count);
+            if (copiedCount > 0 || _finished)
+            {
+                return copiedCount;
+            }
+
+            SetOutputBuffer(await ProduceNextAsync(cancellationToken));
+        }
+    }
+
+    /// <summary>
+    /// Produces the next output bytes, or null when there is no more output.
+    /// </summary>
+    protected abstract byte[]? ProduceNext();
+
+    protected abstract Task<byte[]?> ProduceNextAsync(CancellationToken cancellationToken);
+
+    internal void EnsureReadToAuthenticatedEndCore()
+    {
+        // A previous read that faulted the stream (for example an authentication failure
+        // a contributor swallowed) must not be recovered by re-entering ProduceNext here
+        EnsureCanServe();
+        try
+        {
+            if (IsAtAuthenticatedEnd())
+            {
+                return;
+            }
+
+            // Producing the next record either verifies the terminal record (null) or
+            // returns another content chunk, which means the consumer stopped early
+            ThrowIfMoreContent(ProduceNext());
+        }
+        catch
+        {
+            // Fault the stream so the failure can not be swallowed by reading again
+            MarkFaulted();
+            throw;
+        }
+    }
+
+    internal async ValueTask EnsureReadToAuthenticatedEndCoreAsync(CancellationToken cancellationToken)
+    {
+        EnsureCanServe();
+        // A token cancelled before any I/O leaves the stream untouched, so it can stay
+        // healthy for a retry (the same rule the normal read path applies). Once a read has
+        // started, any failure must fault: a mid-read cancellation already consumed and
+        // discarded bytes of the non-seekable cipher stream, so a retry that resumed from the
+        // middle of the terminal record would misreport a valid BLOB as corrupt
+        cancellationToken.ThrowIfCancellationRequested();
+        try
+        {
+            if (IsAtAuthenticatedEnd())
+            {
+                return;
+            }
+
+            ThrowIfMoreContent(await ProduceNextAsync(cancellationToken));
+        }
+        catch
+        {
+            MarkFaulted();
+            throw;
+        }
+    }
+
+    private bool IsAtAuthenticatedEnd()
+    {
+        if (_finished)
+        {
+            return true;
+        }
+
+        if (_outputBuffer != null && _outputBufferPosition < _outputBuffer.Length)
+        {
+            throw new AbpException(
+                "The encrypted BLOB was not read to its authenticated end, so its completeness can not be verified " +
+                "(a content-pipeline contributor stopped reading the content before the end).");
+        }
+
+        return false;
+    }
+
+    private void ThrowIfMoreContent(byte[]? next)
+    {
+        if (next != null)
+        {
+            throw new AbpException(
+                "The encrypted BLOB was not read to its authenticated end, so its completeness can not be verified " +
+                "(a content-pipeline contributor stopped reading the content before the end).");
+        }
+
+        SetOutputBuffer(null);
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && _outputBuffer != null)
+        {
+            Array.Clear(_outputBuffer, 0, _outputBuffer.Length);
+            _outputBuffer = null;
+        }
+
+        base.Dispose(disposing);
+    }
+
+    private int TryCopyFromOutputBuffer(byte[] buffer, int offset, int count)
+    {
+        if (_outputBuffer == null || _outputBufferPosition >= _outputBuffer.Length)
+        {
+            return 0;
+        }
+
+        var toCopy = Math.Min(count, _outputBuffer.Length - _outputBufferPosition);
+        Array.Copy(_outputBuffer, _outputBufferPosition, buffer, offset, toCopy);
+        _outputBufferPosition += toCopy;
+        _position += toCopy;
+        return toCopy;
+    }
+
+    private void SetOutputBuffer(byte[]? outputBuffer)
+    {
+        _outputBuffer = outputBuffer;
+        _outputBufferPosition = 0;
+
+        if (outputBuffer == null)
+        {
+            _finished = true;
+        }
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/ChunkedDecryptingReadStream.cs

@@ -0,0 +1,180 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+using Volo.Abp.Threading;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Decrypts the cipher stream chunk by chunk while being read. It is the only stream
+/// with an authenticated terminal record, so it is the one implementing
+/// <see cref="IBlobAuthenticatedEndStream"/>.
+/// </summary>
+internal class ChunkedDecryptingReadStream : ChunkedCryptoReadStream, IBlobAuthenticatedEndStream
+{
+    private readonly Stream _cipherStream;
+    private readonly byte[] _associatedData;
+    private readonly byte[] _keyBytes;
+    private readonly IDisposable _chunkCipher;
+    private readonly byte[] _nonce;
+    private readonly int _chunkSize;
+    private int _chunkIndex;
+    private bool _disposed;
+
+    public ChunkedDecryptingReadStream(
+        Stream cipherStream,
+        byte[] associatedDataPrefix,
+        byte[] keyBytes,
+        byte[] baseNonce,
+        int chunkSize)
+    {
+        _cipherStream = cipherStream;
+        // One reusable cipher and buffer each; only the trailing chunk index changes per chunk
+        _associatedData = BlobEncryptionCodec.CreateReusableAssociatedData(associatedDataPrefix);
+        _keyBytes = keyBytes;
+        _chunkCipher = BlobEncryptionCodec.CreateChunkCipher(keyBytes);
+        _nonce = BlobEncryptionCodec.CreateReusableChunkNonce(baseNonce);
+        _chunkSize = chunkSize;
+    }
+
+    public void EnsureReadToAuthenticatedEnd()
+    {
+        EnsureReadToAuthenticatedEndCore();
+    }
+
+    public ValueTask EnsureReadToAuthenticatedEndAsync(CancellationToken cancellationToken = default)
+    {
+        return EnsureReadToAuthenticatedEndCoreAsync(cancellationToken);
+    }
+
+    protected override byte[]? ProduceNext()
+    {
+        var cipherChunkSize = BlobEncryptionCodec.GetCipherChunkSize(
+            BlobEncryptionCodec.ReadUpTo(_cipherStream, BlobEncryptionCodec.ChunkLengthPrefixSize),
+            _chunkSize
+        );
+        if (cipherChunkSize == 0)
+        {
+            var terminalTag = BlobEncryptionCodec.ReadExactly(_cipherStream, BlobEncryptionCodec.GcmTagSize);
+            if (terminalTag == null || BlobEncryptionCodec.ReadUpTo(_cipherStream, 1).Length != 0)
+            {
+                throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid terminal record!");
+            }
+
+            SetChunkIndex(_chunkIndex);
+            BlobEncryptionCodec.VerifyTerminalRecordCore(_chunkCipher, _associatedData, _nonce, terminalTag);
+            return null;
+        }
+
+        return DecryptPayload(
+            BlobEncryptionCodec.ReadExactly(_cipherStream, cipherChunkSize),
+            BlobEncryptionCodec.ReadExactly(_cipherStream, BlobEncryptionCodec.GcmTagSize)
+        );
+    }
+
+    protected override async Task<byte[]?> ProduceNextAsync(CancellationToken cancellationToken)
+    {
+        var cipherChunkSize = BlobEncryptionCodec.GetCipherChunkSize(
+            await BlobEncryptionCodec.ReadUpToAsync(_cipherStream, BlobEncryptionCodec.ChunkLengthPrefixSize, cancellationToken),
+            _chunkSize
+        );
+        if (cipherChunkSize == 0)
+        {
+            var terminalTag = await BlobEncryptionCodec.ReadExactlyAsync(_cipherStream, BlobEncryptionCodec.GcmTagSize, cancellationToken);
+            if (terminalTag == null || (await BlobEncryptionCodec.ReadUpToAsync(_cipherStream, 1, cancellationToken)).Length != 0)
+            {
+                throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid terminal record!");
+            }
+
+            SetChunkIndex(_chunkIndex);
+            BlobEncryptionCodec.VerifyTerminalRecordCore(_chunkCipher, _associatedData, _nonce, terminalTag);
+            return null;
+        }
+
+        return DecryptPayload(
+            await BlobEncryptionCodec.ReadExactlyAsync(_cipherStream, cipherChunkSize, cancellationToken),
+            await BlobEncryptionCodec.ReadExactlyAsync(_cipherStream, BlobEncryptionCodec.GcmTagSize, cancellationToken)
+        );
+    }
+
+    private byte[] DecryptPayload(byte[]? cipherChunk, byte[]? tag)
+    {
+        if (cipherChunk == null || tag == null)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: truncated chunk!");
+        }
+
+        SetChunkIndex(_chunkIndex);
+        var plainChunk = BlobEncryptionCodec.DecryptChunkCore(_chunkCipher, _associatedData, _nonce, cipherChunk, tag);
+        _chunkIndex++;
+        return plainChunk;
+    }
+
+    private void SetChunkIndex(int chunkIndex)
+    {
+        BlobEncryptionCodec.WriteChunkIndex(_nonce, chunkIndex);
+        BlobEncryptionCodec.WriteChunkIndex(_associatedData, chunkIndex);
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && !_disposed)
+        {
+            _disposed = true;
+            _chunkCipher.Dispose();
+            ClearKeyBytes();
+            try
+            {
+#if NETSTANDARD2_0
+                _cipherStream.Dispose();
+#else
+                // Also covers a provider stream that only implements DisposeAsync
+                AsyncHelper.RunSync(() => _cipherStream.DisposeAsync().AsTask());
+#endif
+            }
+            finally
+            {
+                base.Dispose(disposing);
+            }
+
+            return;
+        }
+
+        base.Dispose(disposing);
+    }
+
+#if !NETSTANDARD2_0
+    public override async ValueTask DisposeAsync()
+    {
+        if (!_disposed)
+        {
+            _disposed = true;
+            _chunkCipher.Dispose();
+            ClearKeyBytes();
+            try
+            {
+                await _cipherStream.DisposeAsync();
+            }
+            finally
+            {
+                await base.DisposeAsync();
+            }
+
+            return;
+        }
+
+        await base.DisposeAsync();
+    }
+#endif
+
+    private void ClearKeyBytes()
+    {
+#if NETSTANDARD2_0
+        Array.Clear(_keyBytes, 0, _keyBytes.Length);
+#else
+        CryptographicOperations.ZeroMemory(_keyBytes);
+#endif
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/ChunkedEncryptingReadStream.cs

@@ -0,0 +1,124 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Encrypts the source stream chunk by chunk while being read.
+/// </summary>
+internal class ChunkedEncryptingReadStream : ChunkedCryptoReadStream
+{
+    private readonly Stream _plainStream;
+    private readonly byte[] _prefix;
+    private readonly byte[] _associatedData;
+    private readonly byte[] _keyBytes;
+    private readonly IDisposable _chunkCipher;
+    private readonly byte[] _nonce;
+    private readonly int _chunkSize;
+    private bool _prefixEmitted;
+    private bool _terminalEmitted;
+    private int _chunkIndex;
+
+    public ChunkedEncryptingReadStream(
+        Stream plainStream,
+        byte[] prefix,
+        byte[] associatedDataPrefix,
+        byte[] keyBytes,
+        byte[] baseNonce,
+        int chunkSize,
+        long? encryptedLength)
+        : base(encryptedLength)
+    {
+        _plainStream = plainStream;
+        _prefix = prefix;
+        // One reusable cipher and buffer each; only the trailing chunk index changes per chunk
+        _associatedData = BlobEncryptionCodec.CreateReusableAssociatedData(associatedDataPrefix);
+        _keyBytes = keyBytes;
+        _chunkCipher = BlobEncryptionCodec.CreateChunkCipher(keyBytes);
+        _nonce = BlobEncryptionCodec.CreateReusableChunkNonce(baseNonce);
+        _chunkSize = chunkSize;
+    }
+
+    protected override byte[]? ProduceNext()
+    {
+        var prefix = TryProducePrefix();
+        if (prefix != null)
+        {
+            return prefix;
+        }
+
+        return ProducePayload(BlobEncryptionCodec.ReadUpTo(_plainStream, _chunkSize));
+    }
+
+    protected override async Task<byte[]?> ProduceNextAsync(CancellationToken cancellationToken)
+    {
+        var prefix = TryProducePrefix();
+        if (prefix != null)
+        {
+            return prefix;
+        }
+
+        return ProducePayload(await BlobEncryptionCodec.ReadUpToAsync(_plainStream, _chunkSize, cancellationToken));
+    }
+
+    private byte[]? TryProducePrefix()
+    {
+        if (_prefixEmitted)
+        {
+            return null;
+        }
+
+        _prefixEmitted = true;
+        return _prefix;
+    }
+
+    private byte[]? ProducePayload(byte[] plainChunk)
+    {
+        if (plainChunk.Length == 0)
+        {
+            if (_terminalEmitted)
+            {
+                return null;
+            }
+
+            _terminalEmitted = true;
+            SetChunkIndex(_chunkIndex);
+            return BlobEncryptionCodec.CreateTerminalRecordCore(_chunkCipher, _associatedData, _nonce);
+        }
+
+        SetChunkIndex(_chunkIndex);
+        var chunkBytes = BlobEncryptionCodec.EncryptChunkCore(_chunkCipher, _associatedData, _nonce, plainChunk, plainChunk.Length);
+        _chunkIndex++;
+        return chunkBytes;
+    }
+
+    private void SetChunkIndex(int chunkIndex)
+    {
+        BlobEncryptionCodec.WriteChunkIndex(_nonce, chunkIndex);
+        BlobEncryptionCodec.WriteChunkIndex(_associatedData, chunkIndex);
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        // Do not dispose the plain stream; it is owned by the caller.
+        if (disposing)
+        {
+            _chunkCipher.Dispose();
+            ClearKeyBytes();
+        }
+
+        base.Dispose(disposing);
+    }
+
+    private void ClearKeyBytes()
+    {
+#if NETSTANDARD2_0
+        Array.Clear(_keyBytes, 0, _keyBytes.Length);
+#else
+        CryptographicOperations.ZeroMemory(_keyBytes);
+#endif
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/DefaultBlobEncryptionKeyProvider.cs

@@ -0,0 +1,97 @@
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Resolves the container passphrase first, then the global
+/// <see cref="AbpBlobStoringEncryptionOptions.DefaultPassPhrase"/>; decryption uses
+/// only the source recorded in the BLOB header. Replace this service for
+/// tenant-specific or externally stored passphrases.
+/// </summary>
+public class DefaultBlobEncryptionKeyProvider : IBlobEncryptionKeyProvider, ITransientDependency
+{
+    protected AbpBlobStoringEncryptionOptions Options { get; }
+
+    public DefaultBlobEncryptionKeyProvider(IOptions<AbpBlobStoringEncryptionOptions> options)
+    {
+        Options = options.Value;
+    }
+
+    /// <inheritdoc />
+    public virtual Task<BlobEncryptionKey> ResolveForEncryptionAsync(
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(context, nameof(context));
+        cancellationToken.ThrowIfCancellationRequested();
+
+        var containerPassPhrase = GetContainerPassPhraseOrNull(context.Configuration);
+        if (!string.IsNullOrWhiteSpace(containerPassPhrase))
+        {
+            return Task.FromResult(new BlobEncryptionKey(BlobEncryptionKeySource.Container, containerPassPhrase!));
+        }
+
+        if (!string.IsNullOrWhiteSpace(Options.DefaultPassPhrase))
+        {
+            return Task.FromResult(new BlobEncryptionKey(BlobEncryptionKeySource.Global, Options.DefaultPassPhrase!));
+        }
+
+        throw new AbpException(
+            "BLOB encryption is enabled, but no passphrase could be resolved. " +
+            "Pass a passphrase to the UseEncryption extension method or configure " +
+            $"{nameof(AbpBlobStoringEncryptionOptions)}.{nameof(AbpBlobStoringEncryptionOptions.DefaultPassPhrase)}."
+        );
+    }
+
+    /// <inheritdoc />
+    public virtual Task<string> ResolveForDecryptionAsync(
+        BlobEncryptionKeySource keySource,
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(context, nameof(context));
+        cancellationToken.ThrowIfCancellationRequested();
+
+        string? passPhrase;
+        switch (keySource)
+        {
+            case BlobEncryptionKeySource.Container:
+                passPhrase = GetContainerPassPhraseOrNull(context.Configuration);
+                break;
+            case BlobEncryptionKeySource.Tenant:
+                throw new AbpException(
+                    "The BLOB was encrypted with a tenant-specific passphrase, but the default " +
+                    $"key provider does not supply tenant keys. Replace the {nameof(IBlobEncryptionKeyProvider)} " +
+                    "service with the implementation that was used to encrypt the BLOB."
+                );
+            case BlobEncryptionKeySource.Global:
+                passPhrase = Options.DefaultPassPhrase;
+                break;
+            default:
+                throw new AbpException($"Unknown BLOB encryption key source: {keySource}!");
+        }
+
+        if (string.IsNullOrWhiteSpace(passPhrase))
+        {
+            throw new AbpException(
+                $"The BLOB was encrypted with the '{keySource}' passphrase, " +
+                "but that passphrase is not available anymore, so the BLOB can not be decrypted."
+            );
+        }
+
+        return Task.FromResult(passPhrase!);
+    }
+
+    /// <summary>
+    /// Returns the container-specific passphrase, so derived providers can keep it
+    /// as the highest-priority source.
+    /// </summary>
+    protected virtual string? GetContainerPassPhraseOrNull(BlobContainerConfiguration configuration)
+    {
+        return BlobEncryptionConfiguration.GetPassPhraseOrNull(configuration);
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobAuthenticatedEndStream.cs

@@ -0,0 +1,26 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Implemented by a read stream (like the decrypting stream) that can verify it was
+/// read to an authenticated end. The content pipeline calls it when the composed
+/// stream returned by <c>GetAsync</c> reaches EOF, so a contributor stopping before
+/// the end can not hide a truncation. A stream that wraps such a stream (for example
+/// a custom <c>CreateDecryptingStreamAsync</c> override) should implement this
+/// interface too and forward the calls to the wrapped stream, or the end verification
+/// is skipped for pipeline reads.
+/// </summary>
+public interface IBlobAuthenticatedEndStream
+{
+    /// <summary>
+    /// Throws if the stream has not been consumed up to its authenticated end.
+    /// </summary>
+    void EnsureReadToAuthenticatedEnd();
+
+    /// <summary>
+    /// Throws if the stream has not been consumed up to its authenticated end.
+    /// </summary>
+    ValueTask EnsureReadToAuthenticatedEndAsync(CancellationToken cancellationToken = default);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobEncryptionCodec.cs

@@ -0,0 +1,41 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Encrypts and decrypts the BLOB content stream (authenticated, chunked AES-256-GCM).
+/// Replace this service to change the encryption format or algorithm; the built-in
+/// <see cref="BlobEncryptionCodec"/> implements version 1 of the format.
+/// </summary>
+public interface IBlobEncryptionCodec
+{
+    /// <summary>
+    /// Wraps <paramref name="plainStream"/> in a read-only stream that encrypts the
+    /// content while it is read. The container and BLOB names are expected in their
+    /// normalized form.
+    /// </summary>
+    Task<Stream> CreateEncryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream plainStream,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Wraps <paramref name="cipherStream"/> in a read-only stream that decrypts the
+    /// content while it is read. The container and BLOB names are expected in their
+    /// normalized form.
+    /// </summary>
+    Task<Stream> CreateDecryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream cipherStream,
+        CancellationToken cancellationToken = default);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobEncryptionKeyProvider.cs

@@ -0,0 +1,32 @@
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Resolves the passphrase used to encrypt/decrypt the BLOBs of a container.
+/// Replace this service to read the passphrases from another source, like a vault
+/// or another secret store (the provider must be able to return the passphrase
+/// itself; hardware-backed non-exportable keys are not supported). The
+/// <see cref="BlobEncryptionKeyContext"/> carries the container/BLOB name and the
+/// tenant, so the passphrase can be selected by the BLOB identity too.
+/// </summary>
+public interface IBlobEncryptionKeyProvider
+{
+    /// <summary>
+    /// Resolves the passphrase (and its source) to encrypt a new BLOB; throws if none is available.
+    /// </summary>
+    Task<BlobEncryptionKey> ResolveForEncryptionAsync(
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Resolves the passphrase for the key source recorded in the BLOB header;
+    /// throws if it is not available anymore.
+    /// </summary>
+    Task<string> ResolveForDecryptionAsync(
+        BlobEncryptionKeySource keySource,
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobPipelineContributor.cs

@@ -0,0 +1,41 @@
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Transforms the BLOB content stream (compression, watermarking, validation...)
+/// while it is saved and read. Contributors are configured per container with
+/// <see cref="BlobContainerConfiguration.PipelineContributors"/> and run in the
+/// configuration order while saving and in the reverse order while reading.
+/// The built-in encryption always runs after the contributors while saving (and
+/// before them while reading), so contributors always work on the plain content.
+/// </summary>
+public interface IBlobPipelineContributor
+{
+    /// <summary>
+    /// Transform the content by replacing <see cref="BlobPipelineContext.BlobStream"/>:
+    /// with a lazily transforming read-only wrapper (best for large content), or with an
+    /// eagerly materialized stream. A replacement must leave the stream it received open:
+    /// every stream <b>assigned</b> to <see cref="BlobPipelineContext.BlobStream"/> is disposed
+    /// after the save, while the original stream stays owned by the caller. A stream is only
+    /// tracked from the moment it is assigned, so if you create a stream and then do work
+    /// that may fail before assigning it, dispose it yourself on the failure path.
+    /// <para>
+    /// Not replacing the stream is only valid for a contributor that does not consume the
+    /// content (for example a metadata check). A contributor that reads the content to
+    /// validate it must return a pass-through wrapper that validates the bytes as they
+    /// flow (or an eagerly materialized replacement) — reading the content without
+    /// replacing the stream would leave an empty/truncated stream for the provider.
+    /// </para>
+    /// </summary>
+    Task OnSavingAsync([NotNull] BlobPipelineContext context);
+
+    /// <summary>
+    /// Reverse the save-time transformation by replacing
+    /// <see cref="BlobPipelineContext.BlobStream"/> the same way. Here a replacement
+    /// must dispose the stream it received when it is disposed, since the composed
+    /// stream is returned to the caller as a whole.
+    /// </summary>
+    Task OnGettingAsync([NotNull] BlobPipelineContext context);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/PrefixingReadStream.cs

@@ -0,0 +1,155 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Volo.Abp.Threading;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Serves the already-consumed prefix bytes first, then the rest of the underlying stream.
+/// </summary>
+internal sealed class PrefixingReadStream : SequentialReadStream
+{
+    private readonly byte[] _prefix;
+    private readonly Stream _stream;
+    private readonly long? _length;
+    private int _prefixPosition;
+
+    public PrefixingReadStream(byte[] prefix, Stream stream)
+    {
+        _prefix = prefix;
+        _stream = stream;
+
+        // What this stream serves is the prefix plus whatever remains of the underlying
+        // stream from its current position — not the underlying total length, which
+        // would overstate it when the provider stream did not start at position 0
+        try
+        {
+            _length = _prefix.Length + (_stream.Length - _stream.Position);
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            _length = null;
+        }
+    }
+
+    public override bool CanRead => !IsDisposed && _stream.CanRead;
+
+    // Legacy plaintext BLOBs had a usable Length before encryption was enabled; it is
+    // known when the underlying stream reports both its length and position. Position
+    // reports the bytes served, so Length - Position stays meaningful for length-aware
+    // consumers (like re-encrypting the legacy content)
+    public override long Length => _length ?? throw new NotSupportedException();
+
+    public override long Position
+    {
+        get => _position;
+        set => throw new NotSupportedException();
+    }
+
+    private long _position;
+
+    protected override int ReadCore(byte[] buffer, int offset, int count)
+    {
+        var prefixReadCount = TryCopyFromPrefix(buffer, offset, count);
+        if (prefixReadCount > 0)
+        {
+            _position += prefixReadCount;
+            return prefixReadCount;
+        }
+
+        var readCount = _stream.Read(buffer, offset, count);
+        _position += readCount;
+        return readCount;
+    }
+
+    protected override async Task<int> ReadCoreAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        var prefixReadCount = TryCopyFromPrefix(buffer, offset, count);
+        if (prefixReadCount > 0)
+        {
+            _position += prefixReadCount;
+            return prefixReadCount;
+        }
+
+#if NETSTANDARD2_0
+        var readCount = await _stream.ReadAsync(buffer, offset, count, cancellationToken);
+#else
+        // The modern overload dispatches correctly for streams that only
+        // implement ReadAsync(Memory<byte>)
+        var readCount = await _stream.ReadAsync(buffer.AsMemory(offset, count), cancellationToken);
+#endif
+        _position += readCount;
+        return readCount;
+    }
+
+    private int TryCopyFromPrefix(byte[] buffer, int offset, int count)
+    {
+        if (_prefixPosition >= _prefix.Length)
+        {
+            return 0;
+        }
+
+        var readCount = Math.Min(count, _prefix.Length - _prefixPosition);
+        Array.Copy(_prefix, _prefixPosition, buffer, offset, readCount);
+        _prefixPosition += readCount;
+        return readCount;
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && !IsDisposed)
+        {
+            IsDisposed = true;
+            try
+            {
+#if NETSTANDARD2_0
+                // Stream has no DisposeAsync on netstandard2.0, but the provider stream
+                // may still implement IAsyncDisposable for its async-only cleanup
+                if (_stream is IAsyncDisposable asyncDisposable)
+                {
+                    AsyncHelper.RunSync(() => asyncDisposable.DisposeAsync().AsTask());
+                }
+                else
+                {
+                    _stream.Dispose();
+                }
+#else
+                // Also covers a provider stream that only implements DisposeAsync
+                AsyncHelper.RunSync(() => _stream.DisposeAsync().AsTask());
+#endif
+            }
+            finally
+            {
+                base.Dispose(disposing);
+            }
+
+            return;
+        }
+
+        base.Dispose(disposing);
+    }
+
+#if !NETSTANDARD2_0
+    public override async ValueTask DisposeAsync()
+    {
+        if (!IsDisposed)
+        {
+            IsDisposed = true;
+            try
+            {
+                await _stream.DisposeAsync();
+            }
+            finally
+            {
+                await base.DisposeAsync();
+            }
+
+            return;
+        }
+
+        await base.DisposeAsync();
+    }
+#endif
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/SequentialReadStream.cs

@@ -0,0 +1,146 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// A read-only, non-seekable, forward-only stream; a failed read faults it permanently.
+/// </summary>
+internal abstract class SequentialReadStream : Stream
+{
+    private bool _faulted;
+
+    protected bool IsDisposed { get; set; }
+
+    // Once faulted, no further read can succeed; a failed authenticated-end check
+    // uses it so the failure can not be swallowed by a read-retry layer
+    protected void MarkFaulted()
+    {
+        _faulted = true;
+    }
+
+    // False once disposed, so it stays consistent with Read throwing ObjectDisposedException
+    public override bool CanRead => !IsDisposed;
+
+    public override bool CanSeek => false;
+
+    public override bool CanWrite => false;
+
+    public override long Length => throw new NotSupportedException();
+
+    public override long Position
+    {
+        get => throw new NotSupportedException();
+        set => throw new NotSupportedException();
+    }
+
+    public override void Flush()
+    {
+    }
+
+    public override int Read(byte[] buffer, int offset, int count)
+    {
+        ValidateReadArguments(buffer, offset, count);
+        EnsureCanServe();
+
+        if (count == 0)
+        {
+            return 0;
+        }
+
+        try
+        {
+            return ReadCore(buffer, offset, count);
+        }
+        catch
+        {
+            _faulted = true;
+            throw;
+        }
+    }
+
+    public override async Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        ValidateReadArguments(buffer, offset, count);
+        EnsureCanServe();
+        cancellationToken.ThrowIfCancellationRequested();
+
+        if (count == 0)
+        {
+            return 0;
+        }
+
+        try
+        {
+            return await ReadCoreAsync(buffer, offset, count, cancellationToken);
+        }
+        catch
+        {
+            _faulted = true;
+            throw;
+        }
+    }
+
+    protected abstract int ReadCore(byte[] buffer, int offset, int count);
+
+    protected abstract Task<int> ReadCoreAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken);
+
+    public override long Seek(long offset, SeekOrigin origin)
+    {
+        throw new NotSupportedException();
+    }
+
+    public override void SetLength(long value)
+    {
+        throw new NotSupportedException();
+    }
+
+    public override void Write(byte[] buffer, int offset, int count)
+    {
+        throw new NotSupportedException();
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        IsDisposed = true;
+        base.Dispose(disposing);
+    }
+
+    protected void EnsureCanServe()
+    {
+        if (IsDisposed)
+        {
+            throw new ObjectDisposedException(GetType().FullName);
+        }
+
+        if (_faulted)
+        {
+            throw new AbpException("The stream can not be read anymore, because a previous read operation has failed!");
+        }
+    }
+
+    private static void ValidateReadArguments(byte[] buffer, int offset, int count)
+    {
+        if (buffer == null)
+        {
+            throw new ArgumentNullException(nameof(buffer));
+        }
+
+        if (offset < 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(offset));
+        }
+
+        if (count < 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(count));
+        }
+
+        if (buffer.Length - offset < count)
+        {
+            throw new ArgumentException("The sum of offset and count is larger than the buffer length!");
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Aws.Tests/Volo/Abp/BlobStoring/Aws/AwsBlobProviderUploadDecision_Tests.cs

@@ -0,0 +1,104 @@
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Shouldly;
+using Xunit;
+
+namespace Volo.Abp.BlobStoring.Aws;
+
+public class AwsBlobProviderUploadDecision_Tests
+{
+    private readonly ExposedAwsBlobProvider _provider = new ExposedAwsBlobProvider();
+
+    [Fact]
+    public void Should_Keep_The_Plain_PutObject_Behavior_For_Untransformed_Containers()
+    {
+        // A non-seekable stream of a container without encryption/pipeline
+        // must be uploaded exactly like before
+        var args = CreateArgs(new BlobContainerConfiguration(), new NonSeekableStream());
+
+        _provider.RequiresRetrySafeUploadPublic(args).ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Should_Use_The_Retry_Safe_Upload_For_An_Encrypted_Container()
+    {
+        var configuration = new BlobContainerConfiguration().UseEncryption("test-passphrase");
+        var args = CreateArgs(configuration, new NonSeekableStream());
+
+        _provider.RequiresRetrySafeUploadPublic(args).ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Should_Use_The_Retry_Safe_Upload_For_A_Container_With_PipelineContributors()
+    {
+        var configuration = new BlobContainerConfiguration();
+        configuration.PipelineContributors.Add<FakePipelineContributor>();
+        var args = CreateArgs(configuration, new NonSeekableStream());
+
+        _provider.RequiresRetrySafeUploadPublic(args).ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Should_Not_Use_The_Retry_Safe_Upload_For_A_Seekable_Stream()
+    {
+        var configuration = new BlobContainerConfiguration().UseEncryption("test-passphrase");
+        var args = CreateArgs(configuration, new MemoryStream());
+
+        _provider.RequiresRetrySafeUploadPublic(args).ShouldBeFalse();
+    }
+
+    private static BlobProviderSaveArgs CreateArgs(BlobContainerConfiguration configuration, Stream stream)
+    {
+        return new BlobProviderSaveArgs("test-container", configuration, "test-blob", stream);
+    }
+
+    private sealed class ExposedAwsBlobProvider : AwsBlobProvider
+    {
+        public ExposedAwsBlobProvider()
+            : base(null!, null!, null!)
+        {
+        }
+
+        public bool RequiresRetrySafeUploadPublic(BlobProviderSaveArgs args)
+        {
+            return RequiresRetrySafeUpload(args);
+        }
+    }
+
+    private sealed class FakePipelineContributor : IBlobPipelineContributor
+    {
+        public Task OnSavingAsync(BlobPipelineContext context)
+        {
+            return Task.CompletedTask;
+        }
+
+        public Task OnGettingAsync(BlobPipelineContext context)
+        {
+            return Task.CompletedTask;
+        }
+    }
+
+    private sealed class NonSeekableStream : Stream
+    {
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => 0;
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+    }
+}

framework/test/Volo.Abp.BlobStoring.Aws.Tests/Volo/Abp/BlobStoring/Aws/AwsBlobProviderUploadRequest_Tests.cs

@@ -0,0 +1,84 @@
+using System.IO;
+using Amazon.S3.Model;
+using Amazon.S3.Transfer;
+using Shouldly;
+using Xunit;
+
+namespace Volo.Abp.BlobStoring.Aws;
+
+public class AwsBlobProviderUploadRequest_Tests
+{
+    private readonly ExposedAwsBlobProvider _provider = new ExposedAwsBlobProvider();
+
+    [Fact]
+    public void Should_Wrap_The_Stream_And_Disable_Auto_Close_For_A_Multipart_Request()
+    {
+        // The SDK's non-seekable multipart path ignores AutoCloseStream and disposes the
+        // input, so the source must be protected by the leave-open wrapper
+        var source = new MemoryStream();
+        var configuration = new AwsBlobProviderConfiguration(new BlobContainerConfiguration()) { DisablePayloadSigning = true };
+
+        var request = _provider.CreateMultipartUploadRequestPublic("bucket", "key", source, configuration);
+
+        request.InputStream.ShouldBeOfType<LeaveOpenStreamWrapper>();
+        request.AutoCloseStream.ShouldBeFalse();
+        request.DisablePayloadSigning.ShouldBe(true);
+        request.BucketName.ShouldBe("bucket");
+        request.Key.ShouldBe("key");
+    }
+
+    [Fact]
+    public void Should_Keep_The_Source_Open_After_The_Multipart_Input_Is_Disposed()
+    {
+        var source = new MemoryStream();
+        var configuration = new AwsBlobProviderConfiguration(new BlobContainerConfiguration());
+
+        var request = _provider.CreateMultipartUploadRequestPublic("bucket", "key", source, configuration);
+        request.InputStream.Dispose(); // the SDK disposes the input on the multipart path
+
+        source.CanRead.ShouldBeTrue(); // the wrapper must have left the source open
+    }
+
+    [Fact]
+    public void Should_Propagate_Disable_Payload_Signing_And_Keep_Ownership_For_A_Put_Object_Request()
+    {
+        var source = new MemoryStream();
+        var configuration = new AwsBlobProviderConfiguration(new BlobContainerConfiguration()) { DisablePayloadSigning = true };
+
+        var request = _provider.CreatePutObjectRequestPublic("bucket", "key", source, configuration);
+
+        request.InputStream.ShouldBeSameAs(source);
+        request.AutoCloseStream.ShouldBeFalse();
+        request.DisablePayloadSigning.ShouldBe(true);
+    }
+
+    [Fact]
+    public void Should_Keep_Disable_Payload_Signing_Off_By_Default_For_A_Put_Object_Request()
+    {
+        var configuration = new AwsBlobProviderConfiguration(new BlobContainerConfiguration());
+
+        var request = _provider.CreatePutObjectRequestPublic("bucket", "key", new MemoryStream(), configuration);
+
+        request.DisablePayloadSigning.ShouldBe(false);
+    }
+
+    private sealed class ExposedAwsBlobProvider : AwsBlobProvider
+    {
+        public ExposedAwsBlobProvider()
+            : base(null!, null!, null!)
+        {
+        }
+
+        public TransferUtilityUploadRequest CreateMultipartUploadRequestPublic(
+            string containerName, string blobName, Stream blobStream, AwsBlobProviderConfiguration configuration)
+        {
+            return CreateMultipartUploadRequest(containerName, blobName, blobStream, configuration);
+        }
+
+        public PutObjectRequest CreatePutObjectRequestPublic(
+            string containerName, string blobName, Stream blobStream, AwsBlobProviderConfiguration configuration)
+        {
+            return CreatePutObjectRequest(containerName, blobName, blobStream, configuration);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Aws.Tests/Volo/Abp/BlobStoring/Aws/LeaveOpenStreamWrapper_Tests.cs

@@ -0,0 +1,54 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using Shouldly;
+using Volo.Abp.BlobStoring.Fakes;
+using Xunit;
+
+namespace Volo.Abp.BlobStoring.Aws;
+
+public class LeaveOpenStreamWrapper_Tests
+{
+    [Fact]
+    public async Task Should_Bridge_The_Old_Read_Overload_To_The_Modern_One_And_Leave_The_Stream_Open()
+    {
+        var content = new byte[1000];
+        new Random(42).NextBytes(content);
+        using var inner = new FakeModernAsyncOnlyStream(new MemoryStream(content));
+        var wrapper = new LeaveOpenStreamWrapper(inner);
+
+        // The SDK reads over the old overload; the inner stream only supports the modern one
+        var buffer = new byte[content.Length];
+        var totalReadCount = 0;
+        while (totalReadCount < buffer.Length)
+        {
+            var readCount = await wrapper.ReadAsync(buffer, totalReadCount, buffer.Length - totalReadCount, default);
+            if (readCount == 0)
+            {
+                break;
+            }
+
+            totalReadCount += readCount;
+        }
+
+        totalReadCount.ShouldBe(content.Length);
+        buffer.SequenceEqual(content).ShouldBeTrue();
+
+        wrapper.Dispose();
+
+        // The wrapped stream stays open (a disposed one would throw here)
+        (await inner.ReadAsync(new byte[1].AsMemory(), default)).ShouldBe(0);
+    }
+
+    [Fact]
+    public void Should_Translate_A_Failing_Length_Probe_For_The_Sdk()
+    {
+        // The SDK only handles NotSupportedException while probing the content length
+        using var inner = new FakeIoFailingLengthStream(new MemoryStream(new byte[10]));
+        var wrapper = new LeaveOpenStreamWrapper(inner);
+
+        Should.Throw<NotSupportedException>(() => wrapper.Length);
+        Should.Throw<NotSupportedException>(() => wrapper.Position);
+    }
+}

framework/test/Volo.Abp.BlobStoring.FileSystem.Tests/Volo/Abp/BlobStoring/FileSystem/FileSystemBlobEncryption_Tests.cs

@@ -0,0 +1,576 @@
+#nullable enable
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Shouldly;
+using Volo.Abp.BlobStoring.TestObjects;
+using Volo.Abp.DependencyInjection;
+using Volo.Abp.MultiTenancy;
+using Xunit;
+
+namespace Volo.Abp.BlobStoring.FileSystem;
+
+public class FileSystemBlobEncryption_Tests : AbpBlobStoringFileSystemTestBase
+{
+    private readonly IBlobContainer<TestContainer4> _container4; // UseEncryption("container4-passphrase")
+    private readonly IBlobContainer<TestContainer5> _container5; // UseEncryption() -> key provider (tenant setting / global options)
+    private readonly IBlobContainer<TestContainer6> _container6; // UseEncryption("container6-passphrase", allowLegacyPlainText: true)
+    private readonly IBlobFilePathCalculator _filePathCalculator;
+    private readonly IBlobContainerConfigurationProvider _configurationProvider;
+    private readonly ICurrentTenant _currentTenant;
+
+    public FileSystemBlobEncryption_Tests()
+    {
+        _container4 = GetRequiredService<IBlobContainer<TestContainer4>>();
+        _container5 = GetRequiredService<IBlobContainer<TestContainer5>>();
+        _container6 = GetRequiredService<IBlobContainer<TestContainer6>>();
+        _filePathCalculator = GetRequiredService<IBlobFilePathCalculator>();
+        _configurationProvider = GetRequiredService<IBlobContainerConfigurationProvider>();
+        _currentTenant = GetRequiredService<ICurrentTenant>();
+    }
+
+    [Fact]
+    public async Task Should_Store_Encrypted_Bytes_On_Disk_And_Read_Them_Back()
+    {
+        var blobName = "fs-encrypted-roundtrip";
+        var testContent = "file system test content".GetBytes();
+
+        await _container4.SaveAsync(blobName, testContent);
+
+        var fileBytes = await File.ReadAllBytesAsync(GetFilePath<TestContainer4>(blobName));
+        fileBytes.SequenceEqual(testContent).ShouldBeFalse();
+        Encoding.ASCII.GetString(fileBytes.Take(4).ToArray()).ShouldBe("ABPE");
+
+        (await _container4.GetAllBytesAsync(blobName)).SequenceEqual(testContent).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Save_And_Get_Empty_And_Multi_Chunk_Blobs()
+    {
+        await _container4.SaveAsync("fs-empty", Array.Empty<byte>());
+        (await _container4.GetAllBytesAsync("fs-empty")).ShouldBeEmpty();
+
+        var largeContent = new byte[3 * 1024 * 1024 + 123]; // Spans many 64 KB chunks
+        new Random(42).NextBytes(largeContent);
+
+        await _container4.SaveAsync("fs-large", largeContent);
+
+        (await _container4.GetAllBytesAsync("fs-large")).SequenceEqual(largeContent).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Override_An_Existing_Encrypted_Blob()
+    {
+        var blobName = "fs-override";
+        await _container4.SaveAsync(blobName, "first content".GetBytes());
+        await _container4.SaveAsync(blobName, "second content".GetBytes(), overrideExisting: true);
+
+        (await _container4.GetAllBytesAsync(blobName)).ShouldBe("second content".GetBytes());
+    }
+
+    [Fact]
+    public async Task Should_Save_From_Async_Only_Source_To_Disk()
+    {
+        var blobName = "fs-async-only";
+        var testContent = new byte[192 * 1024];
+        new Random(42).NextBytes(testContent);
+
+        await _container4.SaveAsync(blobName, new AsyncOnlyStream(testContent));
+
+        using var result = await _container4.GetAsync(blobName);
+        using var output = new MemoryStream();
+        await result.CopyToAsync(output);
+
+        output.ToArray().ShouldBe(testContent);
+    }
+
+    [Fact]
+    public async Task Should_Read_Legacy_Plaintext_File_When_Allowed()
+    {
+        var blobName = "fs-legacy";
+        var legacyContent = "plaintext file from before encryption".GetBytes();
+        WriteRawFile<TestContainer6>(blobName, legacyContent);
+
+        (await _container6.GetAllBytesAsync(blobName)).SequenceEqual(legacyContent).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Reject_Legacy_Plaintext_File_By_Default()
+    {
+        var blobName = "fs-legacy-rejected";
+        WriteRawFile<TestContainer4>(blobName, "plaintext file".GetBytes());
+
+        await Assert.ThrowsAsync<AbpException>(async () =>
+        {
+            using var stream = await _container4.GetAsync(blobName);
+        });
+    }
+
+    [Fact]
+    public async Task Should_Detect_Tampered_File_On_Disk()
+    {
+        var blobName = "fs-tampered";
+        var content = new byte[128 * 1024];
+        new Random(42).NextBytes(content);
+        await _container4.SaveAsync(blobName, content);
+
+        var filePath = GetFilePath<TestContainer4>(blobName);
+        var fileBytes = await File.ReadAllBytesAsync(filePath);
+        fileBytes[100] ^= 0xFF; // Inside the first cipher chunk
+        await File.WriteAllBytesAsync(filePath, fileBytes);
+
+        using var stream = await _container4.GetAsync(blobName);
+        using var output = new MemoryStream();
+
+        Assert.ThrowsAny<CryptographicException>(() => stream.CopyTo(output));
+    }
+
+    [Fact]
+    public async Task Should_Detect_Truncated_File_On_Disk()
+    {
+        var blobName = "fs-truncated";
+        await _container4.SaveAsync(blobName, new byte[128 * 1024]);
+
+        var filePath = GetFilePath<TestContainer4>(blobName);
+        var fileBytes = await File.ReadAllBytesAsync(filePath);
+        Array.Resize(ref fileBytes, fileBytes.Length - 20); // Cut the terminal record
+        await File.WriteAllBytesAsync(filePath, fileBytes);
+
+        using var stream = await _container4.GetAsync(blobName);
+        using var output = new MemoryStream();
+
+        Should.Throw<AbpException>(() => stream.CopyTo(output));
+    }
+
+    [Fact]
+    public async Task Should_Fail_Closed_When_File_Magic_Is_Tampered()
+    {
+        var blobName = "fs-tampered-magic";
+        await _container4.SaveAsync(blobName, "secret".GetBytes());
+
+        var filePath = GetFilePath<TestContainer4>(blobName);
+        var fileBytes = await File.ReadAllBytesAsync(filePath);
+        fileBytes[0] ^= 0xFF;
+        await File.WriteAllBytesAsync(filePath, fileBytes);
+
+        await Assert.ThrowsAsync<AbpException>(async () =>
+        {
+            using var stream = await _container4.GetAsync(blobName);
+        });
+    }
+
+    [Fact]
+    public async Task Should_Support_Exists_And_Delete_For_Encrypted_Blobs()
+    {
+        var blobName = "fs-exists-delete";
+        await _container4.SaveAsync(blobName, "content".GetBytes());
+
+        (await _container4.ExistsAsync(blobName)).ShouldBeTrue();
+        (await _container4.DeleteAsync(blobName)).ShouldBeTrue();
+        (await _container4.ExistsAsync(blobName)).ShouldBeFalse();
+        (await _container4.GetOrNullAsync(blobName)).ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task Should_Isolate_Tenant_Blobs_In_Separate_Files()
+    {
+        var blobName = "fs-tenant-isolation";
+        var tenant1 = Guid.NewGuid();
+        var tenant2 = Guid.NewGuid();
+
+        using (_currentTenant.Change(tenant1))
+        {
+            await _container5.SaveAsync(blobName, "tenant 1 content".GetBytes());
+        }
+
+        using (_currentTenant.Change(tenant2))
+        {
+            await _container5.SaveAsync(blobName, "tenant 2 content".GetBytes());
+        }
+
+        string tenant1Path, tenant2Path;
+        using (_currentTenant.Change(tenant1))
+        {
+            tenant1Path = GetFilePath<TestContainer5>(blobName);
+            (await _container5.GetAllBytesAsync(blobName)).ShouldBe("tenant 1 content".GetBytes());
+        }
+
+        using (_currentTenant.Change(tenant2))
+        {
+            tenant2Path = GetFilePath<TestContainer5>(blobName);
+            (await _container5.GetAllBytesAsync(blobName)).ShouldBe("tenant 2 content".GetBytes());
+        }
+
+        tenant1Path.ShouldNotBe(tenant2Path);
+        File.Exists(tenant1Path).ShouldBeTrue();
+        File.Exists(tenant2Path).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Reject_A_File_Moved_Between_Tenants()
+    {
+        var blobName = "fs-moved-between-tenants";
+        var tenant1 = Guid.NewGuid();
+        var tenant2 = Guid.NewGuid();
+
+        string tenant1Path, tenant2Path;
+        using (_currentTenant.Change(tenant1))
+        {
+            await _container4.SaveAsync(blobName, "tenant 1 secret".GetBytes());
+            tenant1Path = GetFilePath<TestContainer4>(blobName);
+        }
+
+        using (_currentTenant.Change(tenant2))
+        {
+            tenant2Path = GetFilePath<TestContainer4>(blobName);
+        }
+
+        // Same container passphrase for both tenants: only the identity binding
+        // makes the copied file unreadable at the new location.
+        Directory.CreateDirectory(Path.GetDirectoryName(tenant2Path)!);
+        File.Copy(tenant1Path, tenant2Path);
+
+        using (_currentTenant.Change(tenant2))
+        {
+            using var stream = await _container4.GetAsync(blobName);
+            using var output = new MemoryStream();
+
+            Assert.ThrowsAny<CryptographicException>(() => stream.CopyTo(output));
+        }
+    }
+
+    [Fact]
+    public async Task Should_Use_Global_PassPhrase_On_Disk_Without_Tenant()
+    {
+        var blobName = "fs-global-key";
+        await _container5.SaveAsync(blobName, "global content".GetBytes());
+
+        var fileBytes = await File.ReadAllBytesAsync(GetFilePath<TestContainer5>(blobName));
+        fileBytes[6].ShouldBe((byte)BlobEncryptionKeySource.Global);
+
+        (await _container5.GetAllBytesAsync(blobName)).ShouldBe("global content".GetBytes());
+    }
+
+    [Fact]
+    public async Task Should_Retry_And_Produce_A_Complete_File_For_A_Replayable_Source()
+    {
+        // TestContainer8 is not encrypted, so the seekable source reaches the provider directly
+        var container8 = GetRequiredService<IBlobContainer<TestContainer8>>();
+        var content = new byte[64 * 1024];
+        new Random(42).NextBytes(content);
+        var source = new FaultOnceSeekableStream(content);
+
+        await container8.SaveAsync("fs-retry-replayable", source, overrideExisting: true);
+
+        source.FaultsInjected.ShouldBe(1); // First attempt failed, the retry succeeded
+        (await container8.GetAllBytesAsync("fs-retry-replayable")).SequenceEqual(content).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Not_Retry_A_Non_Replayable_Encrypted_Save()
+    {
+        // The encrypting wrapper is not seekable, so a mid-write failure must not be retried
+        var content = new byte[64 * 1024];
+        new Random(42).NextBytes(content);
+        var source = new FaultOnceSeekableStream(content, reportSeekable: false);
+
+        await Assert.ThrowsAsync<IOException>(async () =>
+        {
+            await _container4.SaveAsync("fs-retry-non-replayable", source, overrideExisting: true);
+        });
+
+        source.FaultsInjected.ShouldBe(1); // No second attempt
+    }
+
+    [Fact]
+    public async Task Should_Retry_A_Transient_Failure_Before_The_Target_Is_Opened()
+    {
+        // The encrypting wrapper is not seekable, but nothing is consumed while the
+        // target file can not even be opened, so such a failure is safe to retry
+        var blobName = "fs-retry-open-phase";
+        await _container4.SaveAsync(blobName, "first content".GetBytes(), overrideExisting: true);
+
+        using (var fileLock = File.Open(GetFilePath<TestContainer4>(blobName), FileMode.Open, FileAccess.Read, FileShare.None))
+        {
+            var saveTask = _container4.SaveAsync(blobName, "second content".GetBytes(), overrideExisting: true);
+            await Task.Delay(300); // The first attempt fails while the file is locked
+            fileLock.Dispose();
+            await saveTask;
+        }
+
+        (await _container4.GetAllBytesAsync(blobName)).ShouldBe("second content".GetBytes());
+    }
+
+    [Fact]
+    public async Task Should_Not_Retry_A_New_Save_After_The_Target_File_Was_Created()
+    {
+        // A failed CreateNew attempt leaves the file behind, so retrying would only
+        // hit the leftover; even a seekable source must fail after a mid-write fault
+        var container8 = GetRequiredService<IBlobContainer<TestContainer8>>();
+        var content = new byte[64 * 1024];
+        new Random(42).NextBytes(content);
+        var source = new FaultOnceSeekableStream(content);
+
+        await Assert.ThrowsAsync<IOException>(async () =>
+        {
+            await container8.SaveAsync("fs-retry-create-new", source);
+        });
+
+        source.FaultsInjected.ShouldBe(1); // No second attempt
+    }
+
+    [Fact]
+    public async Task Should_Retry_A_Failed_Open_For_A_New_Save()
+    {
+        var content = new byte[64 * 1024];
+        new Random(42).NextBytes(content);
+        var source = new MemoryStream(content);
+        var provider = new FaultingOpenFileSystemBlobProvider(_filePathCalculator, source);
+
+        await provider.SaveAsync(new BlobProviderSaveArgs(
+            BlobContainerNameAttribute.GetContainerName<TestContainer8>(),
+            _configurationProvider.Get<TestContainer8>(),
+            "fs-retry-open-create-new",
+            source
+        ));
+
+        provider.OpenAttempts.ShouldBe(2); // The first open failed, the retry succeeded
+        provider.SourcePositionAtFirstFault.ShouldBe(0); // Nothing was consumed before the failure
+        var fileBytes = await File.ReadAllBytesAsync(GetFilePath<TestContainer8>("fs-retry-open-create-new"));
+        fileBytes.SequenceEqual(content).ShouldBeTrue();
+    }
+
+    [DisableConventionalRegistration]
+    private sealed class FaultingOpenFileSystemBlobProvider : FileSystemBlobProvider
+    {
+        private readonly Stream _source;
+
+        public int OpenAttempts { get; private set; }
+
+        public long SourcePositionAtFirstFault { get; private set; } = -1;
+
+        public FaultingOpenFileSystemBlobProvider(IBlobFilePathCalculator filePathCalculator, Stream source)
+            : base(filePathCalculator)
+        {
+            _source = source;
+        }
+
+        protected override Stream OpenFileStream(string filePath, FileMode fileMode)
+        {
+            OpenAttempts++;
+            if (OpenAttempts == 1)
+            {
+                SourcePositionAtFirstFault = _source.Position;
+                throw new IOException("Injected open failure!");
+            }
+
+            return base.OpenFileStream(filePath, fileMode);
+        }
+    }
+
+    [Fact]
+    public async Task Should_Save_When_The_Position_Probe_Of_A_Seekable_Stream_Fails()
+    {
+        // A failing probe degrades to a single, non-replayable attempt instead of failing the save
+        var container8 = GetRequiredService<IBlobContainer<TestContainer8>>();
+        var content = "position probe failure content".GetBytes();
+        using var source = new PositionThrowingSeekableStream(content);
+
+        await container8.SaveAsync("fs-position-probe", source, overrideExisting: true);
+
+        (await container8.GetAllBytesAsync("fs-position-probe")).ShouldBe(content);
+    }
+
+    private sealed class PositionThrowingSeekableStream : Stream
+    {
+        private readonly MemoryStream _stream;
+        private bool _positionFaultInjected;
+
+        public PositionThrowingSeekableStream(byte[] bytes)
+        {
+            _stream = new MemoryStream(bytes);
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => true;
+        public override bool CanWrite => false;
+        public override long Length => _stream.Length;
+
+        public override long Position
+        {
+            get
+            {
+                // Fail once, transiently, on the first probe
+                if (!_positionFaultInjected)
+                {
+                    _positionFaultInjected = true;
+                    throw new IOException("The position is not available!");
+                }
+
+                return _stream.Position;
+            }
+            set => _stream.Position = value;
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => _stream.Read(buffer, offset, count);
+        public override long Seek(long offset, SeekOrigin origin) => _stream.Seek(offset, origin);
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _stream.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+
+    private sealed class FaultOnceSeekableStream : Stream
+    {
+        private readonly MemoryStream _stream;
+        private readonly bool _reportSeekable;
+        private bool _faulted;
+
+        public int FaultsInjected { get; private set; }
+
+        public FaultOnceSeekableStream(byte[] bytes, bool reportSeekable = true)
+        {
+            _stream = new MemoryStream(bytes);
+            _reportSeekable = reportSeekable;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => _reportSeekable;
+        public override bool CanWrite => false;
+        public override long Length => _reportSeekable ? _stream.Length : throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => _stream.Position;
+            set => _stream.Position = value;
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            return ReadCore(() => _stream.Read(buffer, offset, count));
+        }
+
+        public override Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+        {
+            return Task.FromResult(ReadCore(() => _stream.Read(buffer, offset, count)));
+        }
+
+        private int ReadCore(Func<int> read)
+        {
+            // Fail once in the middle of the content
+            if (!_faulted && _stream.Position >= _stream.Length / 2)
+            {
+                _faulted = true;
+                FaultsInjected++;
+                throw new IOException("Injected I/O failure!");
+            }
+
+            return read();
+        }
+
+        public override long Seek(long offset, SeekOrigin origin)
+        {
+            return _reportSeekable ? _stream.Seek(offset, origin) : throw new NotSupportedException();
+        }
+
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _stream.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+
+    private string GetFilePath<TContainer>(string blobName)
+    {
+        return _filePathCalculator.Calculate(
+            new BlobProviderGetArgs(
+                BlobContainerNameAttribute.GetContainerName<TContainer>(),
+                _configurationProvider.Get<TContainer>(),
+                blobName
+            )
+        );
+    }
+
+    private void WriteRawFile<TContainer>(string blobName, byte[] bytes)
+    {
+        var filePath = GetFilePath<TContainer>(blobName);
+        Directory.CreateDirectory(Path.GetDirectoryName(filePath)!);
+        File.WriteAllBytes(filePath, bytes);
+    }
+
+    private sealed class AsyncOnlyStream : Stream
+    {
+        private readonly MemoryStream _stream;
+
+        public AsyncOnlyStream(byte[] bytes)
+        {
+            _stream = new MemoryStream(bytes);
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            throw new InvalidOperationException("Synchronous reads are not allowed on this stream!");
+        }
+
+        public override Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+        {
+            return _stream.ReadAsync(buffer, offset, count, cancellationToken);
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _stream.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Minio.Tests/Volo/Abp/BlobStoring/Minio/MinioBlobEncryption_Tests.cs

@@ -0,0 +1,127 @@
+#nullable enable
+/*
+//Please set the correct connection string in secrets.json and continue the test.
+using System;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using Shouldly;
+using Volo.Abp.BlobStoring.TestObjects;
+using Xunit;
+
+namespace Volo.Abp.BlobStoring.Minio;
+
+public class MinioBlobEncryption_Tests : AbpBlobStoringMinioTestBase
+{
+    private readonly IBlobContainer<TestContainer4> _container4; // UseEncryption("container4-passphrase")
+
+    public MinioBlobEncryption_Tests()
+    {
+        _container4 = GetRequiredService<IBlobContainer<TestContainer4>>();
+    }
+
+    [Fact]
+    public async Task Should_Save_And_Get_Encrypted_Blob()
+    {
+        var blobName = "minio-encrypted-roundtrip";
+        var testContent = "minio test content".GetBytes();
+
+        await _container4.SaveAsync(blobName, testContent);
+
+        (await _container4.GetAllBytesAsync(blobName)).SequenceEqual(testContent).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Save_And_Get_Empty_And_Multi_Chunk_Blobs()
+    {
+        await _container4.SaveAsync("minio-empty", Array.Empty<byte>());
+        (await _container4.GetAllBytesAsync("minio-empty")).ShouldBeEmpty();
+
+        // MinIO reads BlobStream.Length before uploading, so this verifies the
+        // exact encrypted length calculation against a real object store.
+        var largeContent = new byte[3 * 1024 * 1024 + 123]; // Spans many 64 KB chunks
+        new Random(42).NextBytes(largeContent);
+
+        await _container4.SaveAsync("minio-large", largeContent);
+
+        (await _container4.GetAllBytesAsync("minio-large")).SequenceEqual(largeContent).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Override_An_Existing_Encrypted_Blob()
+    {
+        var blobName = "minio-override";
+        await _container4.SaveAsync(blobName, "first content".GetBytes());
+        await _container4.SaveAsync(blobName, "second content".GetBytes(), overrideExisting: true);
+
+        (await _container4.GetAllBytesAsync(blobName)).ShouldBe("second content".GetBytes());
+    }
+
+    [Fact]
+    public async Task Should_Support_Exists_And_Delete_For_Encrypted_Blobs()
+    {
+        var blobName = "minio-exists-delete";
+        await _container4.SaveAsync(blobName, "content".GetBytes());
+
+        (await _container4.ExistsAsync(blobName)).ShouldBeTrue();
+        (await _container4.DeleteAsync(blobName)).ShouldBeTrue();
+        (await _container4.ExistsAsync(blobName)).ShouldBeFalse();
+        (await _container4.GetOrNullAsync(blobName)).ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task Should_Reject_Non_Seekable_Source_Because_Minio_Requires_The_Length()
+    {
+        // The MinIO provider reads BlobStream.Length; for a non-seekable source the
+        // encrypted length is unknown, so saving fails (same as without encryption).
+        await Assert.ThrowsAsync<NotSupportedException>(async () =>
+        {
+            await _container4.SaveAsync("minio-non-seekable", new NonSeekableStream("content".GetBytes()));
+        });
+    }
+
+    private sealed class NonSeekableStream : Stream
+    {
+        private readonly MemoryStream _stream;
+
+        public NonSeekableStream(byte[] bytes)
+        {
+            _stream = new MemoryStream(bytes);
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            return _stream.Read(buffer, offset, count);
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _stream.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+}
+*/

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/AbpBlobStoringTestModule.cs

@@ -1,4 +1,5 @@
-using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 using NSubstitute;
 using Volo.Abp.Autofac;
 using Volo.Abp.BlobStoring.Fakes;
@@ -19,6 +20,18 @@ public class AbpBlobStoringTestModule : AbpModule
         context.Services.AddSingleton<IBlobProvider>(Substitute.For<FakeBlobProvider1>());
         context.Services.AddSingleton<IBlobProvider>(Substitute.For<FakeBlobProvider2>());
 
+        context.Services.AddSingleton<FakeInMemoryBlobProvider>();
+        context.Services.AddSingleton<IBlobProvider>(
+            serviceProvider => serviceProvider.GetRequiredService<FakeInMemoryBlobProvider>()
+        );
+
+        context.Services.Replace(ServiceDescriptor.Transient<IBlobEncryptionKeyProvider, FakeTenantBlobEncryptionKeyProvider>());
+
+        Configure<AbpBlobStoringEncryptionOptions>(options =>
+        {
+            options.DefaultPassPhrase = "default-global-passphrase";
+        });
+
         Configure<AbpBlobStoringOptions>(options =>
         {
             options.Containers
@@ -40,6 +53,110 @@ public class AbpBlobStoringTestModule : AbpModule
                 .Configure<TestContainer3>(container =>
                 {
                     container.IsMultiTenant = false;
+                })
+                .Configure<TestContainer4>(container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.UseEncryption("container4-passphrase");
+                })
+                .Configure<TestContainer5>(container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.UseEncryption();
+                })
+                .Configure<TestContainer6>(container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.UseEncryption("container6-passphrase", allowLegacyPlainText: true);
+                })
+                .Configure<TestContainer7>(container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.IsMultiTenant = false;
+                    container.UseEncryption("container7-shared-passphrase");
+                })
+                .Configure<TestContainer8>(container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                })
+                .Configure("pipeline-markers", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeAPipelineContributor>();
+                    container.PipelineContributors.Add<FakeBPipelineContributor>();
+                })
+                .Configure("pipeline-encrypted", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.UseEncryption("pipeline-passphrase");
+                    container.PipelineContributors.Add<FakeAPipelineContributor>();
+                })
+                .Configure("pipeline-scoped", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeScopedXorPipelineContributor>();
+                })
+                .Configure("get-bad-encryption-config", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    // A mis-typed value makes reading the encryption flag throw while getting
+                    container.SetConfiguration(BlobEncryptionConfigurationNames.Enabled, "not-a-bool");
+                })
+                .Configure("pipeline-failing-get", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeFailingGetPipelineContributor>();
+                })
+                .Configure("pipeline-set-throw-save", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeSetThenThrowPipelineContributor>();
+                })
+                .Configure("pipeline-partial-get", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeFailingGetPipelineContributor>();
+                    container.PipelineContributors.Add<FakeAPipelineContributor>();
+                })
+                .Configure("pipeline-dispose-throw", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeScopedXorPipelineContributor>();
+                    container.PipelineContributors.Add<FakeDisposeThrowingPipelineContributor>();
+                })
+                .Configure("pipeline-async-scoped", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeAsyncScopedPipelineContributor>();
+                })
+                .Configure("pipeline-encrypted-earlystop", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.UseEncryption("earlystop-passphrase");
+                    container.PipelineContributors.Add<FakeEarlyStopPipelineContributor>();
+                })
+                .Configure("pipeline-unwrap", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeAPipelineContributor>();
+                    container.PipelineContributors.Add<FakeOriginalRestoringPipelineContributor>();
+                })
+                .Configure("pipeline-async-dispose", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeAsyncDisposePipelineContributor>();
+                })
+                .Configure("pipeline-modern-async", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.PipelineContributors.Add<FakeModernAsyncPipelineContributor>();
+                })
+                .Configure("pipeline-shared-tenant", container =>
+                {
+                    container.ProviderType = typeof(FakeInMemoryBlobProvider);
+                    container.IsMultiTenant = false;
+                    container.PipelineContributors.Add<FakeTenantAssertingPipelineContributor>();
+                    container.PipelineContributors.Add<FakeTenantRecordingScopedPipelineContributor>();
                 });
         });
     }

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/BlobContainerConfiguration_Tests.cs

@@ -1,3 +1,4 @@
+using System;
 using System.Linq;
 using Shouldly;
 using Volo.Abp.BlobStoring.Fakes;
@@ -59,4 +60,140 @@ public class BlobContainerConfiguration_Tests
         effective.ShouldContain(typeof(AnotherFakeNamingNormalizer));
         effective.ShouldNotContain(typeof(FakeNamingNormalizer));
     }
+
+    [Fact]
+    public void Should_Inherit_Encryption_From_Default_Container()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.UseEncryption();
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+
+        BlobEncryptionConfiguration.IsEnabled(namedConfig).ShouldBeTrue();
+        BlobEncryptionConfiguration.IsEnabled(defaultConfig).ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Should_Disable_Inherited_Encryption_For_A_Single_Container()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.UseEncryption();
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+        namedConfig.DisableEncryption();
+
+        BlobEncryptionConfiguration.IsEnabled(namedConfig).ShouldBeFalse();
+        BlobEncryptionConfiguration.IsEnabled(defaultConfig).ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Should_Enable_Encryption_Again_After_Disabling()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.UseEncryption();
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+        namedConfig.DisableEncryption();
+        namedConfig.UseEncryption("named-passphrase");
+
+        BlobEncryptionConfiguration.IsEnabled(namedConfig).ShouldBeTrue();
+        BlobEncryptionConfiguration.GetPassPhraseOrNull(namedConfig).ShouldBe("named-passphrase");
+    }
+
+    [Fact]
+    public void Should_Keep_The_Configured_PassPhrase_When_UseEncryption_Is_Called_Again()
+    {
+        var configuration = new BlobContainerConfiguration();
+        configuration.UseEncryption("first-passphrase", allowLegacyPlainText: true);
+
+        // Another module just ensuring that encryption is enabled must not
+        // change the configured key or the legacy option.
+        configuration.UseEncryption();
+
+        BlobEncryptionConfiguration.GetPassPhraseOrNull(configuration).ShouldBe("first-passphrase");
+        BlobEncryptionConfiguration.IsLegacyPlainTextAllowed(configuration).ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Should_Shadow_The_PassPhrase_Inherited_From_The_Default_Container()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.UseEncryption("default-passphrase");
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+        namedConfig.UseEncryption();
+        namedConfig.ClearEncryptionPassPhrase();
+
+        // The named container explicitly opted out of the inherited passphrase
+        BlobEncryptionConfiguration.GetPassPhraseOrNull(namedConfig).ShouldBeNull();
+        BlobEncryptionConfiguration.GetPassPhraseOrNull(defaultConfig).ShouldBe("default-passphrase");
+    }
+
+    [Fact]
+    public void Should_Compose_Default_And_Named_Container_PipelineContributors()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.PipelineContributors.Add<FakeAPipelineContributor>();
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+        namedConfig.PipelineContributors.Add<FakeBPipelineContributor>();
+
+        namedConfig.GetEffectivePipelineContributors()
+            .ShouldBe([typeof(FakeAPipelineContributor), typeof(FakeBPipelineContributor)]);
+        defaultConfig.GetEffectivePipelineContributors().ShouldBe([typeof(FakeAPipelineContributor)]);
+    }
+
+    [Fact]
+    public void Should_Keep_Inherited_PipelineContributors_When_The_Provider_Is_Overridden()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.ProviderType = typeof(FakeBlobProvider1);
+        defaultConfig.PipelineContributors.Add<FakeAPipelineContributor>();
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+        namedConfig.ProviderType = typeof(FakeBlobProvider2);
+
+        namedConfig.GetEffectivePipelineContributors().ShouldBe([typeof(FakeAPipelineContributor)]);
+    }
+
+    [Fact]
+    public void Should_Not_Duplicate_A_PipelineContributor_Configured_On_Both_Levels()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.PipelineContributors.Add<FakeAPipelineContributor>();
+        defaultConfig.PipelineContributors.Add<FakeAPipelineContributor>();
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+        namedConfig.PipelineContributors.Add<FakeAPipelineContributor>();
+
+        // A contributor type runs once, on every configuration level
+        defaultConfig.GetEffectivePipelineContributors().ShouldBe([typeof(FakeAPipelineContributor)]);
+        namedConfig.GetEffectivePipelineContributors().ShouldBe([typeof(FakeAPipelineContributor)]);
+    }
+
+    [Fact]
+    public void Should_Opt_Out_Of_The_Inherited_PipelineContributors()
+    {
+        var defaultConfig = new BlobContainerConfiguration();
+        defaultConfig.PipelineContributors.Add<FakeAPipelineContributor>();
+
+        var namedConfig = new BlobContainerConfiguration(defaultConfig);
+        namedConfig.InheritPipelineContributors = false;
+        namedConfig.PipelineContributors.Add<FakeBPipelineContributor>();
+
+        namedConfig.GetEffectivePipelineContributors().ShouldBe([typeof(FakeBPipelineContributor)]);
+    }
+
+    [Fact]
+    public void Should_Reject_Empty_PassPhrase()
+    {
+        var configuration = new BlobContainerConfiguration();
+
+        Assert.ThrowsAny<ArgumentException>(() => configuration.UseEncryption(""));
+        Assert.ThrowsAny<ArgumentException>(() => configuration.UseEncryption("   ", allowLegacyPlainText: true));
+
+        // A failed call must not leave the configuration partially modified
+        BlobEncryptionConfiguration.IsEnabled(configuration).ShouldBeFalse();
+        BlobEncryptionConfiguration.IsLegacyPlainTextAllowed(configuration).ShouldBeFalse();
+    }
 }

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/BlobContainerPipeline_Tests.cs

@@ -0,0 +1,618 @@
+using System;
+using System.IO;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+using Volo.Abp.BlobStoring.Fakes;
+using Xunit;
+
+namespace Volo.Abp.BlobStoring;
+
+public class BlobContainerPipeline_Tests : AbpBlobStoringTestBase
+{
+    private readonly IBlobContainerFactory _blobContainerFactory;
+    private readonly FakeInMemoryBlobProvider _fakeProvider;
+
+    public BlobContainerPipeline_Tests()
+    {
+        _blobContainerFactory = GetRequiredService<IBlobContainerFactory>();
+        _fakeProvider = GetRequiredService<FakeInMemoryBlobProvider>();
+    }
+
+    [Fact]
+    public async Task Should_Transform_While_Saving_And_Restore_While_Getting()
+    {
+        var container = _blobContainerFactory.Create("pipeline-markers");
+        var content = "pipeline content".GetBytes();
+        using var source = new MemoryStream(content);
+
+        await container.SaveAsync("markers-blob", source);
+
+        // Contributors run in the configuration order while saving: A wraps first,
+        // B wraps the result, so the stored form starts with the marker of B
+        var rawBytes = _fakeProvider.GetRawBytesOrNull("pipeline-markers", "markers-blob");
+        rawBytes.ShouldNotBeNull();
+        Encoding.UTF8.GetString(rawBytes, 0, 4).ShouldBe("B>A>");
+
+        source.CanRead.ShouldBeTrue(); // The caller keeps the ownership of the original stream
+
+        (await container.GetAllBytesAsync("markers-blob")).ShouldBe(content);
+    }
+
+    [Fact]
+    public async Task Should_Run_Contributors_On_The_Plain_Content_When_Encryption_Is_Enabled()
+    {
+        var container = _blobContainerFactory.Create("pipeline-encrypted");
+        var content = "encrypted pipeline content".GetBytes();
+
+        await container.SaveAsync("encrypted-blob", content);
+
+        // The encryption always runs after the contributors, so the stored form is ciphertext
+        var rawBytes = _fakeProvider.GetRawBytesOrNull("pipeline-encrypted", "encrypted-blob");
+        rawBytes.ShouldNotBeNull();
+        Encoding.ASCII.GetString(rawBytes, 0, 4).ShouldBe("ABPE");
+
+        (await container.GetAllBytesAsync("encrypted-blob")).ShouldBe(content);
+    }
+
+    [Fact]
+    public async Task Should_Keep_The_Contributor_Scope_Alive_Until_The_Returned_Stream_Is_Disposed()
+    {
+        var container = _blobContainerFactory.Create("pipeline-scoped");
+        var content = "scoped pipeline content".GetBytes();
+
+        await container.SaveAsync("scoped-blob", content);
+
+        var stream = await container.GetAsync("scoped-blob");
+
+        // The scoped service is used lazily here, after GetAsync already returned
+        using var result = new MemoryStream();
+        await stream.CopyToAsync(result);
+        result.ToArray().ShouldBe(content);
+
+        var disposedCountBefore = FakeScopedMarkerService.DisposedCount;
+        stream.Dispose();
+        FakeScopedMarkerService.DisposedCount.ShouldBe(disposedCountBefore + 1);
+    }
+
+    [Fact]
+    public async Task Should_Dispose_The_Provider_Stream_When_Reading_The_Configuration_Fails()
+    {
+        var container = _blobContainerFactory.Create("get-bad-encryption-config");
+
+        // Save through a plain (well-configured) container to the same provider key,
+        // then read through the mis-configured one so the get fails after the provider
+        // stream was obtained
+        _fakeProvider.SetRawBytes("get-bad-encryption-config", "config-fail-blob", "content".GetBytes());
+
+        await Assert.ThrowsAnyAsync<Exception>(async () =>
+        {
+            await container.GetAsync("config-fail-blob");
+        });
+
+        _fakeProvider.LastServedStream.ShouldNotBeNull();
+        _fakeProvider.LastServedStream!.Disposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Dispose_The_Provider_Stream_When_A_Get_Contributor_Fails()
+    {
+        var container = _blobContainerFactory.Create("pipeline-failing-get");
+
+        await container.SaveAsync("failing-blob", "failing content".GetBytes());
+
+        await Assert.ThrowsAsync<InvalidOperationException>(async () =>
+        {
+            await container.GetAsync("failing-blob");
+        });
+
+        _fakeProvider.LastServedStream.ShouldNotBeNull();
+        _fakeProvider.LastServedStream!.Disposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Dispose_The_Stream_Of_A_Contributor_That_Fails_After_Replacing_It()
+    {
+        var container = _blobContainerFactory.Create("pipeline-set-throw-save");
+
+        await Assert.ThrowsAsync<InvalidOperationException>(async () =>
+        {
+            await container.SaveAsync("set-throw-blob", "content".GetBytes());
+        });
+
+        FakeSetThenThrowPipelineContributor.LastCreatedStream.ShouldNotBeNull();
+        FakeSetThenThrowPipelineContributor.LastCreatedStream!.Disposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Dispose_The_Whole_Chain_When_A_Later_Get_Contributor_Fails()
+    {
+        // The first contributor already wrapped the provider stream when the second one fails
+        var container = _blobContainerFactory.Create("pipeline-partial-get");
+
+        await container.SaveAsync("partial-get-blob", "partial content".GetBytes());
+
+        await Assert.ThrowsAsync<InvalidOperationException>(async () =>
+        {
+            await container.GetAsync("partial-get-blob");
+        });
+
+        _fakeProvider.LastServedStream.ShouldNotBeNull();
+        _fakeProvider.LastServedStream!.Disposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Release_The_Remaining_Streams_And_The_Scope_When_A_Dispose_Fails()
+    {
+        var container = _blobContainerFactory.Create("pipeline-dispose-throw");
+        var disposedCountBefore = FakeScopedMarkerService.DisposedCount;
+
+        // The save itself succeeds; the injected failure surfaces from the cleanup
+        var exception = await Assert.ThrowsAsync<IOException>(async () =>
+        {
+            await container.SaveAsync("dispose-throw-blob", "content".GetBytes());
+        });
+
+        exception.Message.ShouldContain("Injected dispose failure");
+        FakeScopedMarkerService.DisposedCount.ShouldBe(disposedCountBefore + 1); // The scope was still released
+    }
+
+    [Fact]
+    public async Task Should_Keep_The_Container_Tenant_Context_While_The_Returned_Stream_Is_Read()
+    {
+        // A tenant reads a shared (IsMultiTenant = false) container: the lazy
+        // transformation must still run in the host context of the container
+        var container = _blobContainerFactory.Create("pipeline-shared-tenant");
+        var currentTenant = GetRequiredService<Volo.Abp.MultiTenancy.ICurrentTenant>();
+        var content = "shared tenant content".GetBytes();
+
+        using (currentTenant.Change(Guid.NewGuid()))
+        {
+            await container.SaveAsync("shared-tenant-blob", content);
+
+            using var stream = await container.GetAsync("shared-tenant-blob");
+            using var result = new MemoryStream();
+            await stream.CopyToAsync(result); // The wrapper asserts the tenant context here
+
+            result.ToArray().ShouldBe(content);
+        }
+    }
+
+    [Fact]
+    public async Task Should_Not_Degrade_A_Modern_Async_Only_Wrapper_Stream()
+    {
+        var container = _blobContainerFactory.Create("pipeline-modern-async");
+        var content = "modern async content".GetBytes();
+
+        await container.SaveAsync("modern-async-blob", content);
+
+        using var stream = await container.GetAsync("modern-async-blob");
+        using var result = new MemoryStream();
+        await stream.CopyToAsync(result); // Uses ReadAsync(Memory<byte>) on modern runtimes
+
+        result.ToArray().ShouldBe(content);
+
+        // Callers of the old overload must get the same bridging
+        using var oldOverloadStream = await container.GetAsync("modern-async-blob");
+        var buffer = new byte[content.Length];
+        var totalReadCount = 0;
+        while (totalReadCount < buffer.Length)
+        {
+            var readCount = await oldOverloadStream.ReadAsync(buffer, totalReadCount, buffer.Length - totalReadCount, default);
+            if (readCount == 0)
+            {
+                break;
+            }
+
+            totalReadCount += readCount;
+        }
+
+        buffer.ShouldBe(content);
+    }
+
+    [Fact]
+    public async Task Should_Dispose_The_Contributor_Scope_In_The_Container_Tenant_Context()
+    {
+        var container = _blobContainerFactory.Create("pipeline-shared-tenant");
+        var currentTenant = GetRequiredService<Volo.Abp.MultiTenancy.ICurrentTenant>();
+        var content = "scope dispose tenant content".GetBytes();
+
+        using (currentTenant.Change(Guid.NewGuid()))
+        {
+            await container.SaveAsync("scope-dispose-tenant-blob", content, overrideExisting: true);
+
+            var stream = await container.GetAsync("scope-dispose-tenant-blob");
+            using (var result = new MemoryStream())
+            {
+                await stream.CopyToAsync(result);
+            }
+
+            FakeTenantRecordingScopedService.Reset();
+            stream.Dispose(); // Synchronous dispose from the tenant context
+
+            FakeTenantRecordingScopedService.HasRecordedDispose.ShouldBeTrue();
+            FakeTenantRecordingScopedService.LastDisposeTenantId.ShouldBeNull(); // The container is shared (host)
+
+            var asyncStream = await container.GetAsync("scope-dispose-tenant-blob");
+            using (var result = new MemoryStream())
+            {
+                await asyncStream.CopyToAsync(result);
+            }
+
+            FakeTenantRecordingScopedService.Reset();
+            await asyncStream.DisposeAsync(); // Asynchronous dispose from the tenant context
+
+            FakeTenantRecordingScopedService.HasRecordedDispose.ShouldBeTrue();
+            FakeTenantRecordingScopedService.LastDisposeTenantId.ShouldBeNull();
+        }
+    }
+
+    [Fact]
+    public async Task Should_Not_Dispose_The_Original_Stream_When_A_Contributor_Sets_It_Back()
+    {
+        // A wraps the original, then the second contributor sets the original back:
+        // the pipeline must not treat the caller-owned stream as its own
+        var container = _blobContainerFactory.Create("pipeline-unwrap");
+        var content = "unwrap content".GetBytes();
+        using var source = new MemoryStream(content);
+        FakeOriginalRestoringPipelineContributor.RestoreTo = source;
+        try
+        {
+            await container.SaveAsync("unwrap-blob", source);
+        }
+        finally
+        {
+            FakeOriginalRestoringPipelineContributor.RestoreTo = null;
+        }
+
+        source.CanRead.ShouldBeTrue(); // The caller keeps the ownership of the original stream
+        _fakeProvider.GetRawBytesOrNull("pipeline-unwrap", "unwrap-blob").ShouldBe(content);
+    }
+
+    [Fact]
+    public async Task Should_Release_A_Pipeline_Stream_That_Only_Cleans_Up_In_DisposeAsync()
+    {
+        var container = _blobContainerFactory.Create("pipeline-async-dispose");
+
+        await container.SaveAsync("async-dispose-blob", "async dispose content".GetBytes());
+
+        FakeAsyncDisposePipelineContributor.LastSaveStream.ShouldNotBeNull();
+        FakeAsyncDisposePipelineContributor.LastSaveStream!.AsyncDisposed.ShouldBeTrue();
+
+        // The intermediate stream created within the same contributor call is disposed too
+        FakeAsyncDisposePipelineContributor.IntermediateSaveStream.ShouldNotBeNull();
+        FakeAsyncDisposePipelineContributor.IntermediateSaveStream!.AsyncDisposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Should_Bridge_A_Synchronous_Dispose_To_The_Async_Cleanup_Of_The_Cipher_Stream()
+    {
+        // The decrypting stream owns the provider (cipher) stream; a synchronous
+        // Dispose of it must still run the async-only cleanup of that stream
+        var cipherStream = new AsyncOnlyDisposeStream();
+        var decryptingStream = new ChunkedDecryptingReadStream(
+            cipherStream, new byte[16], new byte[32], new byte[8], 64 * 1024);
+
+        decryptingStream.Dispose();
+
+        cipherStream.AsyncDisposed.ShouldBeTrue();
+    }
+
+    private sealed class AsyncOnlyDisposeStream : Stream
+    {
+        public bool AsyncDisposed { get; private set; }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => 0;
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        // The cleanup only happens asynchronously; a synchronous Dispose does nothing,
+        // so the test fails if the decrypting stream does not bridge to DisposeAsync
+        public override ValueTask DisposeAsync()
+        {
+            AsyncDisposed = true;
+            return default;
+        }
+    }
+
+    [Fact]
+    public async Task Should_Bridge_A_Synchronous_Dispose_To_The_Async_Cleanup_Of_A_Get_Wrapper()
+    {
+        var container = _blobContainerFactory.Create("pipeline-async-dispose");
+        var content = "sync dispose bridge content".GetBytes();
+
+        await container.SaveAsync("sync-bridge-blob", content, overrideExisting: true);
+
+        using (var stream = await container.GetAsync("sync-bridge-blob"))
+        {
+            using var result = new MemoryStream();
+            await stream.CopyToAsync(result);
+            result.ToArray().ShouldBe(content);
+        } // The synchronous using must still trigger the async-only cleanup
+
+        FakeAsyncDisposePipelineContributor.LastGetStream.ShouldNotBeNull();
+        FakeAsyncDisposePipelineContributor.LastGetStream!.AsyncDisposed.ShouldBeTrue();
+        _fakeProvider.LastServedStream.ShouldNotBeNull();
+        _fakeProvider.LastServedStream!.Disposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Should_Forward_The_Timeout_Capability_Of_The_Wrapped_Stream()
+    {
+        var currentTenant = GetRequiredService<Volo.Abp.MultiTenancy.ICurrentTenant>();
+        var scope = GetRequiredService<IServiceProvider>().CreateAsyncScope();
+        var inner = new TimeoutCapableStream();
+        await using var stream = new BlobPipelineScopeStream(inner, scope, currentTenant, null);
+
+        stream.CanTimeout.ShouldBeTrue();
+        stream.ReadTimeout = 1234;
+        stream.ReadTimeout.ShouldBe(1234);
+    }
+
+    private sealed class TimeoutCapableStream : MemoryStream
+    {
+        private int _readTimeout = -1;
+
+        public override bool CanTimeout => true;
+
+        public override int ReadTimeout
+        {
+            get => _readTimeout;
+            set => _readTimeout = value;
+        }
+    }
+
+    [Fact]
+    public async Task Should_Not_Fault_The_Composed_Stream_When_The_End_Source_Cancels_Without_Faulting()
+    {
+        // The decrypting stream lets a cancellation before any I/O through while staying
+        // healthy (so a retry can still verify). The composed outer stream must mirror that:
+        // it must not permanently fault on such a cancellation, or the retry can never verify
+        var currentTenant = GetRequiredService<Volo.Abp.MultiTenancy.ICurrentTenant>();
+        var scope = GetRequiredService<IServiceProvider>().CreateAsyncScope();
+        var endSource = new CancelOnceHealthyAuthenticatedEndStream();
+        await using var stream = new BlobPipelineScopeStream(endSource, scope, currentTenant, null, endSource);
+
+        var buffer = new byte[16];
+
+        // The first read reaches EOF and runs the end check, which cancels while staying healthy
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+        {
+            await stream.ReadAsync(buffer, 0, buffer.Length);
+        });
+
+        // A retry must still be able to run (and pass) the end check, not hit a faulted stream
+        var read = await stream.ReadAsync(buffer, 0, buffer.Length);
+        read.ShouldBe(0);
+        endSource.EndCheckAttempts.ShouldBe(2);
+    }
+
+    private sealed class CancelOnceHealthyAuthenticatedEndStream : Stream, IBlobAuthenticatedEndStream
+    {
+        public int EndCheckAttempts { get; private set; }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => 0;
+
+        public override Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+            => Task.FromResult(0);
+
+        public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+            => new ValueTask<int>(0);
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        public void EnsureReadToAuthenticatedEnd()
+        {
+        }
+
+        public ValueTask EnsureReadToAuthenticatedEndAsync(CancellationToken cancellationToken = default)
+        {
+            EndCheckAttempts++;
+            if (EndCheckAttempts == 1)
+            {
+                // Cancelled before any I/O: the source stays healthy, exactly like the real
+                // decrypting stream when the token trips just after the outer's own check
+                throw new OperationCanceledException();
+            }
+
+            return default;
+        }
+    }
+
+    [Fact]
+    public async Task Should_Fault_The_Composed_Stream_When_An_Inner_Read_Fails_After_Consuming()
+    {
+        // An inner contributor consumes a byte from the stream below it and then fails: the
+        // composed stream must fault so a read-retry layer can not silently continue from the
+        // consumed position and hand the caller content that is missing that byte
+        var currentTenant = GetRequiredService<Volo.Abp.MultiTenancy.ICurrentTenant>();
+        var scope = GetRequiredService<IServiceProvider>().CreateAsyncScope();
+        var underlying = new MemoryStream(new byte[] { 1, 2, 3, 4 });
+        var inner = new ConsumeThenThrowStream(underlying);
+        await using var stream = new BlobPipelineScopeStream(inner, scope, currentTenant, null);
+
+        var buffer = new byte[16];
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+        {
+            await stream.ReadAsync(buffer, 0, buffer.Length);
+        });
+
+        // The failed read must have faulted the stream permanently
+        var retry = await Assert.ThrowsAsync<AbpException>(async () =>
+        {
+            await stream.ReadAsync(buffer, 0, buffer.Length);
+        });
+        retry.Message.ShouldContain("a previous read operation has failed");
+    }
+
+    private sealed class ConsumeThenThrowStream : Stream
+    {
+        private readonly Stream _inner;
+        private bool _thrown;
+
+        public ConsumeThenThrowStream(Stream inner)
+        {
+            _inner = inner;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            if (!_thrown)
+            {
+                _thrown = true;
+                // Consume one byte from the stream below, then fail without handing it up
+                _ = _inner.Read(new byte[1], 0, 1);
+                throw new OperationCanceledException();
+            }
+
+            return _inner.ReadAsync(buffer, cancellationToken);
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _inner.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+
+    [Fact]
+    public async Task Should_Verify_The_Authenticated_End_Through_A_Contributor_That_Stops_Early()
+    {
+        var container = _blobContainerFactory.Create("pipeline-encrypted-earlystop");
+        var content = new byte[100_000];
+        new Random(42).NextBytes(content);
+
+        await container.SaveAsync("earlystop-blob", content, overrideExisting: true);
+
+        // The normal round trip works: reading to the end verifies the terminal record
+        (await container.GetAllBytesAsync("earlystop-blob")).ShouldBe(content);
+
+        // Strip the 20-byte terminal record from the stored ciphertext
+        var raw = _fakeProvider.GetRawBytesOrNull("pipeline-encrypted-earlystop", "earlystop-blob");
+        raw.ShouldNotBeNull();
+        var truncated = new byte[raw!.Length - 20];
+        Array.Copy(raw, truncated, truncated.Length);
+        _fakeProvider.SetRawBytes("pipeline-encrypted-earlystop", "earlystop-blob", truncated);
+
+        // Even though the contributor stops at its own declared length, reading the
+        // composed stream to EOF must now fail because the terminal record is gone
+        using var stream = await container.GetAsync("earlystop-blob");
+        var buffer = new byte[content.Length + 1024];
+
+        await Assert.ThrowsAsync<AbpException>(async () =>
+        {
+            await ReadAllAsync(stream, buffer);
+        });
+
+        // The failure must be permanent: reading again must not swallow it and return
+        // a normal EOF (which a read-retry layer would treat as a complete read)
+        await Assert.ThrowsAsync<AbpException>(async () =>
+        {
+            await stream.ReadAsync(buffer, 0, buffer.Length);
+        });
+    }
+
+    private static async Task ReadAllAsync(Stream stream, byte[] buffer)
+    {
+        int read;
+        var offset = 0;
+        while ((read = await stream.ReadAsync(buffer, offset, buffer.Length - offset)) > 0)
+        {
+            offset += read;
+        }
+    }
+
+    [Fact]
+    public void Should_Not_Forward_Reads_After_The_Scope_Stream_Is_Disposed()
+    {
+        // After dispose the contributor scope is gone; reads must not reach the inner
+        // stream (a use-after-scope), and CanRead must be consistent with that
+        var currentTenant = GetRequiredService<Volo.Abp.MultiTenancy.ICurrentTenant>();
+        var scope = GetRequiredService<IServiceProvider>().CreateAsyncScope();
+        var inner = new MemoryStream(new byte[10]);
+        var stream = new BlobPipelineScopeStream(inner, scope, currentTenant, null);
+
+        stream.Dispose();
+
+        stream.CanRead.ShouldBeFalse();
+        Should.Throw<ObjectDisposedException>(() => stream.Read(new byte[1], 0, 1));
+    }
+
+    [Fact]
+    public async Task Should_Support_A_Synchronous_Dispose_With_An_Async_Only_Scoped_Service()
+    {
+        var container = _blobContainerFactory.Create("pipeline-async-scoped");
+        var content = "async scoped content".GetBytes();
+
+        await container.SaveAsync("async-scoped-blob", content);
+
+        var stream = await container.GetAsync("async-scoped-blob");
+        using var result = new MemoryStream();
+        await stream.CopyToAsync(result);
+        result.ToArray().ShouldBe(content);
+
+        var asyncDisposedCountBefore = FakeAsyncOnlyDisposableService.AsyncDisposedCount;
+        stream.Dispose(); // Must not throw although the scoped service is async-only disposable
+        FakeAsyncOnlyDisposableService.AsyncDisposedCount.ShouldBe(asyncDisposedCountBefore + 1);
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeAPipelineContributor.cs

@@ -0,0 +1,11 @@
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+public class FakeAPipelineContributor : FakeMarkerPipelineContributorBase, ITransientDependency
+{
+    public FakeAPipelineContributor()
+        : base("A>")
+    {
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeAsyncDisposePipelineContributor.cs

@@ -0,0 +1,89 @@
+#nullable enable
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Wraps the content with a stream whose cleanup only happens in DisposeAsync,
+/// so tests can verify the pipeline releases its streams asynchronously — on the
+/// save side and also when the caller disposes the returned stream synchronously.
+/// </summary>
+public class FakeAsyncDisposePipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public static AsyncDisposeOnlyStream? LastSaveStream { get; private set; }
+
+    public static AsyncDisposeOnlyStream? LastGetStream { get; private set; }
+
+    public static AsyncDisposeOnlyStream? IntermediateSaveStream { get; private set; }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        // Two replacements in one call: the intermediate stream must also be collected
+        context.BlobStream = IntermediateSaveStream = new AsyncDisposeOnlyStream(context.BlobStream, ownsInner: false);
+        context.BlobStream = LastSaveStream = new AsyncDisposeOnlyStream(context.BlobStream, ownsInner: false);
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        // The get-side contract: the wrapper owns the received stream
+        context.BlobStream = LastGetStream = new AsyncDisposeOnlyStream(context.BlobStream, ownsInner: true);
+        return Task.CompletedTask;
+    }
+
+    public sealed class AsyncDisposeOnlyStream : Stream
+    {
+        private readonly Stream _inner;
+        private readonly bool _ownsInner;
+
+        public bool AsyncDisposed { get; private set; }
+
+        public AsyncDisposeOnlyStream(Stream inner, bool ownsInner)
+        {
+            _inner = inner;
+            _ownsInner = ownsInner;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => _inner.Read(buffer, offset, count);
+
+        public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            return _inner.ReadAsync(buffer, cancellationToken);
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        // The cleanup only happens asynchronously; the synchronous Dispose is a no-op
+        public override async ValueTask DisposeAsync()
+        {
+            AsyncDisposed = true;
+            if (_ownsInner)
+            {
+                await _inner.DisposeAsync();
+            }
+
+            await base.DisposeAsync();
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeAsyncOnlyDisposableService.cs

@@ -0,0 +1,23 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// A scoped service that only implements <see cref="IAsyncDisposable"/>: a synchronous
+/// dispose of the owning scope would throw for such a service.
+/// </summary>
+public class FakeAsyncOnlyDisposableService : IScopedDependency, IAsyncDisposable
+{
+    private static int _asyncDisposedCount;
+
+    public static int AsyncDisposedCount => Volatile.Read(ref _asyncDisposedCount);
+
+    public ValueTask DisposeAsync()
+    {
+        Interlocked.Increment(ref _asyncDisposedCount);
+        return default;
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeAsyncScopedPipelineContributor.cs

@@ -0,0 +1,28 @@
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Holds an async-only disposable scoped service without transforming the content.
+/// </summary>
+public class FakeAsyncScopedPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    // ReSharper disable once NotAccessedField.Local
+    private readonly FakeAsyncOnlyDisposableService _service;
+
+    public FakeAsyncScopedPipelineContributor(FakeAsyncOnlyDisposableService service)
+    {
+        _service = service;
+    }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeBPipelineContributor.cs

@@ -0,0 +1,11 @@
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+public class FakeBPipelineContributor : FakeMarkerPipelineContributorBase, ITransientDependency
+{
+    public FakeBPipelineContributor()
+        : base("B>")
+    {
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeDisposeThrowingPipelineContributor.cs

@@ -0,0 +1,59 @@
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Wraps the stream with a pass-through wrapper that fails on Dispose, so tests
+/// can verify the best-effort cleanup of the pipeline.
+/// </summary>
+public class FakeDisposeThrowingPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new DisposeThrowingStream(context.BlobStream);
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+
+    private sealed class DisposeThrowingStream : Stream
+    {
+        private readonly Stream _inner;
+
+        public DisposeThrowingStream(Stream inner)
+        {
+            _inner = inner;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => _inner.Read(buffer, offset, count);
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            throw new IOException("Injected dispose failure!");
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeEarlyStopPipelineContributor.cs

@@ -0,0 +1,120 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// On saving, prepends the 4-byte content length; on getting, returns a wrapper that
+/// stops at that declared length — reproducing a contributor that reaches its own EOF
+/// before the decryption stream's authenticated end.
+/// </summary>
+public class FakeEarlyStopPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public async Task OnSavingAsync(BlobPipelineContext context)
+    {
+        using var content = new MemoryStream();
+        await context.BlobStream.CopyToAsync(content, 81920, context.CancellationToken);
+
+        var output = new MemoryStream();
+        var lengthPrefix = BitConverter.GetBytes((int)content.Length);
+        output.Write(lengthPrefix, 0, lengthPrefix.Length);
+        content.Position = 0;
+        await content.CopyToAsync(output, 81920, context.CancellationToken);
+        output.Position = 0;
+        context.BlobStream = output;
+    }
+
+    public async Task OnGettingAsync(BlobPipelineContext context)
+    {
+        var lengthPrefix = new byte[4];
+        await ReadExactlyAsync(context.BlobStream, lengthPrefix, context.CancellationToken);
+        var contentLength = BitConverter.ToInt32(lengthPrefix, 0);
+        context.BlobStream = new LengthLimitedStream(context.BlobStream, contentLength);
+    }
+
+    private static async Task ReadExactlyAsync(Stream stream, byte[] buffer, CancellationToken cancellationToken)
+    {
+        var total = 0;
+        while (total < buffer.Length)
+        {
+            var read = await stream.ReadAsync(buffer.AsMemory(total, buffer.Length - total), cancellationToken);
+            if (read == 0)
+            {
+                throw new AbpException("Unexpected end of stream while reading the length prefix!");
+            }
+
+            total += read;
+        }
+    }
+
+    private sealed class LengthLimitedStream : Stream
+    {
+        private readonly Stream _inner;
+        private long _remaining;
+
+        public LengthLimitedStream(Stream inner, long length)
+        {
+            _inner = inner;
+            _remaining = length;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        // Stops at the declared length without reading the rest of the inner stream
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            if (_remaining <= 0)
+            {
+                return 0;
+            }
+
+            var toRead = (int)Math.Min(count, _remaining);
+            var read = _inner.Read(buffer, offset, toRead);
+            _remaining -= read;
+            return read;
+        }
+
+        public override async ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            if (_remaining <= 0)
+            {
+                return 0;
+            }
+
+            var toRead = (int)Math.Min(buffer.Length, _remaining);
+            var read = await _inner.ReadAsync(buffer.Slice(0, toRead), cancellationToken);
+            _remaining -= read;
+            return read;
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _inner.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeFailingGetPipelineContributor.cs

@@ -0,0 +1,18 @@
+using System;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+public class FakeFailingGetPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        throw new InvalidOperationException("This contributor can not read content back!");
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeInMemoryBlobProvider.cs

@@ -0,0 +1,83 @@
+#nullable enable
+using System.Collections.Concurrent;
+using System.IO;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// A real in-memory provider (not a substitute), so tests can inspect the raw stored bytes.
+/// </summary>
+public class FakeInMemoryBlobProvider : BlobProviderBase
+{
+    private readonly ConcurrentDictionary<string, byte[]> _blobs = new ConcurrentDictionary<string, byte[]>();
+
+    public override async Task SaveAsync(BlobProviderSaveArgs args)
+    {
+        var key = GetKey(args.ContainerName, args.BlobName);
+
+        if (!args.OverrideExisting && _blobs.ContainsKey(key))
+        {
+            throw new BlobAlreadyExistsException(
+                $"Saving BLOB '{args.BlobName}' does already exists in the container '{args.ContainerName}'!");
+        }
+
+        using (var memoryStream = new MemoryStream())
+        {
+            await args.BlobStream.CopyToAsync(memoryStream);
+            _blobs[key] = memoryStream.ToArray();
+        }
+    }
+
+    public override Task<bool> DeleteAsync(BlobProviderDeleteArgs args)
+    {
+        return Task.FromResult(_blobs.TryRemove(GetKey(args.ContainerName, args.BlobName), out _));
+    }
+
+    public override Task<bool> ExistsAsync(BlobProviderExistsArgs args)
+    {
+        return Task.FromResult(_blobs.ContainsKey(GetKey(args.ContainerName, args.BlobName)));
+    }
+
+    public TrackingMemoryStream? LastServedStream { get; private set; }
+
+    public override Task<Stream?> GetOrNullAsync(BlobProviderGetArgs args)
+    {
+        return Task.FromResult<Stream?>(
+            _blobs.TryGetValue(GetKey(args.ContainerName, args.BlobName), out var bytes)
+                ? LastServedStream = new TrackingMemoryStream(bytes)
+                : null
+        );
+    }
+
+    public byte[]? GetRawBytesOrNull(string containerName, string blobName)
+    {
+        return _blobs.TryGetValue(GetKey(containerName, blobName), out var bytes) ? bytes : null;
+    }
+
+    public void SetRawBytes(string containerName, string blobName, byte[] bytes)
+    {
+        _blobs[GetKey(containerName, blobName)] = bytes;
+    }
+
+    private static string GetKey(string containerName, string blobName)
+    {
+        return containerName + "/" + blobName;
+    }
+
+    public sealed class TrackingMemoryStream : MemoryStream
+    {
+        public bool Disposed { get; private set; }
+
+        public TrackingMemoryStream(byte[] bytes)
+            : base(bytes)
+        {
+        }
+
+        protected override void Dispose(bool disposing)
+        {
+            Disposed = true;
+            base.Dispose(disposing);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeIoFailingLengthStream.cs

@@ -0,0 +1,48 @@
+using System;
+using System.IO;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// A readable, non-seekable stream whose length/position probes fail with an
+/// <see cref="IOException"/> — a legal stream shape the optional probes must tolerate.
+/// </summary>
+public sealed class FakeIoFailingLengthStream : Stream
+{
+    private readonly Stream _inner;
+
+    public FakeIoFailingLengthStream(Stream inner)
+    {
+        _inner = inner;
+    }
+
+    public override bool CanRead => true;
+    public override bool CanSeek => false;
+    public override bool CanWrite => false;
+    public override long Length => throw new IOException("The length is not available!");
+
+    public override long Position
+    {
+        get => throw new IOException("The position is not available!");
+        set => throw new NotSupportedException();
+    }
+
+    public override void Flush()
+    {
+    }
+
+    public override int Read(byte[] buffer, int offset, int count) => _inner.Read(buffer, offset, count);
+    public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+    public override void SetLength(long value) => throw new NotSupportedException();
+    public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing)
+        {
+            _inner.Dispose();
+        }
+
+        base.Dispose(disposing);
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeMarkerPipelineContributorBase.cs

@@ -0,0 +1,156 @@
+using System;
+using System.IO;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Prepends a marker while saving and verifies/strips it while getting,
+/// so tests can observe the raw stored form and the execution order.
+/// </summary>
+public abstract class FakeMarkerPipelineContributorBase : IBlobPipelineContributor
+{
+    private readonly byte[] _marker;
+
+    protected FakeMarkerPipelineContributorBase(string marker)
+    {
+        _marker = Encoding.UTF8.GetBytes(marker);
+    }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new MarkerPrependingStream(_marker, context.BlobStream);
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new MarkerStrippingStream(_marker, context.BlobStream);
+        return Task.CompletedTask;
+    }
+
+    private sealed class MarkerPrependingStream : Stream
+    {
+        private readonly byte[] _marker;
+        private readonly Stream _inner;
+        private int _markerPosition;
+
+        public MarkerPrependingStream(byte[] marker, Stream inner)
+        {
+            _marker = marker;
+            _inner = inner;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            if (_markerPosition < _marker.Length)
+            {
+                var toCopy = Math.Min(count, _marker.Length - _markerPosition);
+                Array.Copy(_marker, _markerPosition, buffer, offset, toCopy);
+                _markerPosition += toCopy;
+                return toCopy;
+            }
+
+            return _inner.Read(buffer, offset, count);
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        // The save-side contract: the wrapper leaves the received stream open
+    }
+
+    private sealed class MarkerStrippingStream : Stream
+    {
+        private readonly byte[] _marker;
+        private readonly Stream _inner;
+        private bool _markerConsumed;
+
+        public MarkerStrippingStream(byte[] marker, Stream inner)
+        {
+            _marker = marker;
+            _inner = inner;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            ConsumeMarker();
+            return _inner.Read(buffer, offset, count);
+        }
+
+        private void ConsumeMarker()
+        {
+            if (_markerConsumed)
+            {
+                return;
+            }
+
+            _markerConsumed = true;
+
+            var markerBytes = new byte[_marker.Length];
+            var readCount = 0;
+            while (readCount < markerBytes.Length)
+            {
+                var read = _inner.Read(markerBytes, readCount, markerBytes.Length - readCount);
+                if (read <= 0)
+                {
+                    break;
+                }
+
+                readCount += read;
+            }
+
+            if (readCount != _marker.Length || !((ReadOnlySpan<byte>)markerBytes).SequenceEqual(_marker))
+            {
+                throw new AbpException($"The expected content marker '{Encoding.UTF8.GetString(_marker)}' was not found!");
+            }
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            // The get-side contract: the wrapper owns the received stream
+            if (disposing)
+            {
+                _inner.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeModernAsyncOnlyStream.cs

@@ -0,0 +1,59 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// A stream that only supports the modern async read overload; the synchronous
+/// read throws, like some modern network/response streams.
+/// </summary>
+public sealed class FakeModernAsyncOnlyStream : Stream
+{
+    private readonly Stream _inner;
+
+    public FakeModernAsyncOnlyStream(Stream inner)
+    {
+        _inner = inner;
+    }
+
+    public override bool CanRead => true;
+    public override bool CanSeek => false;
+    public override bool CanWrite => false;
+    public override long Length => throw new NotSupportedException();
+
+    public override long Position
+    {
+        get => throw new NotSupportedException();
+        set => throw new NotSupportedException();
+    }
+
+    public override void Flush()
+    {
+    }
+
+    public override int Read(byte[] buffer, int offset, int count)
+    {
+        throw new InvalidOperationException("This stream only supports the modern async read overload!");
+    }
+
+    public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+    {
+        return _inner.ReadAsync(buffer, cancellationToken);
+    }
+
+    public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+    public override void SetLength(long value) => throw new NotSupportedException();
+    public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing)
+        {
+            _inner.Dispose();
+        }
+
+        base.Dispose(disposing);
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeModernAsyncPipelineContributor.cs

@@ -0,0 +1,23 @@
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Wraps the content with a stream that only supports the modern async read
+/// overload, so tests can verify the pipeline does not degrade such a stream
+/// to the synchronous byte[] fallback of the Stream base class.
+/// </summary>
+public class FakeModernAsyncPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new FakeModernAsyncOnlyStream(context.BlobStream);
+        return Task.CompletedTask;
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeOriginalRestoringPipelineContributor.cs

@@ -0,0 +1,30 @@
+#nullable enable
+using System.IO;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Sets the content stream back to a stream chosen by the test (the caller's
+/// original), so tests can verify the pipeline never treats it as its own.
+/// </summary>
+public class FakeOriginalRestoringPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public static Stream? RestoreTo { get; set; }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        if (RestoreTo != null)
+        {
+            context.BlobStream = RestoreTo;
+        }
+
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeScopedMarkerService.cs

@@ -0,0 +1,37 @@
+using System;
+using System.Threading;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// A scoped service used by <see cref="FakeScopedXorPipelineContributor"/> to prove
+/// that the contributor scope stays alive while the returned stream is being read.
+/// </summary>
+public class FakeScopedMarkerService : IScopedDependency, IDisposable
+{
+    private static int _disposedCount;
+
+    public static int DisposedCount => Volatile.Read(ref _disposedCount);
+
+    private bool _disposed;
+
+    public byte Transform(byte value)
+    {
+        if (_disposed)
+        {
+            throw new ObjectDisposedException(nameof(FakeScopedMarkerService));
+        }
+
+        return (byte)(value ^ 0x5A);
+    }
+
+    public void Dispose()
+    {
+        if (!_disposed)
+        {
+            _disposed = true;
+            Interlocked.Increment(ref _disposedCount);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeScopedXorPipelineContributor.cs

@@ -0,0 +1,86 @@
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// XOR-transforms the content through a scoped service that is used lazily,
+/// while the stream is being read.
+/// </summary>
+public class FakeScopedXorPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    private readonly FakeScopedMarkerService _markerService;
+
+    public FakeScopedXorPipelineContributor(FakeScopedMarkerService markerService)
+    {
+        _markerService = markerService;
+    }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new XorStream(_markerService, context.BlobStream, ownsInner: false);
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new XorStream(_markerService, context.BlobStream, ownsInner: true);
+        return Task.CompletedTask;
+    }
+
+    private sealed class XorStream : Stream
+    {
+        private readonly FakeScopedMarkerService _markerService;
+        private readonly Stream _inner;
+        private readonly bool _ownsInner;
+
+        public XorStream(FakeScopedMarkerService markerService, Stream inner, bool ownsInner)
+        {
+            _markerService = markerService;
+            _inner = inner;
+            _ownsInner = ownsInner;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            var readCount = _inner.Read(buffer, offset, count);
+            for (var i = 0; i < readCount; i++)
+            {
+                buffer[offset + i] = _markerService.Transform(buffer[offset + i]);
+            }
+
+            return readCount;
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing && _ownsInner)
+            {
+                _inner.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeSetThenThrowPipelineContributor.cs

@@ -0,0 +1,65 @@
+#nullable enable
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Replaces the stream and then fails, so tests can verify that the
+/// already-created stream is not leaked.
+/// </summary>
+public class FakeSetThenThrowPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public static TrackableStream? LastCreatedStream { get; private set; }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = LastCreatedStream = new TrackableStream(context.BlobStream);
+        throw new InvalidOperationException("This contributor fails after replacing the stream!");
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+
+    public sealed class TrackableStream : Stream
+    {
+        private readonly Stream _inner;
+
+        public bool Disposed { get; private set; }
+
+        public TrackableStream(Stream inner)
+        {
+            _inner = inner;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count) => _inner.Read(buffer, offset, count);
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            Disposed = true;
+            base.Dispose(disposing);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeTenantAssertingPipelineContributor.cs

@@ -0,0 +1,100 @@
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+using Volo.Abp.MultiTenancy;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Asserts, lazily while the content is read, that the ambient tenant is the
+/// tenant the BLOB operation belongs to.
+/// </summary>
+public class FakeTenantAssertingPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    private readonly ICurrentTenant _currentTenant;
+
+    public FakeTenantAssertingPipelineContributor(ICurrentTenant currentTenant)
+    {
+        _currentTenant = currentTenant;
+    }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new TenantAssertingStream(context.BlobStream, _currentTenant, context.TenantId);
+        return Task.CompletedTask;
+    }
+
+    private sealed class TenantAssertingStream : Stream
+    {
+        private readonly Stream _inner;
+        private readonly ICurrentTenant _currentTenant;
+        private readonly Guid? _expectedTenantId;
+
+        public TenantAssertingStream(Stream inner, ICurrentTenant currentTenant, Guid? expectedTenantId)
+        {
+            _inner = inner;
+            _currentTenant = currentTenant;
+            _expectedTenantId = expectedTenantId;
+        }
+
+        public override bool CanRead
+        {
+            get
+            {
+                // Stream.CopyToAsync reads CanRead before the first ReadAsync call
+                AssertTenant();
+                return true;
+            }
+        }
+
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush()
+        {
+        }
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            AssertTenant();
+            return _inner.Read(buffer, offset, count);
+        }
+
+        private void AssertTenant()
+        {
+            if (_currentTenant.Id != _expectedTenantId)
+            {
+                throw new AbpException(
+                    $"The lazy transformation ran in the tenant '{_currentTenant.Id?.ToString() ?? "host"}' " +
+                    $"instead of the tenant of the BLOB operation ('{_expectedTenantId?.ToString() ?? "host"}')!");
+            }
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _inner.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeTenantBlobEncryptionKeyProvider.cs

@@ -0,0 +1,60 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// A custom key provider giving each tenant its own passphrase, selected from the
+/// tenant carried by the <see cref="BlobEncryptionKeyContext"/>.
+/// </summary>
+public class FakeTenantBlobEncryptionKeyProvider : DefaultBlobEncryptionKeyProvider
+{
+    public const string PassPhrasePrefix = "tenant-passphrase-";
+
+    public FakeTenantBlobEncryptionKeyProvider(
+        IOptions<AbpBlobStoringEncryptionOptions> options)
+        : base(options)
+    {
+    }
+
+    public override Task<BlobEncryptionKey> ResolveForEncryptionAsync(
+        BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        var containerPassPhrase = GetContainerPassPhraseOrNull(context.Configuration);
+        if (string.IsNullOrWhiteSpace(containerPassPhrase) && context.TenantId.HasValue)
+        {
+            return Task.FromResult(new BlobEncryptionKey(
+                BlobEncryptionKeySource.Tenant,
+                GetPassPhrase(context.TenantId.Value)
+            ));
+        }
+
+        return base.ResolveForEncryptionAsync(context, cancellationToken);
+    }
+
+    public override Task<string> ResolveForDecryptionAsync(
+        BlobEncryptionKeySource keySource,
+        BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        if (keySource == BlobEncryptionKeySource.Tenant)
+        {
+            if (!context.TenantId.HasValue)
+            {
+                throw new AbpException("The BLOB was encrypted with a tenant-specific passphrase, but there is no current tenant!");
+            }
+
+            return Task.FromResult(GetPassPhrase(context.TenantId.Value));
+        }
+
+        return base.ResolveForDecryptionAsync(keySource, context, cancellationToken);
+    }
+
+    public static string GetPassPhrase(Guid tenantId)
+    {
+        return PassPhrasePrefix + tenantId.ToString("N");
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeTenantRecordingScopedPipelineContributor.cs

@@ -0,0 +1,29 @@
+using System.Threading.Tasks;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Holds a <see cref="FakeTenantRecordingScopedService"/> in the contributor scope
+/// without transforming the content.
+/// </summary>
+public class FakeTenantRecordingScopedPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    // ReSharper disable once NotAccessedField.Local
+    private readonly FakeTenantRecordingScopedService _service;
+
+    public FakeTenantRecordingScopedPipelineContributor(FakeTenantRecordingScopedService service)
+    {
+        _service = service;
+    }
+
+    public Task OnSavingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        return Task.CompletedTask;
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/Fakes/FakeTenantRecordingScopedService.cs

@@ -0,0 +1,35 @@
+using System;
+using Volo.Abp.DependencyInjection;
+using Volo.Abp.MultiTenancy;
+
+namespace Volo.Abp.BlobStoring.Fakes;
+
+/// <summary>
+/// Records the ambient tenant at the moment the owning scope disposes it, so tests
+/// can verify the scope is released in the tenant of the BLOB operation.
+/// </summary>
+public class FakeTenantRecordingScopedService : IScopedDependency, IDisposable
+{
+    public static Guid? LastDisposeTenantId { get; private set; }
+
+    public static bool HasRecordedDispose { get; private set; }
+
+    private readonly ICurrentTenant _currentTenant;
+
+    public FakeTenantRecordingScopedService(ICurrentTenant currentTenant)
+    {
+        _currentTenant = currentTenant;
+    }
+
+    public static void Reset()
+    {
+        LastDisposeTenantId = null;
+        HasRecordedDispose = false;
+    }
+
+    public void Dispose()
+    {
+        LastDisposeTenantId = _currentTenant.Id;
+        HasRecordedDispose = true;
+    }
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/TestObjects/TestContainer4.cs

@@ -0,0 +1,6 @@
+namespace Volo.Abp.BlobStoring.TestObjects;
+
+public class TestContainer4
+{
+
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/TestObjects/TestContainer5.cs

@@ -0,0 +1,6 @@
+namespace Volo.Abp.BlobStoring.TestObjects;
+
+public class TestContainer5
+{
+
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/TestObjects/TestContainer6.cs

@@ -0,0 +1,6 @@
+namespace Volo.Abp.BlobStoring.TestObjects;
+
+public class TestContainer6
+{
+
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/TestObjects/TestContainer7.cs

@@ -0,0 +1,5 @@
+namespace Volo.Abp.BlobStoring.TestObjects;
+
+public class TestContainer7
+{
+}

framework/test/Volo.Abp.BlobStoring.Tests/Volo/Abp/BlobStoring/TestObjects/TestContainer8.cs

@@ -0,0 +1,5 @@
+namespace Volo.Abp.BlobStoring.TestObjects;
+
+public class TestContainer8
+{
+}