refactor(keyring): fold master-key/KMS lifecycle into the deep module#144
Merged
Merged
Conversation
Extends ADR-0013: the envelope-encryption data plane was already a deep module, but the master-key/KMS lifecycle around it was a shallow, exported control surface that leaked and could not be tested. - Hide root-key material: unexport the master-key type and its bytes; only the opaque MasterKeyChain handle crosses the package boundary. Add MasterKeyChain.Has for presence checks without leaking material. - Make bootstrap testable: extract bootstrapWith behind the kek/dek store seams so KEK loading is unit-tested without a database. Public Bootstrap / NewKekUseCase signatures and di wiring are unchanged. - Honest KMS seam: add Encrypt to KMSKeeper so the create/rotate master-key CLI commands drop their runtime type assertions; add an exported keyring.FakeKMSService as a real second adapter and cover loadMasterKeyChainFromKMS in-package. - Delete the unused internal/tokenization/testing helper. Also reconcile .mockery.yaml with the current package layout (it still referenced the deleted crypto/auth-service packages): repository mocks now generate beside their domain interfaces, KekUseCase under keyring. Verified: make lint, make test, and make test-all (incl. the DB-backed integration suite) all pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends ADR-0013. The envelope-encryption data plane was already a deep module, but the master-key/KMS lifecycle around it stayed a shallow, exported control surface — it leaked raw key material and had no test seam. This folds that lifecycle into
keyring.Hide root-key material
keybytes; only the opaqueMasterKeyChainhandle crosses the package boundary.MasterKeyChain.Has(id) bool— presence check with no material leak.internal/tokenization/testinghelper.Make bootstrap testable (Option A — narrow public interface)
bootstrapWithbehind thekekStore/dekStoreseams so KEK loading is unit-tested without a database.Bootstrap/NewKekUseCasesignatures and the DI wiring are unchanged.Honest KMS seam
EncrypttoKMSKeeper— the create/rotate-master-key CLI commands (and the integration helpers) drop their runtime*secrets.Keepertype assertions.keyring.FakeKMSServiceas a real second adapter; coverloadMasterKeyChainFromKMSin-package (env / base64 / key-size / decrypt-fail / active-not-found / happy multi-key).Mockery reconciliation
.mockery.yamlstill referenced deletedcrypto/auth-servicepackages. Repointed every interface at its real home: repository mocks now generate beside theirdomaininterfaces,KekUseCaseunderkeyring. The 6 usecase tests import paths updated accordingly.Testing
make lint— 0 issues, govulncheck cleanmake test— pass, keyring unit coverage added for previously-untested pathsmake test-all— pass, including the DB-backed integration suite against real PostgresReview
Ran the two-axis code review (Standards + Spec) — Spec clean; the one hard Standards finding (table-driven tests) fixed.
🤖 Generated with Claude Code