3 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	47ba13083e	feat: make a split deployment work end to end by fixing the three defects that made an off-host node impossible to configure (nodeEnvKeys shipped S3_BUCKET and KMS_KEY_ID, which nothing reads, so an AWS-backed node silently used the default bucket and key alias; a joined consumer never received PRIMARY_DB and died at boot; and node.env was rewritten on every join with no file an operator could add to), then removing the need for cloud credentials on a node at all with brokered KMS and blob providers that renderNodeEnv hands out automatically, plus deploy/split-cloud, scripts/aws-bootstrap.sh, two fleet instance checks and the docs	2026-09-10 13:58:59 +02:00
Matthew Meszaros	a6acb97dea	feat: key the worker-facing internal DEK endpoint by organization ... The /api/v1/internal/dek route parameter is now :orgID to match the org-scoped encryptedkeys store. Workers fetch the organization DEK for the account they are operating on instead of a user DEK.	2026-06-10 17:16:07 +02:00
Matthew Meszaros	99226338c9	infra(encryptedkeys): pluggable DEK store with HTTP proxy for workers ... New encryptedkeys.Store interface with three impls: postgres - backend default, durable via PG dynamodb - existing AWS path, also covers Scylla Alternator via AWS_ENDPOINT_URL_DYNAMODB http - worker-side adapter that talks to the backend's new /api/v1/internal/dek/:userID endpoint, so workers never connect directly to Postgres The HTTP endpoint sits behind a new InternalAuthMiddleware that does constant-time bearer-token compare against INTERNAL_API_TOKEN. Fail- closed if the env var is unset. cipher.Service now takes an encryptedkeys.Store instead of a Dynamo repository. The old internal/repository/dynamo_user_encrypted_keys.go is deleted (the file also had a pre-existing copy-paste bug using EmailMessageMapTable in Get/Del that's gone with it). New migration 38 adds user_encrypted_keys (user_id PK, encrypted_data_key, created_at, updated_at). 20 tests cover HTTP round-trip, conflict semantics, factory selection, middleware auth (fail-closed / wrong-scheme / timing-safe / happy path), and DEK handler responses through gin's test harness.	2026-05-27 14:42:11 +00:00