Matthew Meszaros 99226338c9 infra(encryptedkeys): pluggable DEK store with HTTP proxy for workers ...

New encryptedkeys.Store interface with three impls:

  postgres  - backend default, durable via PG
  dynamodb  - existing AWS path, also covers Scylla Alternator via
              AWS_ENDPOINT_URL_DYNAMODB
  http      - worker-side adapter that talks to the backend's new
              /api/v1/internal/dek/:userID endpoint, so workers never
              connect directly to Postgres

The HTTP endpoint sits behind a new InternalAuthMiddleware that does
constant-time bearer-token compare against INTERNAL_API_TOKEN. Fail-
closed if the env var is unset.

cipher.Service now takes an encryptedkeys.Store instead of a Dynamo
repository. The old internal/repository/dynamo_user_encrypted_keys.go
is deleted (the file also had a pre-existing copy-paste bug using
EmailMessageMapTable in Get/Del that's gone with it).

New migration 38 adds user_encrypted_keys (user_id PK, encrypted_data_key,
created_at, updated_at).

20 tests cover HTTP round-trip, conflict semantics, factory selection,
middleware auth (fail-closed / wrong-scheme / timing-safe / happy path),
and DEK handler responses through gin's test harness.

2026-05-27 14:42:11 +00:00

..

cache.go

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

cipher.go

infra(encryptedkeys): pluggable DEK store with HTTP proxy for workers

2026-05-27 14:42:11 +00:00

config.go

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

decrypt.go

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

encrypt.go

New Repository: Add Backend Code

2026-01-17 14:11:14 +00:00

service.go

infra(encryptedkeys): pluggable DEK store with HTTP proxy for workers

2026-05-27 14:42:11 +00:00