bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

runtime: derive secret keys with hkdf

Browse Source
This commit is contained in:
a.tolmachev
2026-04-12 11:36:28 +03:00
parent 99a5d44fea
commit 7a9248a0f3
7 changed files with 186 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/admin-api/src/service.rs
+8 -4
View File
@@ -2386,9 +2386,10 @@ impl AdminService {
secret_id: secret_id.as_str().to_owned(),
version: secret.secret.current_version,
})?;
let plaintext = self
.secret_crypto
.decrypt(&version.secret_version.ciphertext)?;
let plaintext = self.secret_crypto.decrypt(
&version.secret_version.key_version,
&version.secret_version.ciphertext,
)?;
self.registry
.touch_secret(workspace_id, secret_id, &used_at)
.await
@@ -4667,7 +4668,10 @@ async fn resolve_runtime_auth_for_task(
secret_id: secret_id.as_str().to_owned(),
version: secret.secret.current_version,
})?;
let plaintext = secret_crypto.decrypt(&version.secret_version.ciphertext)?;
let plaintext = secret_crypto.decrypt(
&version.secret_version.key_version,
&version.secret_version.ciphertext,
)?;
registry
.touch_secret(workspace_id, secret_id, &used_at)
.await