runtime: derive secret keys with hkdf

2026-04-12 11:36:28 +03:00
parent 99a5d44fea
commit 7a9248a0f3
7 changed files with 186 additions and 46 deletions
@@ -582,7 +582,10 @@ async fn resolve_auth_profile(
                secret_id: secret_id.as_str().to_owned(),
                version: secret.secret.current_version,
            })?;
-        let plaintext = secret_crypto.decrypt(&version.secret_version.ciphertext)?;
+        let plaintext = secret_crypto.decrypt(
+            &version.secret_version.key_version,
+            &version.secret_version.ciphertext,
+        )?;
        registry
            .touch_secret(workspace_id, secret_id, &used_at)
            .await