Method DecryptContext

hckms/keysource.go:201–235

DecryptContext decrypts the EncryptedKey with HuaweiCloud KMS and returns the result.

(ctx context.Context)

// DecryptContext decrypts the EncryptedKey with HuaweiCloud KMS and returns the result.
func (key *MasterKey) DecryptContext(ctx context.Context) ([]byte, error) {
	client, err := key.createKMSClient(ctx)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to create HuaweiCloud KMS client: %w", err)
	}

	decryptAlgorithm := model.GetDecryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT

	request := &model.DecryptDataRequest{
		Body: &model.DecryptDataRequestBody{
			CipherText:          key.EncryptedKey,
			EncryptionAlgorithm: &decryptAlgorithm,
			KeyId:               &key.KeyUUID,
		},
	}

	response, err := client.DecryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to decrypt sops data key with HuaweiCloud KMS: %w", err)
	}

	if response.PlainText == nil {
		return nil, fmt.Errorf("decryption response missing plaintext")
	}
	decrypted, err := base64.StdEncoding.DecodeString(*response.PlainText)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to base64 decode decrypted data key: %w", err)
	}

	log.WithField("keyID", key.KeyID).Info("Decryption succeeded")
	return decrypted, nil
}

// NeedsRotation returns whether the data key needs to be rotated or not.
func (key *MasterKey) NeedsRotation() bool {