Method createMigrationServices

internal/commands/migrate.go:479–513

createMigrationServices creates old and new encryption services for migration

()

// createMigrationServices creates old and new encryption services for migration
func (cmd *MigrateKeysCommand) createMigrationServices() (oldService, newService encryption.Service, err error) {
	// Create old encryption service (for decryption) based on parameters only
	if cmd.fromKey != "" {
		// Decrypt with specified key
		oldService, err = encryption.NewService(cmd.fromKey)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to create old encryption service: %w", err)
		}
	} else {
		// Enable encryption scenario: data should be unencrypted
		// Use noop service (empty key means no encryption)
		oldService, err = encryption.NewService("")
		if err != nil {
			return nil, nil, fmt.Errorf("failed to create noop encryption service for source: %w", err)
		}
	}

	// Create new encryption service (for encryption) based on parameters only
	if cmd.toKey != "" {
		// Encrypt with specified key
		newService, err = encryption.NewService(cmd.toKey)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to create new encryption service: %w", err)
		}
	} else {
		// Disable encryption scenario: data should be unencrypted
		// Use noop service (empty key means no encryption)
		newService, err = encryption.NewService("")
		if err != nil {
			return nil, nil, fmt.Errorf("failed to create noop encryption service for target: %w", err)
		}
	}

	return oldService, newService, nil
}

// processBatchToTempTable processes a batch of keys and writes to temporary table
func (cmd *MigrateKeysCommand) processBatchToTempTable(keys []models.APIKey, oldService, newService encryption.Service) error {