Method GetAIProviderKeys

enterprise/dbcrypt/dbcrypt.go:559–570

GetAIProviderKeys returns AI provider key rows with their api_key decrypted. The list handler relies on the default scope (live providers only); the dbcrypt key rotation utility calls with includeDeleted=TRUE so it can walk every row holding a foreign-key reference to dbcrypt_keys before old keys ar

(ctx context.Context, includeDeleted bool)

// includeDeleted=TRUE so it can walk every row holding a foreign-key
// reference to dbcrypt_keys before old keys are revoked.
func (db *dbCrypt) GetAIProviderKeys(ctx context.Context, includeDeleted bool) ([]database.AIProviderKey, error) {
	keys, err := db.Store.GetAIProviderKeys(ctx, includeDeleted)
	if err != nil {
		return nil, err
	}
	for i := range keys {
		if err := db.decryptAIProviderKey(&keys[i]); err != nil {
			return nil, err
		}
	}
	return keys, nil
}

// UpdateEncryptedAIProviderKey re-encrypts the api_key column of a
// key row, so that dbcrypt key rotation can move every FK reference