Method UpdateEncryptedAIProviderKey

enterprise/dbcrypt/dbcrypt.go:575–590

UpdateEncryptedAIProviderKey re-encrypts the api_key column of a key row, so that dbcrypt key rotation can move every FK reference to a new key digest before old keys are revoked.

(ctx context.Context, params database.UpdateEncryptedAIProviderKeyParams)

// key row, so that dbcrypt key rotation can move every FK reference
// to a new key digest before old keys are revoked.
func (db *dbCrypt) UpdateEncryptedAIProviderKey(ctx context.Context, params database.UpdateEncryptedAIProviderKeyParams) (database.AIProviderKey, error) {
	if strings.TrimSpace(params.APIKey) == "" {
		params.ApiKeyKeyID = sql.NullString{}
	} else if err := db.encryptField(&params.APIKey, &params.ApiKeyKeyID); err != nil {
		return database.AIProviderKey{}, err
	}

	key, err := db.Store.UpdateEncryptedAIProviderKey(ctx, params)
	if err != nil {
		return database.AIProviderKey{}, err
	}
	if err := db.decryptAIProviderKey(&key); err != nil {
		return database.AIProviderKey{}, err
	}
	return key, nil
}

func (db *dbCrypt) decryptUserAIProviderKey(key *database.UserAiProviderKey) error {
	return db.decryptField(&key.APIKey, key.ApiKeyKeyID)