From 8c5c88aefb2ab922d1b9b603595aae940dfd9df8 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 28 Oct 2025 23:41:25 +0800
Subject: [PATCH] misc: corrected hsm placement

---
 backend/src/ee/services/hsm/hsm-fns.ts |  2 +-
 backend/src/server/routes/index.ts     | 54 +++++++++++++-------------
 2 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/backend/src/ee/services/hsm/hsm-fns.ts b/backend/src/ee/services/hsm/hsm-fns.ts
index 400fa31e9..d37766f71 100644
--- a/backend/src/ee/services/hsm/hsm-fns.ts
+++ b/backend/src/ee/services/hsm/hsm-fns.ts
@@ -84,7 +84,7 @@ export const isHsmActiveAndEnabled = async ({
 
   rootKmsConfigEncryptionStrategy = (rootKmsConfig?.encryptionStrategy || null) as RootKeyEncryptionStrategy | null;
   if (
-    rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.HSM &&
+    (rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.HSM || isHsmConfigured) &&
     licenseService &&
     !licenseService.onPremFeatures.hsm
   ) {
diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts
index 44a5c8503..d50f3d01e 100644
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -2300,36 +2300,36 @@ export const registerRoutes = async (
   // setup the communication with license key server
   await licenseService.init();
 
+  // If FIPS is enabled, we check to ensure that the users license includes FIPS mode.
+  crypto.verifyFipsLicense(licenseService);
+
+  // Start HSM service if it's configured/enabled.
+  await hsmService.startService();
+
+  const hsmStatus = await isHsmActiveAndEnabled({
+    hsmService,
+    kmsRootConfigDAL,
+    licenseService
+  });
+
+  // if the encryption strategy is software - user needs to provide an encryption key
+  // if the encryption strategy is null AND the hsm is not configured - user needs to provide an encryption key
+  const needsEncryptionKey =
+    hsmStatus.rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.Software ||
+    (hsmStatus.rootKmsConfigEncryptionStrategy === null && !hsmStatus.isHsmConfigured);
+
+  if (needsEncryptionKey) {
+    if (!envConfig.ROOT_ENCRYPTION_KEY && !envConfig.ENCRYPTION_KEY) {
+      throw new BadRequestError({
+        message:
+          "Root KMS encryption strategy is set to software. Please set the ENCRYPTION_KEY environment variable and restart your deployment.\nYou can enable HSM encryption in the Server Console."
+      });
+    }
+  }
+
   const completeServerInitialization = async () => {
     await superAdminService.initServerCfg();
 
-    // If FIPS is enabled, we check to ensure that the users license includes FIPS mode.
-    crypto.verifyFipsLicense(licenseService);
-
-    // Start HSM service if it's configured/enabled.
-    await hsmService.startService();
-
-    const hsmStatus = await isHsmActiveAndEnabled({
-      hsmService,
-      kmsRootConfigDAL,
-      licenseService
-    });
-
-    // if the encryption strategy is software - user needs to provide an encryption key
-    // if the encryption strategy is null AND the hsm is not configured - user needs to provide an encryption key
-    const needsEncryptionKey =
-      hsmStatus.rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.Software ||
-      (hsmStatus.rootKmsConfigEncryptionStrategy === null && !hsmStatus.isHsmConfigured);
-
-    if (needsEncryptionKey) {
-      if (!envConfig.ROOT_ENCRYPTION_KEY && !envConfig.ENCRYPTION_KEY) {
-        throw new BadRequestError({
-          message:
-            "Root KMS encryption strategy is set to software. Please set the ENCRYPTION_KEY environment variable and restart your deployment.\nYou can enable HSM encryption in the Server Console."
-        });
-      }
-    }
-
     await telemetryQueue.startTelemetryCheck();
     await telemetryQueue.startAggregatedEventsJob();
     await dailyResourceCleanUp.init();