fix: fips + hsm mode, key requirements

backend/e2e-test/routes/v2/service-token.spec.ts

@@ -146,7 +146,8 @@ describe("Service token secret ops", async () => {
   let folderId = "";
   beforeAll(async () => {
     initLogger();
-    await initEnvConfig(testSuperAdminDAL, logger);
+
+    await initEnvConfig(testHsmService, testKmsRootConfigDAL, testSuperAdminDAL, logger);
 
     serviceToken = await createServiceToken(
       [{ secretPath: "/**", environment: seedData1.environment.slug }],

backend/e2e-test/routes/v3/secrets.spec.ts

@@ -158,7 +158,7 @@ describe("Secret V3 Router", async () => {
   let folderId = "";
   beforeAll(async () => {
     initLogger();
-    await initEnvConfig(testSuperAdminDAL, logger);
+    await initEnvConfig(testHsmService, testKmsRootConfigDAL, testSuperAdminDAL, logger);
 
     const projectKeyRes = await testServer.inject({
       method: "GET",

backend/e2e-test/vitest-environment-knex.ts

@@ -6,7 +6,7 @@ import { crypto } from "@app/lib/crypto/cryptography";
 import path from "path";
 
 import { seedData1 } from "@app/db/seed-data";
-import { getDatabaseCredentials, initEnvConfig } from "@app/lib/config/env";
+import { getDatabaseCredentials, getHsmConfig, initEnvConfig } from "@app/lib/config/env";
 import { initLogger } from "@app/lib/logger";
 import { main } from "@app/server/app";
 import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
@@ -20,6 +20,8 @@ import { initializeHsmModule } from "@app/ee/services/hsm/hsm-fns";
 import { buildRedisFromConfig } from "@app/lib/config/redis";
 import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
 import { bootstrapCheck } from "@app/server/boot-strap-check";
+import { hsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
+import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
 
 dotenv.config({ path: path.join(__dirname, "../../.env.test"), debug: true });
 export default {
@@ -28,6 +30,7 @@ export default {
   async setup() {
     const logger = initLogger();
     const databaseCredentials = getDatabaseCredentials(logger);
+    const hsmConfig = getHsmConfig(logger);
 
     const db = initDbConnection({
       dbConnectionUri: databaseCredentials.dbConnectionUri,
@@ -35,7 +38,19 @@ export default {
     });
 
     const superAdminDAL = superAdminDALFactory(db);
-    const envCfg = await initEnvConfig(superAdminDAL, logger);
+    const kmsRootConfigDAL = kmsRootConfigDALFactory(db);
+
+    const hsmModule = initializeHsmModule(hsmConfig);
+    hsmModule.initialize();
+
+    const hsmService = hsmServiceFactory({
+      hsmModule: hsmModule.getModule(),
+      envConfig: hsmConfig
+    });
+
+    await hsmService.startService();
+
+    const envCfg = await initEnvConfig(hsmService, kmsRootConfigDAL, superAdminDAL, logger);
 
     const redis = buildRedisFromConfig(envCfg);
     await redis.flushdb("SYNC");
@@ -68,16 +83,14 @@ export default {
 
       await queue.initialize();
 
-      const hsmModule = initializeHsmModule(envCfg);
-      hsmModule.initialize();
-
       const server = await main({
         db,
         smtp,
         logger,
         queue,
         keyStore,
-        hsmModule: hsmModule.getModule(),
+        hsmService,
+        kmsRootConfigDAL,
         superAdminDAL,
         redis,
         envConfig: envCfg
@@ -92,6 +105,10 @@ export default {
       // @ts-expect-error type
       globalThis.testSuperAdminDAL = superAdminDAL;
       // @ts-expect-error type
+      globalThis.testKmsRootConfigDAL = kmsRootConfigDAL;
+      // @ts-expect-error type
+      globalThis.testHsmService = hsmService;
+      // @ts-expect-error type
       globalThis.jwtAuthToken = crypto.jwt().sign(
         {
           authTokenType: AuthTokenType.ACCESS_TOKEN,