fix: fips + hsm mode, key requirements

backend/src/ee/services/hsm/hsm-fns.ts

@@ -73,7 +73,7 @@ export const isHsmActiveAndEnabled = async ({
 }: {
   hsmService: Pick<THsmServiceFactory, "isActive">;
   kmsRootConfigDAL: Pick<TKmsRootConfigDALFactory, "findById">;
-  licenseService: Pick<TLicenseServiceFactory, "onPremFeatures">;
+  licenseService?: Pick<TLicenseServiceFactory, "onPremFeatures">;
 }) => {
   const isHsmConfigured = await hsmService.isActive();
 
@@ -83,7 +83,11 @@ export const isHsmActiveAndEnabled = async ({
   const rootKmsConfig = await kmsRootConfigDAL.findById(KMS_ROOT_CONFIG_UUID).catch(() => null);
 
   rootKmsConfigEncryptionStrategy = (rootKmsConfig?.encryptionStrategy || null) as RootKeyEncryptionStrategy | null;
-  if (rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.HSM && !licenseService.onPremFeatures.hsm) {
+  if (
+    rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.HSM &&
+    licenseService &&
+    !licenseService.onPremFeatures.hsm
+  ) {
     throw new BadRequestError({
       message: "Your license does not include HSM integration. Please upgrade to the Enterprise plan to use HSM."
     });

backend/src/ee/services/hsm/hsm-service.ts

@@ -25,6 +25,8 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
   const AES_KEY_SIZE = 256;
   const HMAC_KEY_SIZE = 256;
 
+  let pkcs11TestPassed = false;
+
   const $withSession = async <T>(callbackWithSession: SessionCallback<T>): Promise<T> => {
     const RETRY_INTERVAL = 200; // 200ms between attempts
     const MAX_TIMEOUT = 90_000; // 90 seconds maximum total time
@@ -363,7 +365,9 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
       return false;
     }
 
-    let pkcs11TestPassed = false;
+    if (pkcs11TestPassed) {
+      return true;
+    }
 
     try {
       pkcs11TestPassed = await $withSession($testPkcs11Module);
@@ -371,7 +375,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
       logger.error(err, "HSM: Error testing PKCS#11 module");
     }
 
-    return envConfig.isHsmConfigured && isInitialized && pkcs11TestPassed;
+    return pkcs11TestPassed;
   };
 
   const startService = async () => {