fix: only validate encryption key if HSM not active

backend/src/lib/crypto/cryptography/crypto.ts

@@ -122,6 +122,19 @@ const cryptographyFactory = () => {
 
       const appCfg = envCfg || getConfig();
 
+      const hsmStatus = await isHsmActiveAndEnabled({
+        hsmService,
+        kmsRootConfigDAL
+      });
+
+      // if the encryption strategy is software - user needs to provide an encryption key
+      // if the encryption strategy is null AND the hsm is not configured - user needs to provide an encryption key
+      const needsEncryptionKey =
+        hsmStatus.rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.Software ||
+        (hsmStatus.rootKmsConfigEncryptionStrategy === null && !hsmStatus.isHsmConfigured);
+
+      // only perform encryption key validation if it's actually required.
+      if (needsEncryptionKey) {
         if (appCfg.ENCRYPTION_KEY) {
           // we need to validate that the ENCRYPTION_KEY is a base64 encoded 256-bit key
 
@@ -140,18 +153,6 @@ const cryptographyFactory = () => {
             });
           }
         } else {
-        const hsmStatus = await isHsmActiveAndEnabled({
-          hsmService,
-          kmsRootConfigDAL
-        });
-
-        // if the encryption strategy is software - user needs to provide an encryption key
-        // if the encryption strategy is null AND the hsm is not configured - user needs to provide an encryption key
-        const needsEncryptionKey =
-          hsmStatus.rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.Software ||
-          (hsmStatus.rootKmsConfigEncryptionStrategy === null && !hsmStatus.isHsmConfigured);
-
-        if (needsEncryptionKey) {
           throw new CryptographyError({
             message:
               "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not set.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"