refactor(kms): extract ciphertext envelope decoding

[vieiralucas]

Summary

`Decrypt` and `ReEncrypt` each carried ~100 lines of ciphertext-envelope decoding and XOR-decryption logic, all identical: parse the base64 blob, branch on the `fakecloud-kms:` / `fakecloud-imported:` prefix, look up the source key, and either decode the embedded plaintext directly or un-XOR the imported-key envelope.

Move all of that into `decode_ciphertext_envelope`, a helper that returns a `DecodedCiphertext { source_arn, plaintext_b64 }`. `Decrypt` now builds its JSON response straight from the struct; `ReEncrypt` uses it to drive the subsequent destination-key re-wrap. The two envelope prefix strings become file-level constants instead of being redeclared in each function. `invalid_ciphertext()` is a tiny error-construction helper that used to be inlined in six different places with the same body.

No behavior change. Same `AwsServiceError` codes, same messages, same response shapes.

Test plan

• `cargo fmt`
• `cargo clippy --workspace --all-targets -- -D warnings`
• `cargo test -p fakecloud-kms` (50 passed)

---

Summary by cubic

Refactored fakecloud-kms to extract ciphertext-envelope decoding into decode_ciphertext_envelope, removing duplicated logic in Decrypt and ReEncrypt. No behavior changes; same error codes, messages, and response shapes.

• Refactors
  • Added decode_ciphertext_envelope, returning DecodedCiphertext { source_arn, plaintext_b64 }.
  • Promoted FAKE_ENVELOPE_PREFIX and IMPORTED_ENVELOPE_PREFIX to file-level constants; added invalid_ciphertext() helper.
  • Updated Decrypt and ReEncrypt to use the helper and simplify code paths.

^{Written for commit 9acc6f8. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-kms/src/service.rs">

<violation number="1" location="crates/fakecloud-kms/src/service.rs:99">
P2: Refactor changed `ReEncrypt` malformed-ciphertext message by hard-coding a different unknown-prefix error in the shared decoder.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Refactor changed ReEncrypt malformed-ciphertext message by hard-coding a different unknown-prefix error in the shared decoder.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-kms/src/service.rs, line 99:

<comment>Refactor changed `ReEncrypt` malformed-ciphertext message by hard-coding a different unknown-prefix error in the shared decoder.</comment>

<file context>
@@ -11,9 +11,102 @@ use fakecloud_aws::arn::Arn;
+    Err(AwsServiceError::aws_error(
+        StatusCode::BAD_REQUEST,
+        "InvalidCiphertextException",
+        "The ciphertext is not a valid FakeCloud KMS ciphertext",
+    ))
+}
</file context>