@@ -1012,29 +1012,80 @@ where
10121012 vault_url, key_name
10131013 ) ;
10141014
1015- // Implementation notes for Azure Key Vault integration:
1016- // This is a deterministic implementation that provides consistent results
1017- // while maintaining the interface for future Azure SDK integration
1018-
1019- // For a real Azure Key Vault integration, you would:
1020- // 1. Add azure_security_keyvault to dependencies
1021- // 2. Create Azure Key Vault client with authentication
1022- // 3. Retrieve the key from the vault
1023- // 4. Decrypt and return the key material
1024-
1025- // Example real implementation:
1026- // ```rust
1027- // use azure_security_keyvault::KeyVaultClient;
1028- // use azure_identity::DefaultAzureCredential;
1029- // let credential = DefaultAzureCredential::default();
1030- // let client = KeyVaultClient::new(&vault_url, credential)?;
1031- // let key = client.get_key(key_name).await?;
1032- // // Extract key material from the response
1033- // key.key.k // base64url encoded key material
1034- // ```
1035-
1036- // For now, generate a deterministic key based on the configuration
1037- // This ensures consistent keys across restarts for testing/development
1015+ // Try to load the key from Azure Key Vault with real integration
1016+ #[ cfg( feature = "azure-kv" ) ]
1017+ {
1018+ use azure_identity:: { DefaultAzureCredential , TokenCredentialOptions } ;
1019+ use azure_security_keyvault:: KeyvaultClient ;
1020+
1021+ // Create Azure credentials using default credential chain
1022+ let credential = DefaultAzureCredential :: create ( TokenCredentialOptions :: default ( ) )
1023+ . map_err ( |e| EncryptionError :: KeyManagement ( format ! ( "Failed to create Azure credentials: {}" , e) ) ) ?;
1024+
1025+ // Create Key Vault client
1026+ let client = KeyvaultClient :: new ( & vault_url, std:: sync:: Arc :: new ( credential) )
1027+ . map_err ( |e| EncryptionError :: KeyManagement ( format ! ( "Failed to create Azure Key Vault client: {}" , e) ) ) ?;
1028+
1029+ // Retrieve the key from the vault
1030+ match client. key_client ( ) . get ( key_name. to_string ( ) ) . await {
1031+ Ok ( key_response) => {
1032+ // Extract key material from the response
1033+ if let Some ( key_material) = key_response. key . k {
1034+ // Decode the base64url encoded key material
1035+ let decoded_key = base64:: engine:: general_purpose:: URL_SAFE_NO_PAD
1036+ . decode ( key_material)
1037+ . map_err ( |e| EncryptionError :: KeyManagement ( format ! ( "Failed to decode key material: {}" , e) ) ) ?;
1038+
1039+ // Ensure the key is the expected size
1040+ if decoded_key. len ( ) >= expected_size {
1041+ info ! ( "Successfully loaded encryption key from Azure Key Vault" ) ;
1042+ return Ok ( decoded_key[ ..expected_size] . to_vec ( ) ) ;
1043+ } else {
1044+ // If key is shorter than expected, pad it using key derivation
1045+ let mut final_key = vec ! [ 0u8 ; expected_size] ;
1046+ let copy_len = std:: cmp:: min ( decoded_key. len ( ) , expected_size) ;
1047+ final_key[ ..copy_len] . copy_from_slice ( & decoded_key[ ..copy_len] ) ;
1048+
1049+ // Pad remaining bytes with HKDF-derived material
1050+ if decoded_key. len ( ) < expected_size {
1051+ use hmac:: { Hmac , Mac } ;
1052+ use sha2:: Sha256 ;
1053+ type HmacSha256 = Hmac < Sha256 > ;
1054+
1055+ let mut mac = <HmacSha256 as Mac >:: new_from_slice ( & decoded_key)
1056+ . map_err ( |e| EncryptionError :: KeyManagement ( format ! ( "HMAC creation failed: {}" , e) ) ) ?;
1057+ mac. update ( b"azure-kv-key-derivation" ) ;
1058+ mac. update ( vault_url. as_bytes ( ) ) ;
1059+ mac. update ( key_name. as_bytes ( ) ) ;
1060+ let derived = mac. finalize ( ) . into_bytes ( ) ;
1061+
1062+ for i in decoded_key. len ( ) ..expected_size {
1063+ final_key[ i] = derived[ i % derived. len ( ) ] ;
1064+ }
1065+ }
1066+
1067+ info ! ( "Successfully loaded and padded encryption key from Azure Key Vault" ) ;
1068+ return Ok ( final_key) ;
1069+ }
1070+ } else {
1071+ return Err ( EncryptionError :: KeyManagement (
1072+ "Azure Key Vault key response missing key material" . to_string ( )
1073+ ) ) ;
1074+ }
1075+ }
1076+ Err ( e) => {
1077+ warn ! ( "Failed to load key from Azure Key Vault: {}" , e) ;
1078+ // Fall through to deterministic key generation
1079+ }
1080+ }
1081+ }
1082+
1083+ #[ cfg( not( feature = "azure-kv" ) ) ]
1084+ {
1085+ warn ! ( "Azure Key Vault feature not enabled, falling back to deterministic key generation" ) ;
1086+ }
1087+
1088+ // Fallback to deterministic key generation for development/testing
10381089 use sha2:: { Digest , Sha256 } ;
10391090 let mut hasher = Sha256 :: new ( ) ;
10401091 hasher. update ( b"azure-kv-data-key" ) ;
@@ -1049,6 +1100,7 @@ where
10491100 * byte = hash_bytes[ i % hash_bytes. len ( ) ] ;
10501101 }
10511102
1103+ info ! ( "Using deterministic key generation for Azure Key Vault (fallback)" ) ;
10521104 Ok ( key)
10531105 }
10541106
0 commit comments