safe-global / safe-client-gateway / 29084699125

87%

Build Type

push

github

Committed by web-flow

Commit Message

feat(spaces,users): per-entity field-level encryption (KMS envelope) + backfill (#3196)

Adds per-entity, field-level encryption for human-entered text in Spaces and Users, using AES-256-GCM with an AWS KMS envelope scheme (KMS wraps per-entity data keys; the app encrypts/decrypts locally in the repository layer). Flag-gated and a full no-op when disabled, so it is safe to merge ahead of rollout.

Previously stacked on the earlier encryption PRs; now rebased directly onto main, so this PR contains the whole stack: KMS infrastructure → per-space field encryption → per-user email encryption → backfill → test alignment.

Coverage Stats

3670 of 4491 branches covered (81.72%)

Branch coverage included in aggregate %.

137 of 151 new or added lines in 8 files covered. (90.73%)

1 existing line in 1 file now uncovered.

9542 of 10722 relevant lines covered (88.99%)

507.14 hits per line