Key Rotation

pub struct KeyMetadata {
    pub key_id: Uuid,
    pub lineage_id: Uuid,
    pub version: i32,
    pub active: bool,
}

fn rotate_key(&self, key_id: Uuid) -> Result<KeyMetadata> {
    let mut keys = self.keys.write()
        .map_err(|_| QimemError::Config("poisoned lock".to_string()))?;
    
    // 1. Mark old key inactive
    let old = keys.get_mut(&key_id)
        .ok_or(QimemError::KeyNotFound(key_id))?;
    old.metadata.active = false;

    // 2. Generate new key with incremented version
    let new_id = Uuid::new_v4();
    let metadata = KeyMetadata {
        key_id: new_id,
        lineage_id: old.metadata.lineage_id,
        version: old.metadata.version + 1,
        active: true,
    };
    
    let new = StoredKey {
        metadata: metadata.clone(),
        material: generate_key_material().to_vec(),
    };
    
    // 3. Insert new key
    keys.insert(new_id, new);
    
    // 4. Update lineage pointer to latest key
    self.lineages.write()
        .map_err(|_| QimemError::Config("poisoned lock".to_string()))?.
        insert(metadata.lineage_id, new_id);
    
    Ok(metadata)
}

fn rotate_key(&self, key_id: Uuid) -> Result<KeyMetadata> {
    let new_id = Uuid::new_v4();
    let material = generate_key_material();
    let rt = tokio::runtime::Handle::current();
    
    let metadata = rt.block_on(async {
        let mut tx = self.pool.begin().await?;
        
        // 1. Fetch lineage and version from old key
        let row = sqlx::query("SELECT lineage_id, version FROM keys WHERE key_id=$1")
            .bind(key_id)
            .fetch_optional(&mut *tx)
            .await?
            .ok_or(QimemError::KeyNotFound(key_id))?;
        let lineage_id: Uuid = row.try_get("lineage_id")?;
        let version: i32 = row.try_get("version")?;
        
        // 2. Deactivate old key
        sqlx::query("UPDATE keys SET active=false WHERE key_id=$1")
            .bind(key_id)
            .execute(&mut *tx)
            .await?;
        
        // 3. Insert new active key
        sqlx::query("INSERT INTO keys (key_id, lineage_id, version, active, material) VALUES ($1,$2,$3,$4,$5)")
            .bind(new_id)
            .bind(lineage_id)
            .bind(version + 1)
            .bind(true)
            .bind(material.as_slice())
            .execute(&mut *tx)
            .await?;
        
        tx.commit().await?;
        Ok::<KeyMetadata, QimemError>(KeyMetadata { 
            key_id: new_id, 
            lineage_id, 
            version: version + 1, 
            active: true 
        })
    })?;
    
    Ok(metadata)
}

Time 0: Create Key A
  key_id: a1b2c3d4
  lineage_id: a1b2c3d4  (same as key_id)
  version: 1
  active: true

Time 1: Rotate Key A
  Old Key:
    key_id: a1b2c3d4
    lineage_id: a1b2c3d4
    version: 1
    active: false  (changed)
  
  New Key:
    key_id: e5f6g7h8
    lineage_id: a1b2c3d4  (inherited)
    version: 2  (incremented)
    active: true

Time 2: Rotate Key A Again
  Key v1:
    key_id: a1b2c3d4, version: 1, active: false
  
  Key v2:
    key_id: e5f6g7h8, version: 2, active: false  (changed)
  
  Key v3:
    key_id: i9j0k1l2
    lineage_id: a1b2c3d4  (inherited)
    version: 3  (incremented)
    active: true

pub struct Envelope {
    pub key_id: Uuid,  // Identifies the specific key version
    // ... other fields
}

let envelope = Envelope::deserialize_binary(&bytes)?;
let key = state.store.get_key(envelope.key_id)?;  // Fetch by key_id
let plaintext = CryptoEngine::new(envelope.algorithm).decrypt(&key, &envelope)?;

// Encrypt with key v1
let key_v1 = store.get_key(metadata_v1.key_id)?;
let envelope_v1 = engine.encrypt(&key_v1, b"data1")?;

// Rotate to key v2
let metadata_v2 = store.rotate_key(metadata_v1.key_id)?;

// Encrypt with key v2
let key_v2 = store.get_key(metadata_v2.key_id)?;
let envelope_v2 = engine.encrypt(&key_v2, b"data2")?;

// Both envelopes can still be decrypted
let plaintext1 = engine.decrypt(&key_v1, &envelope_v1)?;  // Uses v1
let plaintext2 = engine.decrypt(&key_v2, &envelope_v2)?;  // Uses v2

if !key.active {
    return Err(QimemError::KeyInactive(key.key_id));
}

let key_v1 = store.get_key(metadata_v1.key_id)?;
// After rotation, key_v1.active == false

let result = engine.encrypt(&key_v1, b"new data");
assert!(matches!(result, Err(QimemError::KeyInactive(_))));

lineages: RwLock<HashMap<Uuid, Uuid>>

POST /v1/security/rotate
Content-Type: application/json

{
  "key_id": "550e8400-e29b-41d4-a716-446655440000"
}

{
  "key_id": "e5f6g7h8-i9j0-k1l2-m3n4-o5p6q7r8s9t0",
  "lineage_id": "550e8400-e29b-41d4-a716-446655440000",
  "version": 2,
  "active": true
}

async fn rotate_key(
    State(state): State<PlatformState>,
    Json(req): Json<RotateRequest>,
) -> ApiResult<serde_json::Value> {
    let key = state.store.rotate_key(req.key_id).map_err(map_err)?;
    Ok(Json(serde_json::json!(key)))
}

// Decrypt with old key
let plaintext = engine.decrypt(&key_v1, &old_envelope)?;

// Re-encrypt with new key
let new_envelope = engine.encrypt(&key_v2, &plaintext)?;