mirror of
https://github.com/luxfi/treasury.git
synced 2026-10-30 15:15:00 +00:00
zeekay
77faf32ed9
Replace the ErrNotImplemented stub on Config.LoadFromKMS with a real implementation against a narrow KMSGetter interface. Adapter has zero direct dependency on luxfi/kms; the canonical luxfi/kms.GetWith satisfies KMSGetter via a 1-line wrapper at treasuryd startup. Signature: (ctx, KMSGetter, env) error. env is "sandbox" or "prod". KMS path scheme (per integration brief §2): shared/northcapital/<env>/clientID (required) shared/northcapital/<env>/developerAPIKey (required) The treasury-side adapter holds only the two payment-rail credentials (no webhook keys — webhook surface lives on the broker side). Error sentinels: ErrKMSKeyMissing — required key absent / empty value ErrKMSDecryption — transport / decryption failure The previous test pinning ErrNotImplemented is rewritten to assert LoadFromKMS is wired (not returning the sentinel). ErrNotImplemented is retained for any future Provider method that ships its scaffold ahead of its body. Tests: 11 cases, all pass under -race. Conformance: - sandbox + prod happy paths populate clientID + developerAPIKey - exact KMS path shape (shared/northcapital/<env>/<field>) - missing required key → ErrKMSKeyMissing (each of 2 required) - empty value treated as missing - decryption error → ErrKMSDecryption - transport error → ErrKMSDecryption - nil KMSGetter rejected - empty / unknown env rejected - kmsPath shape pinned Source-of-design: Public-Spec Source-ref: legal/partnerships/northcapital/ NorthCapital_Lux_Integration_Brief.md §2; github.com/luxfi/kms public Go surface (kms.Get / kms.GetWith) Clean-Team-Member: dev-agent (P0 NCPS LoadFromKMS completion) Signed-off-by: dev <[email protected]>