feat: secure organization Feishu credentials

hub/src/security/localKekRotation.ts

@@ -3,6 +3,7 @@ import { lstat, open, rename, unlink, type FileHandle } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join } from "node:path";
 import type { Prisma, PrismaClient } from "@prisma/client";
 import { rewrapStoredProviderEnvelopes } from "../connections/providerConnections.js";
+import { rewrapStoredFeishuApplicationEnvelopes } from "../connections/feishuApplicationConnections.js";
 import {
   LocalSecretEnvelope,
   loadLocalSecretKeyringFile,
@@ -76,14 +77,19 @@ async function rotateUnderLock(
   const keyring: LocalSecretKeyring = { activeKeyId: keyId, keys };
   try {
     await replaceKeyringAtomically(input.keyringFile, keyring, metadata.uid, metadata.gid);
-    const result = await rewrapStoredProviderEnvelopes(
+    const providerResult = await rewrapStoredProviderEnvelopes(
+      tx,
+      new LocalSecretEnvelope(keyring),
+    );
+    const feishuResult = await rewrapStoredFeishuApplicationEnvelopes(
       tx,
       new LocalSecretEnvelope(keyring),
     );
     return {
       previousActiveKeyId: previous.activeKeyId,
       activeKeyId: keyId,
-      ...result,
+      verified: providerResult.verified + feishuResult.verified,
+      rewrapped: providerResult.rewrapped + feishuResult.rewrapped,
     };
   } finally {
     generatedKey.fill(0);