fix(kms): make the deletion waiting window non-bypassable (#5535)

rustfs/src/admin/handlers/kms_dynamic.rs

@@ -192,6 +192,9 @@ async fn save_kms_config(config: &KmsConfig) -> Result<(), String> {
 
 fn decode_persisted_kms_config(data: &[u8]) -> serde_json::Result<(KmsConfig, bool)> {
     let mut config: KmsConfig = serde_json::from_slice(data)?;
+    // The immediate-deletion gate is per-server operator state, never stored,
+    // so a config loaded from cluster storage still has to pick it up here.
+    config.allow_immediate_deletion = rustfs_kms::config::allow_immediate_deletion_from_env();
     let value: serde_json::Value = serde_json::from_slice(data)?;
     let is_missing_development_flag = value
         .as_object()

rustfs/src/admin/handlers/kms_keys.rs

@@ -1023,6 +1023,9 @@ pub struct DeleteKmsKeyRequest {
     pub key_id: String,
     pub pending_window_in_days: Option<u32>,
     pub force_immediate: Option<bool>,
+    /// Echo of `key_id`, required by the service gate before it will destroy
+    /// key material immediately. Absent for an ordinary scheduled deletion.
+    pub confirm_key_id: Option<String>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -1089,11 +1092,13 @@ impl Operation for DeleteKmsKeyHandler {
             // Extract pending_window_in_days and force_immediate from query parameters
             let pending_window_in_days = query_params.get("pending_window_in_days").and_then(|s| s.parse::<u32>().ok());
             let force_immediate = query_params.get("force_immediate").and_then(|s| s.parse::<bool>().ok());
+            let confirm_key_id = query_params.get("confirm_key_id").map(|s| s.to_string());
 
             DeleteKmsKeyRequest {
                 key_id: key_id.clone(),
                 pending_window_in_days,
                 force_immediate,
+                confirm_key_id,
             }
         } else {
             serde_json::from_slice(&body).map_err(|e| s3_error!(InvalidRequest, "invalid JSON: {}", e))?
@@ -1131,6 +1136,7 @@ impl Operation for DeleteKmsKeyHandler {
             key_id: request.key_id.clone(),
             pending_window_in_days: request.pending_window_in_days,
             force_immediate: request.force_immediate,
+            confirm_key_id: request.confirm_key_id.clone(),
         };
 
         match manager.delete_key_with_context(kms_request, audit.context()).await {

rustfs/src/init.rs

@@ -291,6 +291,7 @@ fn build_local_kms_config(cfg: &config::Config) -> std::io::Result<rustfs_kms::c
             file_permissions: Some(0o600),
         }),
         allow_insecure_dev_defaults: cfg.kms_allow_insecure_dev_defaults,
+        allow_immediate_deletion: rustfs_kms::config::allow_immediate_deletion_from_env(),
         default_key_id: cfg.kms_default_key_id.clone(),
         timeout: std::time::Duration::from_secs(30),
         retry_attempts: 3,
@@ -328,6 +329,7 @@ fn build_vault_kms_config(cfg: &config::Config) -> std::io::Result<rustfs_kms::c
             tls: None,
         })),
         allow_insecure_dev_defaults: cfg.kms_allow_insecure_dev_defaults,
+        allow_immediate_deletion: rustfs_kms::config::allow_immediate_deletion_from_env(),
         default_key_id: cfg.kms_default_key_id.clone(),
         timeout: std::time::Duration::from_secs(30),
         retry_attempts: 3,
@@ -363,6 +365,7 @@ fn build_vault_transit_kms_config(cfg: &config::Config) -> std::io::Result<rustf
             ..rustfs_kms::config::VaultTransitConfig::default()
         })),
         allow_insecure_dev_defaults: cfg.kms_allow_insecure_dev_defaults,
+        allow_immediate_deletion: rustfs_kms::config::allow_immediate_deletion_from_env(),
         default_key_id: cfg.kms_default_key_id.clone(),
         timeout: std::time::Duration::from_secs(30),
         retry_attempts: 3,
@@ -417,6 +420,7 @@ fn build_static_kms_config(cfg: &config::Config) -> std::io::Result<rustfs_kms::
         default_key_id: cfg.kms_default_key_id.clone().or(Some(key_id)),
         backend_config: rustfs_kms::config::BackendConfig::Static(static_config),
         allow_insecure_dev_defaults: cfg.kms_allow_insecure_dev_defaults,
+        allow_immediate_deletion: rustfs_kms::config::allow_immediate_deletion_from_env(),
         ..Default::default()
     };