From 679ea238dedba064d2c5f3625e45cddb0636dc7b Mon Sep 17 00:00:00 2001
From: Zhengchao An <anzhengchao@gmail.com>
Date: Wed, 12 Aug 2026 22:20:47 +0800
Subject: [PATCH] chore(kms): import canonical internal encryption header
 constants (#5997)

kms/service.rs re-declared x-rustfs-encryption-key-id and x-rustfs-encryption-algorithm locally; the canonical owners live in rustfs-utils' object_encryption_keys module, which kms already transitively builds. Enable the http feature on the existing rustfs-utils dependency and import the two constants instead. The explanatory comment about why the algorithm header exists (SSE mode vs AEAD cipher round-trip) moves to the import site.

No dependency-graph change (cargo tree -p rustfs-kms is unchanged apart from the feature) and no behavior change: the imported values are byte-identical.

Ref rustfs/backlog#1833 (PR2).
---
 crates/kms/Cargo.toml     |  2 +-
 crates/kms/src/service.rs | 18 ++++++++----------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/crates/kms/Cargo.toml b/crates/kms/Cargo.toml
index 8ff8cd939..86aa8950a 100644
--- a/crates/kms/Cargo.toml
+++ b/crates/kms/Cargo.toml
@@ -62,7 +62,7 @@ moka = { workspace = true, features = ["future"] }
 # Additional dependencies
 md-5 = { workspace = true }
 arc-swap = { workspace = true }
-rustfs-utils = { workspace = true }
+rustfs-utils = { workspace = true, features = ["http"] }
 rustfs-security-governance = { workspace = true }
 # `EventName` for KMS audit records. A leaf crate with no rustfs dependencies,
 # so the audit sink can live outside this crate without a second, drifting
diff --git a/crates/kms/src/service.rs b/crates/kms/src/service.rs
index a0b1bfb95..87466b601 100644
--- a/crates/kms/src/service.rs
+++ b/crates/kms/src/service.rs
@@ -81,16 +81,14 @@ fn request_encryption_context(context: &ObjectEncryptionContext) -> HashMap<Stri
     enc_context
 }
 
-const INTERNAL_ENCRYPTION_KEY_ID_HEADER: &str = "x-rustfs-encryption-key-id";
-
-/// Carries the AEAD algorithm the object was sealed with.
-///
-/// The S3 `x-amz-server-side-encryption` header records the *SSE mode*
-/// (`AES256` / `aws:kms`), not the cipher, so it cannot round-trip
-/// `ChaCha20Poly1305`. Without this header a ChaCha-sealed object comes back
-/// from the projection claiming `aws:kms` and is then opened with the wrong
-/// cipher.
-const INTERNAL_ENCRYPTION_ALGORITHM_HEADER: &str = "x-rustfs-encryption-algorithm";
+// Canonical owners of the internal encryption header names. Note on
+// INTERNAL_ENCRYPTION_ALGORITHM_HEADER: it carries the AEAD algorithm the
+// object was sealed with. The S3 `x-amz-server-side-encryption` header records
+// the *SSE mode* (`AES256` / `aws:kms`), not the cipher, so it cannot
+// round-trip `ChaCha20Poly1305`. Without this header a ChaCha-sealed object
+// comes back from the projection claiming `aws:kms` and is then opened with
+// the wrong cipher.
+use rustfs_utils::http::object_encryption_keys::{INTERNAL_ENCRYPTION_ALGORITHM_HEADER, INTERNAL_ENCRYPTION_KEY_ID_HEADER};
 
 /// Result of object encryption
 #[derive(Debug, Clone)]