Fix KMS configuration synchronization across cluster nodes (#855)

* Initial plan

* Add KMS configuration persistence to cluster storage

Co-authored-by: houseme <4829346+houseme@users.noreply.github.com>

* Apply code formatting to KMS configuration changes

Co-authored-by: houseme <4829346+houseme@users.noreply.github.com>

* add comment

* fix fmt

* fix

* Fix overlapping dependabot cargo configurations

Co-authored-by: houseme <4829346+houseme@users.noreply.github.com>

* improve code for comment and replace  `Once_Cell` to `std::sync::OnceLock`

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: houseme <4829346+houseme@users.noreply.github.com>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: loverustfs <155562731+loverustfs@users.noreply.github.com>

crates/utils/src/crypto.rs

@@ -12,45 +12,95 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use hex_simd::{AsOut, AsciiCase};
+use hmac::{Hmac, KeyInit, Mac};
+use hyper::body::Bytes;
+use sha1::Sha1;
+use sha2::{Digest, Sha256};
 use std::mem::MaybeUninit;
 
-use hex_simd::{AsOut, AsciiCase};
-use hyper::body::Bytes;
-
+/// Base64 URL safe encoding without padding
+/// `base64_encode_url_safe_no_pad(input)`
+///
+/// # Arguments
+/// * `input` - A byte slice to be encoded
+///
+/// # Returns
+/// A `String` containing the Base64 URL safe encoded representation of the input data
 pub fn base64_encode_url_safe_no_pad(input: &[u8]) -> String {
     base64_simd::URL_SAFE_NO_PAD.encode_to_string(input)
 }
 
+/// Base64 URL safe decoding without padding
+/// `base64_decode_url_safe_no_pad(input)`
+///
+/// # Arguments
+/// * `input` - A byte slice containing the Base64 URL safe encoded data
+///
+/// # Returns
+/// A `Result` containing a `Vec<u8>` with the decoded data or a `base64_simd::Error` if decoding fails
+///
+/// # Errors
+/// This function will return an error if the input data is not valid Base64 URL safe encoded data
+///
 pub fn base64_decode_url_safe_no_pad(input: &[u8]) -> Result<Vec<u8>, base64_simd::Error> {
     base64_simd::URL_SAFE_NO_PAD.decode_to_vec(input)
 }
 
+/// encode to hex string (lowercase)
+/// `hex(data)`
+///
+/// # Arguments
+/// * `data` - A byte slice to be encoded
+///
+/// # Returns
+/// A `String` containing the hexadecimal representation of the input data in lowercase
+///
 pub fn hex(data: impl AsRef<[u8]>) -> String {
     hex_simd::encode_to_string(data, hex_simd::AsciiCase::Lower)
 }
 
 /// verify sha256 checksum string
+///
+/// # Arguments
+/// * `s` - A string slice to be verified
+///
+/// # Returns
+/// A `bool` indicating whether the input string is a valid SHA-256 checksum (64
+///
 pub fn is_sha256_checksum(s: &str) -> bool {
     // TODO: optimize
     let is_lowercase_hex = |c: u8| matches!(c, b'0'..=b'9' | b'a'..=b'f');
     s.len() == 64 && s.as_bytes().iter().copied().all(is_lowercase_hex)
 }
 
+/// HMAC-SHA1 hashing
 /// `hmac_sha1(key, data)`
+///
+/// # Arguments
+/// * `key` - A byte slice representing the HMAC key
+/// * `data` - A byte slice representing the data to be hashed
+///
+/// # Returns
+/// A 20-byte array containing the HMAC-SHA1 hash of the input data using the provided key
+///
 pub fn hmac_sha1(key: impl AsRef<[u8]>, data: impl AsRef<[u8]>) -> [u8; 20] {
-    use hmac::{Hmac, KeyInit, Mac};
-    use sha1::Sha1;
-
     let mut m = <Hmac<Sha1>>::new_from_slice(key.as_ref()).unwrap();
     m.update(data.as_ref());
     m.finalize().into_bytes().into()
 }
 
+/// HMAC-SHA256 hashing
 /// `hmac_sha256(key, data)`
+///
+/// # Arguments
+/// * `key` - A byte slice representing the HMAC key
+/// * `data` - A byte slice representing the data to be hashed
+///
+/// # Returns
+/// A 32-byte array containing the HMAC-SHA256 hash of the input data using the provided key
+///
 pub fn hmac_sha256(key: impl AsRef<[u8]>, data: impl AsRef<[u8]>) -> [u8; 32] {
-    use hmac::{Hmac, KeyInit, Mac};
-    use sha2::Sha256;
-
     let mut m = Hmac::<Sha256>::new_from_slice(key.as_ref()).unwrap();
     m.update(data.as_ref());
     m.finalize().into_bytes().into()
@@ -64,18 +114,25 @@ fn hex_bytes32<R>(src: impl AsRef<[u8]>, f: impl FnOnce(&str) -> R) -> R {
 }
 
 fn sha256(data: &[u8]) -> impl AsRef<[u8; 32]> + use<> {
-    use sha2::{Digest, Sha256};
     <Sha256 as Digest>::digest(data)
 }
 
 fn sha256_chunk(chunk: &[Bytes]) -> impl AsRef<[u8; 32]> + use<> {
-    use sha2::{Digest, Sha256};
     let mut h = <Sha256 as Digest>::new();
     chunk.iter().for_each(|data| h.update(data));
     h.finalize()
 }
 
-/// `f(hex(sha256(data)))`
+/// hex of sha256 `f(hex(sha256(data)))`
+///
+/// # Arguments
+/// * `data` - A byte slice representing the data to be hashed
+/// * `f` - A closure that takes a string slice and returns a value of type `R`
+///
+/// # Returns
+/// A value of type `R` returned by the closure `f` after processing the hexadecimal
+/// representation of the SHA-256 hash of the input data
+///
 pub fn hex_sha256<R>(data: &[u8], f: impl FnOnce(&str) -> R) -> R {
     hex_bytes32(sha256(data).as_ref(), f)
 }