feat(kms): allow key description and tag updates (#5546)

crates/kms/src/backends/local.rs

@@ -14,7 +14,10 @@
 
 //! Local file-based KMS backend implementation
 
-use crate::backends::{BackendCapabilities, ExpiredKeyRemoval, KmsBackend, StateGatedOperation, ensure_key_status_permits};
+use crate::backends::{
+    BackendCapabilities, ExpiredKeyRemoval, KmsBackend, StateGatedOperation, ensure_key_status_permits,
+    ensure_tag_keys_are_mutable,
+};
 use crate::config::KmsConfig;
 use crate::config::LocalConfig;
 use crate::encryption::{AesDekCrypto, DataKeyEnvelope, DekCrypto, generate_key_material};
@@ -1294,6 +1297,32 @@ impl LocalKmsClient {
         Ok(())
     }
 
+    /// Read-modify-write of a key's mutable metadata under the per-key write
+    /// lock, carrying the existing key material over untouched.
+    ///
+    /// `mutate` reports whether it changed anything; an unchanged record is
+    /// never rewritten, so a repeated no-op update neither rewrites the key
+    /// file nor risks a failed commit on an unrelated call.
+    async fn update_key_metadata<F>(&self, key_id: &str, mutate: F) -> Result<()>
+    where
+        F: FnOnce(&mut MasterKeyInfo) -> Result<bool>,
+    {
+        let _write_guard = self.lock_key_for_write(key_id).await;
+        let mut master_key = self.load_master_key(key_id).await?;
+        if !mutate(&mut master_key)? {
+            return Ok(());
+        }
+
+        // Preserve the existing key material (see enable_key): a metadata edit
+        // must never regenerate the master key, or every DEK wrapped by it
+        // becomes undecryptable.
+        let key_material = self.get_key_material(key_id).await?;
+        self.save_master_key(&master_key, &key_material).await?;
+
+        debug!(key_id, "Local KMS key metadata updated");
+        Ok(())
+    }
+
     /// Test-only lifecycle driver: the product path goes through [`KmsBackend`].
     #[cfg(test)]
     pub(crate) async fn schedule_key_deletion(
@@ -1412,12 +1441,15 @@ impl KmsBackend for LocalKmsBackend {
             // Generate key material
             let key_material = generate_key_material(algorithm)?;
 
-            let master_key = MasterKeyInfo::new_with_description(
+            let mut master_key = MasterKeyInfo::new_with_description(
                 key_id.clone(),
                 algorithm.to_string(),
                 Some("local-kms".to_string()),
                 request.description.clone(),
             );
+            // Persist the caller's tags: the response below reports them, and
+            // describe_key reads them back out of this record.
+            master_key.metadata = request.tags.clone();
 
             // Save to disk
             self.client.save_new_master_key(&master_key, &key_material).await?;
@@ -1685,6 +1717,44 @@ impl KmsBackend for LocalKmsBackend {
         self.client.disable_key(key_id, None).await
     }
 
+    async fn update_key_description(&self, key_id: &str, description: Option<&str>) -> Result<()> {
+        self.client
+            .update_key_metadata(key_id, |master_key| {
+                if master_key.description.as_deref() == description {
+                    return Ok(false);
+                }
+                master_key.description = description.map(str::to_string);
+                Ok(true)
+            })
+            .await
+    }
+
+    async fn tag_key(&self, key_id: &str, tags: &HashMap<String, String>) -> Result<()> {
+        ensure_tag_keys_are_mutable(tags.keys().map(String::as_str))?;
+        self.client
+            .update_key_metadata(key_id, |master_key| {
+                let mut changed = false;
+                for (tag_key, value) in tags {
+                    changed |= master_key.metadata.insert(tag_key.clone(), value.clone()).as_ref() != Some(value);
+                }
+                Ok(changed)
+            })
+            .await
+    }
+
+    async fn untag_key(&self, key_id: &str, tag_keys: &[String]) -> Result<()> {
+        ensure_tag_keys_are_mutable(tag_keys.iter().map(String::as_str))?;
+        self.client
+            .update_key_metadata(key_id, |master_key| {
+                let mut changed = false;
+                for tag_key in tag_keys {
+                    changed |= master_key.metadata.remove(tag_key).is_some();
+                }
+                Ok(changed)
+            })
+            .await
+    }
+
     async fn health_check(&self) -> Result<bool> {
         self.client.health_check().await.map(|_| true)
     }
@@ -1697,6 +1767,7 @@ impl KmsBackend for LocalKmsBackend {
             .with_enable_disable(true)
             .with_schedule_deletion(true)
             .with_physical_delete(true)
+            .with_update_key_metadata(true)
     }
 
     async fn remove_expired_key(&self, key_id: &str, now: &Zoned) -> Result<ExpiredKeyRemoval> {