fix(boost): tighten API surface and harden error paths

- Remove encryptValue/decryptValue from public exports (internal only)
- Mark encryptionSecret, set(), remove() as @internal
- Auto-delete corrupt JSON rows in getOverride
- Handle decryption failures from rotated secrets gracefully
- Use knex.fn.now() for DB timestamps instead of client-side Date
- Add tests for corrupt JSON and rotated-secret error paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: gabemontero <gmontero@redhat.com>

Author: gabemontero

workspaces/boost/plugins/boost-backend/report.api.md

@@ -32,7 +32,6 @@ export class AdminConfigService {
 export interface AdminConfigServiceOptions {
   // (undocumented)
   database: DatabaseService;
-  encryptionSecret?: string;
   // (undocumented)
   logger: LoggerService;
 }
@@ -161,12 +160,6 @@ export function createAgentResourceLoader(): ResourceLoader;
 // @public
 export function createToolResourceLoader(): ResourceLoader;
 
-// @public
-export function decryptValue(encrypted: string, secret: string): string;
-
-// @public
-export function encryptValue(plaintext: string, secret: string): string;
-
 // @public
 export function isDbWritable(key: BoostConfigKey): boolean;
 
@@ -195,10 +188,8 @@ export type ResourceLoader = (req: Request_2) => Promise<
 export class RuntimeConfigResolver {
   constructor(options: RuntimeConfigResolverOptions);
   invalidate(): Promise<void>;
-  remove(key: BoostConfigKey): Promise<void>;
   resolve(key: BoostConfigKey): Promise<unknown | undefined>;
   resolveAll(): Promise<Map<string, unknown>>;
-  set(key: BoostConfigKey, value: unknown): Promise<void>;
 }
 
 // @public

workspaces/boost/plugins/boost-backend/src/config/AdminConfigService.test.ts

@@ -232,6 +232,69 @@ describe('AdminConfigService', () => {
     });
   });
 
+  describe('corrupt data handling', () => {
+    it('getOverride returns undefined and deletes corrupt JSON row', async () => {
+      mockKnex._rows.push({
+        key: 'boost.model.baseUrl',
+        value: '<<<not-json>>>',
+        schema_version: 1,
+        updated_at: new Date().toISOString(),
+      });
+
+      const value = await service.getOverride('boost.model.baseUrl');
+      expect(value).toBeUndefined();
+      expect(logger.error).toHaveBeenCalledWith(
+        expect.stringContaining('Corrupt value'),
+      );
+      // Row should be deleted
+      const row = mockKnex._rows.find(
+        (r: { key: string }) => r.key === 'boost.model.baseUrl',
+      );
+      expect(row).toBeUndefined();
+    });
+
+    it('getAllOverrides skips corrupt JSON rows', async () => {
+      await service.setOverride('boost.model.name', 'gpt-4');
+      mockKnex._rows.push({
+        key: 'boost.model.baseUrl',
+        value: '<<<not-json>>>',
+        schema_version: 1,
+        updated_at: new Date().toISOString(),
+      });
+
+      const overrides = await service.getAllOverrides();
+      expect(overrides.size).toBe(1);
+      expect(overrides.get('boost.model.name')).toBe('gpt-4');
+      expect(overrides.has('boost.model.baseUrl')).toBe(false);
+    });
+
+    it('getOverride returns undefined when decryption fails (rotated secret)', async () => {
+      // Write with the current secret
+      await service.setOverride(
+        'boost.devSpaces.credentials',
+        'my-secret-token',
+      );
+
+      // Create a new service with a different secret
+      const database: DatabaseService = {
+        getClient: async () => mockKnex,
+      } as unknown as DatabaseService;
+      const rotatedService = new AdminConfigService({
+        database,
+        logger,
+        encryptionSecret: 'different-secret',
+      });
+
+      const value = await rotatedService.getOverride(
+        'boost.devSpaces.credentials',
+      );
+      expect(value).toBeUndefined();
+      expect(logger.error).toHaveBeenCalledWith(
+        expect.stringContaining('Failed to decrypt'),
+      );
+    });
+  });
+
   describe('removeOverride', () => {
     it('removes an existing override', async () => {
       await service.setOverride(

workspaces/boost/plugins/boost-backend/src/config/AdminConfigService.ts

@@ -52,7 +52,10 @@ interface AdminConfigRow {
 export interface AdminConfigServiceOptions {
   database: DatabaseService;
   logger: LoggerService;
-  /** Secret used for encrypting sensitive config values. */
+  /**
+   * Secret used for encrypting sensitive config values.
+   * @internal
+   */
   encryptionSecret?: string;
 }
 
@@ -130,8 +133,9 @@ export class AdminConfigService {
       rawValue = JSON.parse(row.value);
     } catch {
       this.logger.error(
-        `Corrupt value for config key "${key}" — skipping (invalid JSON)`,
+        `Corrupt value for config key "${key}" — removing (invalid JSON)`,
       );
+      await knex<AdminConfigRow>(TABLE_NAME).where({ key }).delete();
       return undefined;
     }
 
@@ -143,7 +147,14 @@ export class AdminConfigService {
         );
         return undefined;
       }
-      rawValue = decryptValue(rawValue, this.encryptionSecret);
+      try {
+        rawValue = decryptValue(rawValue, this.encryptionSecret);
+      } catch {
+        this.logger.error(
+          `Failed to decrypt sensitive field "${key}" — secret may have been rotated`,
+        );
+        return undefined;
+      }
     }
 
     return rawValue;
@@ -183,7 +194,14 @@ export class AdminConfigService {
           );
           continue;
         }
-        rawValue = decryptValue(rawValue, this.encryptionSecret);
+        try {
+          rawValue = decryptValue(rawValue, this.encryptionSecret);
+        } catch {
+          this.logger.error(
+            `Failed to decrypt sensitive field "${key}" — secret may have been rotated`,
+          );
+          continue;
+        }
       }
 
       result.set(row.key, rawValue);
@@ -227,20 +245,19 @@ export class AdminConfigService {
     }
 
     const knex = await this.getDb();
-    const now = new Date().toISOString();
 
     await knex<AdminConfigRow>(TABLE_NAME)
       .insert({
         key,
         value: serialized,
         schema_version: BOOST_CONFIG_SCHEMA_VERSION,
-        updated_at: now,
+        updated_at: knex.fn.now() as unknown as string,
       })
       .onConflict('key')
       .merge({
         value: serialized,
         schema_version: BOOST_CONFIG_SCHEMA_VERSION,
-        updated_at: now,
+        updated_at: knex.fn.now() as unknown as string,
       });
 
     this.logger.info(`Config override set: ${key}`);

workspaces/boost/plugins/boost-backend/src/config/RuntimeConfigResolver.ts

@@ -115,6 +115,7 @@ export class RuntimeConfigResolver {
    *
    * @param key - The config field key.
    * @param value - The value to store.
+   * @internal
    */
   async set(key: BoostConfigKey, value: unknown): Promise<void> {
     await this.adminConfigService.setOverride(key, value);
@@ -126,6 +127,7 @@ export class RuntimeConfigResolver {
    * baseline is restored.
    *
    * @param key - The config field key.
+   * @internal
    */
   async remove(key: BoostConfigKey): Promise<void> {
     await this.adminConfigService.removeOverride(key);

workspaces/boost/plugins/boost-backend/src/config/encryption.ts

@@ -44,7 +44,7 @@ function deriveKey(secret: string): Buffer {
  * @param secret - The encryption secret (will be derived to a 256-bit key).
  * @returns The encrypted value as a base64-encoded string.
  *
- * @public
+ * @internal
  */
 export function encryptValue(plaintext: string, secret: string): string {
   const key = deriveKey(secret);
@@ -71,7 +71,7 @@ export function encryptValue(plaintext: string, secret: string): string {
  * @returns The decrypted plaintext string.
  * @throws Error if decryption fails (wrong key, tampered data, etc.)
  *
- * @public
+ * @internal
  */
 export function decryptValue(encrypted: string, secret: string): string {
   const key = deriveKey(secret);

workspaces/boost/plugins/boost-backend/src/config/index.ts

@@ -32,4 +32,3 @@ export {
   type ConfigScope,
   type ConfigFieldMeta,
 } from './schemas';
-export { encryptValue, decryptValue } from './encryption';

workspaces/boost/plugins/boost-backend/src/index.ts

@@ -42,8 +42,6 @@ export {
   validateConfigValue,
   isDbWritable,
   isSensitiveField,
-  encryptValue,
-  decryptValue,
   type AdminConfigServiceOptions,
   type RuntimeConfigResolverOptions,
   type BoostConfigKey,