fix(boost): prevent data loss on secret rotation and add auth policy

- validateStoredValues: separate decryption errors from validation errors.
  Rows that fail decryption (rotated secret) are kept intact with a
  warning instead of being deleted. Only rows that fail Zod schema
  validation after successful decryption are removed.
- Add httpRouter.addAuthPolicy for /config/status endpoint to match
  the pattern used by all other endpoints in the codebase.
- Add tests for both new behaviors (2 new test cases, 79 total).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: gabemontero <gmontero@redhat.com>

Author: gabemontero

workspaces/boost/plugins/boost-backend/src/config/AdminConfigService.test.ts

@@ -351,6 +351,50 @@ describe('AdminConfigService', () => {
       expect(removed).toContain('boost.nonexistent.field');
     });
 
+    it('keeps encrypted rows when decryption fails (rotated secret)', async () => {
+      // Write a sensitive field with the current secret
+      await service.setOverride(
+        'boost.devSpaces.credentials',
+        'my-secret-token',
+      );
+
+      // Create a service with a different secret
+      const database: DatabaseService = {
+        getClient: async () => mockKnex,
+      } as unknown as DatabaseService;
+      const rotatedService = new AdminConfigService({
+        database,
+        logger,
+        encryptionSecret: 'different-secret',
+      });
+
+      const removed = await rotatedService.validateStoredValues();
+      expect(removed).not.toContain('boost.devSpaces.credentials');
+      // Row should still exist
+      const row = mockKnex._rows.find(
+        (r: { key: string }) => r.key === 'boost.devSpaces.credentials',
+      );
+      expect(row).toBeDefined();
+      expect(logger.warn).toHaveBeenCalledWith(
+        expect.stringContaining('decryption failed'),
+      );
+    });
+
+    it('removes corrupt JSON rows during validation', async () => {
+      mockKnex._rows.push({
+        key: 'boost.model.baseUrl',
+        value: '<<<not-json>>>',
+        schema_version: 1,
+        updated_at: new Date().toISOString(),
+      });
+
+      const removed = await service.validateStoredValues();
+      expect(removed).toContain('boost.model.baseUrl');
+      expect(logger.warn).toHaveBeenCalledWith(
+        expect.stringContaining('corrupt JSON'),
+      );
+    });
+
     it('removes values that fail validation', async () => {
       // Insert invalid URL directly
       mockKnex._rows.push({

workspaces/boost/plugins/boost-backend/src/config/AdminConfigService.ts

@@ -308,19 +308,36 @@ export class AdminConfigService {
         );
       }
 
-      // Re-validate the stored value
+      // Decrypt sensitive fields before validation
+      let rawValue: unknown;
       try {
-        let rawValue: unknown = JSON.parse(row.value);
-
-        // Decrypt sensitive fields for validation
-        if (
-          isSensitiveField(key) &&
-          typeof rawValue === 'string' &&
-          this.encryptionSecret
-        ) {
+        rawValue = JSON.parse(row.value);
+      } catch {
+        this.logger.warn(
+          `Removing config override "${key}" — corrupt JSON (schema version ${row.schema_version})`,
+        );
+        await knex<AdminConfigRow>(TABLE_NAME).where({ key }).delete();
+        removedKeys.push(key);
+        continue;
+      }
+
+      if (
+        isSensitiveField(key) &&
+        typeof rawValue === 'string' &&
+        this.encryptionSecret
+      ) {
+        try {
           rawValue = decryptValue(rawValue, this.encryptionSecret);
+        } catch {
+          this.logger.warn(
+            `Cannot validate sensitive field "${key}" — decryption failed (secret may have been rotated). Keeping row intact.`,
+          );
+          continue;
         }
+      }
 
+      // Re-validate the decrypted value against the Zod schema
+      try {
         validateConfigValue(key, rawValue);
       } catch (error) {
         this.logger.warn(

workspaces/boost/plugins/boost-backend/src/plugin.ts

@@ -228,6 +228,10 @@ export const boostPlugin = createBackendPlugin({
           path: '/health',
           allow: 'unauthenticated',
         });
+        httpRouter.addAuthPolicy({
+          path: '/config/status',
+          allow: 'user-cookie',
+        });
 
         logger.info('Boost backend plugin initialized successfully');
       },