From dd6d20e3a3bfc78eaa78298a4f38a8a44831c870 Mon Sep 17 00:00:00 2001
From: Walter Oggioni <oggioni.walter@gmail.com>
Date: Mon, 26 Oct 2026 12:06:17 +0800
Subject: [PATCH] Fix hexadecimal master key decoding

---
 .../packages/kca-core/src/kca/core/crypto.py   | 18 ++++++++++++------
 server/packages/kca-core/tests/test_core.py    |  4 ++++
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/server/packages/kca-core/src/kca/core/crypto.py b/server/packages/kca-core/src/kca/core/crypto.py
index 888b39d..44e7233 100644
--- a/server/packages/kca-core/src/kca/core/crypto.py
+++ b/server/packages/kca-core/src/kca/core/crypto.py
@@ -28,13 +28,19 @@ def decode_master_key(value: str) -> bytes:
     text = (value or "").strip()
     if not text:
         raise ValueError("KCA_MASTER_KEY is empty")
-    try:
-        raw = base64.b64decode(text, validate=True)
-    except Exception:  # noqa: BLE001
+    is_hex = len(text) == KEY_BYTES * 2 and all(
+        char in "0123456789abcdefABCDEF" for char in text
+    )
+    if is_hex:
+        raw = bytes.fromhex(text)
+    else:
         try:
-            raw = bytes.fromhex(text)
-        except ValueError as exc:
-            raise ValueError("KCA_MASTER_KEY must be base64 or hex") from exc
+            raw = base64.b64decode(text, validate=True)
+        except Exception:  # noqa: BLE001
+            try:
+                raw = bytes.fromhex(text)
+            except ValueError as exc:
+                raise ValueError("KCA_MASTER_KEY must be base64 or hex") from exc
     if len(raw) != KEY_BYTES:
         raise ValueError(f"KCA_MASTER_KEY must be {KEY_BYTES} bytes")
     return raw
diff --git a/server/packages/kca-core/tests/test_core.py b/server/packages/kca-core/tests/test_core.py
index 359faf2..d85a48a 100644
--- a/server/packages/kca-core/tests/test_core.py
+++ b/server/packages/kca-core/tests/test_core.py
@@ -553,6 +553,10 @@ class ExportImportTest(unittest.TestCase):
 
 
 class CryptoTest(unittest.TestCase):
+    def test_decode_hex_master_key(self) -> None:
+        expected = bytes(range(crypto.KEY_BYTES))
+        self.assertEqual(crypto.decode_master_key(expected.hex()), expected)
+
     def test_envelope(self) -> None:
         master = crypto.generate_master_key()
         blob = crypto.encrypt_private_key(b"secret", "key-id", crypto.decode_master_key(master))