Fix hexadecimal master key decoding

server/packages/kca-core/src/kca/core/crypto.py

@@ -28,13 +28,19 @@ def decode_master_key(value: str) -> bytes:
     text = (value or "").strip()
     if not text:
         raise ValueError("KCA_MASTER_KEY is empty")
-    try:
-        raw = base64.b64decode(text, validate=True)
-    except Exception:  # noqa: BLE001
+    is_hex = len(text) == KEY_BYTES * 2 and all(
+        char in "0123456789abcdefABCDEF" for char in text
+    )
+    if is_hex:
+        raw = bytes.fromhex(text)
+    else:
         try:
-            raw = bytes.fromhex(text)
-        except ValueError as exc:
-            raise ValueError("KCA_MASTER_KEY must be base64 or hex") from exc
+            raw = base64.b64decode(text, validate=True)
+        except Exception:  # noqa: BLE001
+            try:
+                raw = bytes.fromhex(text)
+            except ValueError as exc:
+                raise ValueError("KCA_MASTER_KEY must be base64 or hex") from exc
     if len(raw) != KEY_BYTES:
         raise ValueError(f"KCA_MASTER_KEY must be {KEY_BYTES} bytes")
     return raw

server/packages/kca-core/tests/test_core.py

@@ -553,6 +553,10 @@ class ExportImportTest(unittest.TestCase):
 
 
 class CryptoTest(unittest.TestCase):
+    def test_decode_hex_master_key(self) -> None:
+        expected = bytes(range(crypto.KEY_BYTES))
+        self.assertEqual(crypto.decode_master_key(expected.hex()), expected)
+
     def test_envelope(self) -> None:
         master = crypto.generate_master_key()
         blob = crypto.encrypt_private_key(b"secret", "key-id", crypto.decode_master_key(master))