From cbb57258c2f0828fb197d7e7625d61cd74fbab75 Mon Sep 17 00:00:00 2001
From: root <root@localhost>
Date: Fri, 5 Dec 2025 01:32:30 +0500
Subject: [PATCH] .

---
 .../parser/service/EncryptionService.java      | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/main/java/kz/konturai/parser/service/EncryptionService.java b/src/main/java/kz/konturai/parser/service/EncryptionService.java
index 55623cc..92293bf 100644
--- a/src/main/java/kz/konturai/parser/service/EncryptionService.java
+++ b/src/main/java/kz/konturai/parser/service/EncryptionService.java
@@ -10,6 +10,7 @@ import javax.crypto.KeyGenerator;
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
 import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 import java.security.SecureRandom;
 import java.util.Base64;
 
@@ -27,13 +28,25 @@ public class EncryptionService {
         if (secretKeyBase64 != null && !secretKeyBase64.isEmpty()) {
             try {
                 byte[] keyBytes = Base64.getDecoder().decode(secretKeyBase64);
-                key = new SecretKeySpec(keyBytes, ALGORITHM);
+                // If decoded key is exactly 32 bytes (256 bits), use it directly
+                // Otherwise, derive a 32-byte key using SHA-256
+                if (keyBytes.length == 32) {
+                    key = new SecretKeySpec(keyBytes, ALGORITHM);
+                } else {
+                    // Derive a proper 32-byte key using SHA-256
+                    MessageDigest sha = MessageDigest.getInstance("SHA-256");
+                    byte[] derivedKey = sha.digest(keyBytes);
+                    key = new SecretKeySpec(derivedKey, ALGORITHM);
+                    logger.info("Derived AES-256 key from provided secret (original length: {} bytes)",
+                            keyBytes.length);
+                }
             } catch (Exception e) {
                 logger.warn("Failed to decode encryption key from config, generating new one", e);
                 key = generateKey();
             }
         } else {
-            logger.warn("Encryption secret key not configured, generating temporary key. This should be configured in production!");
+            logger.warn(
+                    "Encryption secret key not configured, generating temporary key. This should be configured in production!");
             key = generateKey();
         }
         this.secretKey = key;
@@ -82,4 +95,3 @@ public class EncryptionService {
         }
     }
 }
-