fix(hsm): support strict-template HSMs - #7068

💬 Discussion in Slack: #pr-review-infisical-7068-fix-hsm-support-strict-template-hsms

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

Confidence Score: 4/5

The change is a targeted compatibility fix with no new control paths or external data flows; the relaxed HMAC key search is intentional and the label is distinctive enough for normal deployments.

Both the AES and HMAC template additions are additive false-attribute declarations that follow PKCS#11 spec and do not alter the keys' functional properties. The relaxed HMAC find trades search precision for HSM portability, which is the stated goal and is well-commented. The only minor risk is the broader HMAC label-only search silently matching an unintended key if label collisions exist on the HSM, but this is an unlikely operational scenario.

backend/src/ee/services/hsm/hsm-service.ts — specifically the relaxed HMAC $findKey template.

Important Files Changed

_{Reviews (1): Last reviewed commit: "Update hsm-service.ts" | Re-trigger Greptile}