encryption: implement DEK caching

[patrislav]

Adds an optional in-memory LRU cache for decrypted data encryption keys (DEKs), eliminating KMS round-trips on cache hits. Each decrypt/encrypt operation currently requires 2-3 KMS calls to recover the DEK via Shamir secret sharing — the cache reduces this to zero on hit.

Design

• LRU + TTL eviction with configurable max size and TTL, using sync.Mutex + container/list
• Singleflight dedup prevents concurrent cache misses for the same key from stampeding KMS
• Key material zeroed on every eviction path (TTL, LRU, delete, clear)
• Opt-in via WithCache() — existing callers are unaffected (no cache by default)
• Encrypt path: still hits DynamoDB (to resolve key index → key ref), but skips KMS on cache hit
• Decrypt path: skips DynamoDB, verification, and KMS entirely on cache hit

Security

• DEK ↔ key ref mapping is immutable — cached DEKs cannot become stale
• Key material is copied on store and on retrieval (caller and cache are fully independent)
• RotateKey explicitly invalidates the cache entry
• No migration handling needed — generation changes require restart, which clears the cache

[Copilot]

Pull request overview

This PR adds an opt-in, in-process decrypted DEK cache to the encryption.Pool to avoid repeated DynamoDB/KMS/Shamir work on repeated encrypt/decrypt operations for the same keyRef.

Changes:

• Introduces CacheConfig, an in-memory LRU+TTL dekCache, and singleflight-style miss deduplication.
• Updates Pool construction to accept PoolOptions (notably WithCache) and threads cache usage through Encrypt/Decrypt/RotateKey.
• Adds unit tests covering cache hit/miss behavior, cache population, invalidation, and singleflight behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
encryption/pool.go	Adds cache plumbing to Pool plus a new fetchDEK helper to centralize the miss path and deduplicate concurrent fetches.
encryption/pool_test.go	Adds integration-style tests proving cache behavior across Encrypt/Decrypt/RotateKey and concurrent decrypts.
encryption/cache.go	Implements the LRU+TTL DEK cache with key zeroing on eviction and singleflight coordination.
encryption/cache_test.go	Adds unit tests for cache correctness (copy semantics, TTL/LRU eviction, delete/clear, singleflight).

Comments suppressed due to low confidence (1)

encryption/pool.go:235

• Decrypt no longer annotates the trace span with the resolved key generation / key index (these annotations existed before the refactor). Since fetchDEK has the key object, consider re-adding these annotations (e.g., by setting them on the active span in ctx or returning key metadata) so cache misses still emit the same observability signals.

	key, found, err := p.keysTable.GetLatestByKeyRef(ctx, keyRef, false)
	if err != nil {
		return nil, fmt.Errorf("get latest key: %w", err)
	}
	if !found {
		return nil, fmt.Errorf("key not found")
	}
	if err := p.VerifyKey(ctx, att, key); err != nil {
		return nil, fmt.Errorf("verify key: %w", err)
	}

	config, err := p.getConfig(key.Generation)
	if err != nil {
		return nil, fmt.Errorf("get config: %w", err)
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.