new fixes

app/core/background/convert_v3_service.py

@@ -18,8 +18,8 @@ from app.core.models.content_v3 import (
 )
 from app.core.models.node_storage import StoredContent
 from app.core.ipfs_client import cat_stream
-from app.core.crypto.aesgcm_stream import CHUNK_BYTES
 from app.core.crypto.encf_stream import decrypt_encf_auto
+from app.core.crypto.keywrap import unwrap_dek, wrap_dek, KeyWrapError
 from app.core.network.key_client import request_key_from_peer
 from app.core.models.my_network import KnownNode
 
@@ -226,8 +226,11 @@ async def _pick_pending(limit: int) -> List[Tuple[EncryptedContent, str]]:
                     dek = await request_key_from_peer(base_url, ec.encrypted_cid)
                     if not dek:
                         continue
-                    import base64
-                    dek_b64 = base64.b64encode(dek).decode()
+                    try:
+                        dek_b64 = wrap_dek(dek)
+                    except KeyWrapError as exc:
+                        make_log('convert_v3', f"wrap failed for peer DEK: {exc}", level='error')
+                        continue
                     session_ck = ContentKey(
                         content_id=ec.id,
                         key_ciphertext_b64=dek_b64,
@@ -282,10 +285,14 @@ async def main_fn(memory):
     await worker_loop()
 
 
-async def stage_plain_from_ipfs(ec: EncryptedContent, dek_b64: str) -> str | None:
+async def stage_plain_from_ipfs(ec: EncryptedContent, dek_wrapped: str) -> str | None:
     """Download encrypted ENCF stream from IPFS and decrypt on the fly into a temp file."""
-    import base64, tempfile
-    dek = base64.b64decode(dek_b64)
+    import tempfile
+    try:
+        dek = unwrap_dek(dek_wrapped)
+    except KeyWrapError as exc:
+        make_log('convert_v3', f"unwrap failed for {ec.encrypted_cid}: {exc}", level='error')
+        return None
     tmp = tempfile.NamedTemporaryFile(prefix=f"dec_{ec.encrypted_cid[:8]}_", delete=False)
     tmp_path = tmp.name
     tmp.close()