Merge pull request #118 from CryptoLabInc/couragehong/fix/decryptscores-base64-encoding

fix(service): base64-encode envector cipher before Vault.DecryptScores

Author: couragehong

internal/service/capture.go

@@ -10,6 +10,7 @@ package service
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -273,7 +274,11 @@ func (s *CaptureService) runNoveltyCheck(ctx context.Context, embeddingText stri
 		return &domain.NoveltyInfo{Score: 1.0, Class: "novel"}, nil, nil
 	}
 
-	entries, err := s.Vault.DecryptScores(ctx, string(blobs[0]), 3)
+	// Vault.DecryptScores's `EncryptedBlobB64` is a proto3 string field —
+	// envector's raw cipher bytes must be base64-encoded before sending.
+	// Mirrors recall.searchSingle.
+	encryptedBlobB64 := base64.StdEncoding.EncodeToString(blobs[0])
+	entries, err := s.Vault.DecryptScores(ctx, encryptedBlobB64, 3)
 	if err != nil || len(entries) == 0 {
 		slog.Warn("novelty check: decrypt failed (non-fatal)", "err", err)
 		return &domain.NoveltyInfo{Score: 1.0, Class: "novel"}, nil, nil

internal/service/recall.go

@@ -159,8 +159,14 @@ func (s *RecallService) searchSingle(ctx context.Context, vec []float32, topk in
 		return nil, nil
 	}
 
-	// Vault decrypt scores
-	entries, err := s.Vault.DecryptScores(ctx, string(blobs[0]), topk)
+	// Vault decrypt scores. The Vault RPC field is `EncryptedBlobB64`
+	// (proto3 `string`, valid-UTF-8 only) — envector returns raw cipher
+	// bytes, so we must base64-encode before sending. A direct
+	// `string(blobs[0])` cast pushes random cipher bytes through the
+	// proto3 string-validation path and trips
+	// "grpc: error while marshaling: string field contains invalid UTF-8".
+	encryptedBlobB64 := base64.StdEncoding.EncodeToString(blobs[0])
+	entries, err := s.Vault.DecryptScores(ctx, encryptedBlobB64, topk)
 	if err != nil {
 		return nil, fmt.Errorf("vault decrypt scores: %w", err)
 	}