fix(worker): store iv as hex string instead of raw bytes

The SavedPackageData.iv column is String(255), but the worker was
writing the raw bytes returned by os.urandom(16). SQLAlchemy/psycopg2
serialize bytes-into-text as PostgreSQL's BYTEA literal "\x..." +
hex, which then flowed straight to the client through /blob's JSON
response. The frontend tried to use that as a hex IV, AES-CBC produced
garbage, and the loading screen was stuck on "processing" forever.

Fix: write iv.hex() at the worker. App's /blob handler now just
returns row.iv as-is — the previous defensive bytes-to-hex check was
masking the real bug.

Existing rows written before this fix still carry the "\x..." prefix
and need to be reprocessed (delete + POST /process).

Author: Androz2091

src/app.py

@@ -238,13 +238,9 @@ def get_package_blob(package_id):
     if not row or not blob_storage.exists(package_id):
         return make_response('', 404)
 
-    iv_value = row.iv
-    if isinstance(iv_value, (bytes, bytearray)):
-        iv_value = iv_value.hex()
-
     return jsonify({
         'url': blob_storage.presigned_url(package_id, ttl_seconds=ttl),
-        'iv': iv_value,
+        'iv': row.iv,
         'ttl': ttl,
     }), 200
 

src/tasks.py

@@ -913,9 +913,12 @@ def _is_in_existing_event(t):
 
     # Encrypted blob → S3 (clients fetch via presigned URL); only the iv
     # stays in Postgres so the API can hand it to the client for decryption.
+    # Store iv as hex — the column is a String, so writing raw bytes lets
+    # PostgreSQL serialize it as the BYTEA literal "\x..." which leaks
+    # straight to the client.
     import blob_storage
     blob_storage.upload(package_id, data)
-    session.add(SavedPackageData(package_id=package_id, iv=iv))
+    session.add(SavedPackageData(package_id=package_id, iv=iv.hex()))
     session.commit()
 
     print(f'SQLite serialization: {time.time() - start}')