From 6f4cdb86f7be383b7d5b64d066c1ebd231d23479 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Garc=C3=ADa?= Date: Mon, 2 Nov 2026 17:16:11 +0100 Subject: [PATCH] Clear user key ids left stale by key rotations --- migrations/mysql/2026-11-02-120000_reset_user_key_id/down.sql | 0 migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql | 4 ++++ .../postgresql/2026-11-02-120000_reset_user_key_id/down.sql | 0 .../postgresql/2026-11-02-120000_reset_user_key_id/up.sql | 4 ++++ .../sqlite/2026-11-02-120000_reset_user_key_id/down.sql | 0 migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql | 4 ++++ 6 files changed, 12 insertions(+) create mode 100644 migrations/mysql/2026-11-02-120000_reset_user_key_id/down.sql create mode 100644 migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql create mode 100644 migrations/postgresql/2026-11-02-120000_reset_user_key_id/down.sql create mode 100644 migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql create mode 100644 migrations/sqlite/2026-11-02-120000_reset_user_key_id/down.sql create mode 100644 migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql diff --git a/migrations/mysql/2026-11-02-120000_reset_user_key_id/down.sql b/migrations/mysql/2026-11-02-120000_reset_user_key_id/down.sql new file mode 100644 index 00000000..e69de29b diff --git a/migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql b/migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql new file mode 100644 index 00000000..eeffa854 --- /dev/null +++ b/migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql @@ -0,0 +1,4 @@ +-- Key rotations before this kept the id of the old user key, so every new +-- cipher was refused from then on. Stale ids can't be told apart, so clear +-- all of them; clients record their current key's id again when it's empty. +UPDATE users SET key_id = NULL; diff --git a/migrations/postgresql/2026-11-02-120000_reset_user_key_id/down.sql b/migrations/postgresql/2026-11-02-120000_reset_user_key_id/down.sql new file mode 100644 index 00000000..e69de29b diff --git a/migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql b/migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql new file mode 100644 index 00000000..eeffa854 --- /dev/null +++ b/migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql @@ -0,0 +1,4 @@ +-- Key rotations before this kept the id of the old user key, so every new +-- cipher was refused from then on. Stale ids can't be told apart, so clear +-- all of them; clients record their current key's id again when it's empty. +UPDATE users SET key_id = NULL; diff --git a/migrations/sqlite/2026-11-02-120000_reset_user_key_id/down.sql b/migrations/sqlite/2026-11-02-120000_reset_user_key_id/down.sql new file mode 100644 index 00000000..e69de29b diff --git a/migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql b/migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql new file mode 100644 index 00000000..eeffa854 --- /dev/null +++ b/migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql @@ -0,0 +1,4 @@ +-- Key rotations before this kept the id of the old user key, so every new +-- cipher was refused from then on. Stale ids can't be told apart, so clear +-- all of them; clients record their current key's id again when it's empty. +UPDATE users SET key_id = NULL;