@bevel-software/platform-core-backend 0.23.0 → 0.25.0

package/src/tenancy/static-tenant-source.ts

@@ -164,6 +164,7 @@ export function tenantConfigFrom(record: TenantRecord, settings: TenantHostSetti
     workspacesRoot: path.resolve(settings.workspacesRoot, slug),
     backupsRoot: besideWorkspaces('backups'),
     spillRoot: besideWorkspaces('tool-chain-spills'),
+    agentUploadsRoot: besideWorkspaces('agent-uploads'),
     docExtractCacheRoot: besideWorkspaces('doc-extract-cache'),
     jwtSecret: secrets.jwtSecret,
     secretsEncKey: secrets.secretsEncKey,

package/src/tenancy/tenant-secrets.ts

@@ -4,7 +4,7 @@ import { hkdfSync } from 'node:crypto';
 export interface TenantSecrets {
   /** Signs the tenant's login sessions and OAuth state. */
   jwtSecret: string;
-  /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens and stored git credential. */
+  /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens, stored git credential and personal-data columns. */
   secretsEncKey: string;
   /** HMAC key for the tenant's internal (loopback) tool tokens. */
   internalTokenSecret: string;
@@ -25,6 +25,10 @@ const MIN_MASTER_KEY_LENGTH = 32;
  * export, and nothing per tenant has to be kept safe in the meantime. The
  * cloud app's registry calls this with the same inputs and gets the same
  * answer.
+ *
+ * The personal-data columns are sealed under `secretsEncKey` too (each
+ * tenant's database handle is built with it), so the same one key opens the
+ * whole of a tenant's dump.
  */
 export function deriveTenantSecrets(masterKey: string, slug: string): TenantSecrets {
   if (masterKey.length < MIN_MASTER_KEY_LENGTH) {