@hilbras/keystone 1.5.0 → 1.9.0

package/dist/db/migrations/meta/_journal.json

@@ -57,6 +57,55 @@
       "when": 1784223453577,
       "tag": "0007_greedy_vindicator",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1790267029462,
+      "tag": "0008_flashy_firestar",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1790271016658,
+      "tag": "0009_daffy_changeling",
+      "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "7",
+      "when": 1790276829374,
+      "tag": "0010_wealthy_shadow_king",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1790281200949,
+      "tag": "0011_overrated_vector",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "7",
+      "when": 1790365064453,
+      "tag": "0012_brave_darkhawk",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "7",
+      "when": 1790365489615,
+      "tag": "0013_wonderful_chimera",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "7",
+      "when": 1790367480928,
+      "tag": "0014_magical_morph",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/reencryptOidcSecrets.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=reencryptOidcSecrets.d.ts.map

package/dist/db/reencryptOidcSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reencryptOidcSecrets.d.ts","sourceRoot":"","sources":["../../src/db/reencryptOidcSecrets.ts"],"names":[],"mappings":""}

package/dist/db/reencryptOidcSecrets.js

@@ -0,0 +1,41 @@
+import { eq } from "drizzle-orm";
+import { db, closeDb } from "./index.js";
+import { oidcConnections } from "./schema.js";
+import { encryptSecret } from "../services/secrets/index.js";
+import { isLegacyOidcSecret, LEGACY_OIDC_SECRET_PREFIX } from "../services/oidcSecretFormat.js";
+const allowUnmarkedPlaintext = process.argv.includes("--allow-unmarked-plaintext");
+function looksEncrypted(value) {
+    if (value.startsWith("aes-256-gcm$") || value.startsWith("azure-key-vault$"))
+        return true;
+    const parts = value.split(":");
+    if (parts.length !== 2)
+        return false;
+    try {
+        return Buffer.from(parts[0], "base64").length === 16 && parts[1].length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function main() {
+    const rows = await db.select().from(oidcConnections);
+    let migrated = 0;
+    for (const row of rows) {
+        const value = row.clientSecret;
+        const legacy = isLegacyOidcSecret(value);
+        if (!legacy && (!allowUnmarkedPlaintext || looksEncrypted(value)))
+            continue;
+        const plaintext = legacy ? value.slice(LEGACY_OIDC_SECRET_PREFIX.length) : value;
+        const encrypted = await encryptSecret(plaintext);
+        await db.update(oidcConnections).set({ clientSecret: encrypted, updatedAt: new Date() }).where(eq(oidcConnections.id, row.id));
+        migrated++;
+    }
+    console.log(`[db] migrated ${migrated} OIDC client secret(s)`);
+}
+try {
+    await main();
+}
+finally {
+    await closeDb();
+}
+//# sourceMappingURL=reencryptOidcSecrets.js.map

package/dist/db/reencryptOidcSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reencryptOidcSecrets.js","sourceRoot":"","sources":["../../src/db/reencryptOidcSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEhG,MAAM,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;AAEnF,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC;QAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,sBAAsB,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/H,QAAQ,EAAE,CAAC;IACb,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,wBAAwB,CAAC,CAAC;AACjE,CAAC;AAED,IAAI,CAAC;IACH,MAAM,IAAI,EAAE,CAAC;AACf,CAAC;QAAS,CAAC;IACT,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC"}