Nick SzaunigandClaude Opus 5.5
c01a38835a
Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks: - run roles api/worker/job/all with shared startup checks (Task 1) - schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2) - audit, notifications and domain events written in the same transaction (Task 3) - dispatcher with SKIP LOCKED claims, retries and stale release (Task 4) - worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5) - worker process and entry points (Task 6) - throttler counters in Postgres (Task 19) - separate keys per purpose with key ring (Task 20) - public origin page without exact location (Task 22) - shop keys split into read and write (Task 23) - Kustomize base, components, overlay encry, CI validation (Task 26) Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks: - brood frames, read endpoints, apiary overview and offline pack - network basics, offline queue v3, navigation sheets, form building blocks - new inspection with last-time hints and weather, varroa per day, treatment prefill, apiary page with round - inspection photo (Task 10) is implemented, review pending Not rolled out. Remaining tasks follow in later commits. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
37 lines
1.2 KiB
TypeScript
37 lines
1.2 KiB
TypeScript
import {
|
|
KEY_ID_PATTERN,
|
|
isSealedWithCurrentKey,
|
|
loadKeyRing,
|
|
openLegacyCiphertext,
|
|
openWithRing,
|
|
sealWithRing,
|
|
warnLegacyRead,
|
|
} from '../common/crypto/key-ring';
|
|
|
|
// Webhook signing secrets must stay reversible (the server signs with them),
|
|
// so they are sealed with the webhook key ring (WEBHOOK_ENCRYPTION_KEY, see
|
|
// common/crypto/key-ring.ts). Two older forms stay readable until the rekey
|
|
// job reseals them: "enc:v1:" + a ciphertext under sha256(JWT_ACCESS_SECRET),
|
|
// and, from before encryption, the plain secret without any prefix.
|
|
const LEGACY_PREFIX = 'enc:v1:';
|
|
|
|
export function sealWebhookSecret(secret: string): string {
|
|
return sealWithRing(loadKeyRing('webhook'), secret);
|
|
}
|
|
|
|
export function openWebhookSecret(stored: string): string {
|
|
if (KEY_ID_PATTERN.test(stored)) {
|
|
return openWithRing(loadKeyRing('webhook'), stored).plaintext;
|
|
}
|
|
if (stored.startsWith(LEGACY_PREFIX)) {
|
|
return openLegacyCiphertext('webhook', stored.slice(LEGACY_PREFIX.length));
|
|
}
|
|
warnLegacyRead('webhook');
|
|
return stored;
|
|
}
|
|
|
|
/** True for secrets the rekey job should reseal with the current key. */
|
|
export function webhookSecretNeedsRekey(stored: string): boolean {
|
|
return !isSealedWithCurrentKey(loadKeyRing('webhook'), stored);
|
|
}
|