0039_api_key_encrypted.sql18 lines · main

1	-- 0039_api_key_encrypted — store each SDK key's ciphertext so a project owner
2	-- can copy the FULL plaintext again later (to paste elsewhere) without it ever
3	-- being displayed on screen.
4	--
5	-- Until now `briven_auth_sdk_keys` kept only a sha-256 digest (+ prefix +
6	-- suffix); the plaintext was shown exactly once on creation and then
7	-- unrecoverable. This adds a NULLABLE `encrypted_key` column holding the
8	-- AES-256-GCM ciphertext of the plaintext, encrypted at rest with the same
9	-- BRIVEN_ENCRYPTION_KEY KEK that protects customer env vars
10	-- (services/project-env.ts). The sha-256 `hash` column is unchanged and
11	-- remains the sole auth-verification mechanism — `encrypted_key` is for the
12	-- authenticated, audited copy-again action only.
13	--
14	-- NULLABLE on purpose: keys created before this migration have no ciphertext
15	-- and can never be revealed (the reveal endpoint returns key_not_revealable;
16	-- the owner must rotate to get a copyable key). IF NOT EXISTS keeps this safe
17	-- if a partial run ever happened.
18	ALTER TABLE "briven_auth_sdk_keys" ADD COLUMN IF NOT EXISTS "encrypted_key" text;