0040_user_delete_secret.sql17 lines · main

1	-- 0040_user_delete_secret — store a user-chosen "delete secret" that gates
2	-- project deletion. Mirrors the SDK-key pattern (0034 + 0039):
3	--
4	-- * delete_secret_hash — sha-256 hex digest, the ONLY verification
5	-- mechanism (leaking it leaks zero usable secrets).
6	-- * delete_secret_enc — AES-256-GCM ciphertext of the plaintext,
7	-- encrypted at rest with the same BRIVEN_ENCRYPTION_KEY KEK that
8	-- protects customer env vars (services/project-env.ts). Exists solely
9	-- so the owner can reveal/copy the secret again through the
10	-- authenticated + audited reveal path; never used for verification.
11	-- * delete_secret_set_at — when the current secret was set.
12	--
13	-- All three NULLABLE: a user who has never set a secret has all three null.
14	-- IF NOT EXISTS keeps this safe if a partial run ever happened.
15	ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "delete_secret_hash" text;
16	ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "delete_secret_enc" text;
17	ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "delete_secret_set_at" timestamptz;