Ethica/Termix
1
0
Fork 0
mirror of https://github.com/Termix-SSH/Termix.git synced 2026-07-17 05:43:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(crypto): make system-wrapped DEKs the authoritative key path

Browse Source 
DataCrypto and AuthManager now read keys through UserKeyManager: DEKs are
always unwrappable server-side, so the in-memory unlock session, DEK-in-JWT
wrapping, session-expiry data locks and ALLOW_APIKEY_DATA_UNLOCK are gone.
utils/user-crypto.ts is deleted; boot migration now cleans legacy wraps.
A one-release shim adopts DEKs from legacy dataKeyWrap tokens so active
password users migrate without re-login. Password login migrates legacy
password-wrapped DEKs via migratePasswordUserAtLogin.
This commit is contained in:
LukeGus
2026-07-16 00:19:12 -05:00
parent 16506de9da
commit ee7768dd86
14 changed files with 234 additions and 1114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/backend/starter.ts
+1 -1
View File
@@ -122,7 +122,7 @@ import {
const { runBootDekMigration } =
await import("./utils/crypto-migration/dek-migration.js");
await runBootDekMigration();
await runBootDekMigration({ cleanupLegacy: true });
const authManager = AuthManager.getInstance();
await authManager.initialize();