LukeGus ee7768dd86 refactor(crypto): make system-wrapped DEKs the authoritative key path ...

DataCrypto and AuthManager now read keys through UserKeyManager: DEKs are
always unwrappable server-side, so the in-memory unlock session, DEK-in-JWT
wrapping, session-expiry data locks and ALLOW_APIKEY_DATA_UNLOCK are gone.
utils/user-crypto.ts is deleted; boot migration now cleans legacy wraps.
A one-release shim adopts DEKs from legacy dataKeyWrap tokens so active
password users migrate without re-login. Password login migrates legacy
password-wrapped DEKs via migratePasswordUserAtLogin.

2026-07-16 00:19:12 -05:00

..

db

draft: database layer refactor (#1054)

2026-07-15 23:28:10 -05:00

repositories

refactor(db): route remaining raw DB access through repositories

2026-07-16 00:04:36 -05:00

routes

refactor(crypto): make system-wrapped DEKs the authoritative key path

2026-07-16 00:19:12 -05:00

database.ts

refactor(db): collapse repository rollout scaffolding into single factory

2026-07-15 23:56:02 -05:00