mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 21:46:49 +00:00
Maurice
724c88c201
A mechanical prettier --write over server/src, server/tests, server/scripts and shared/src with the workspaces' .prettierrc; nothing but layout and import order changes, and every file keeps the same set of imports. shared is formatted throughout and its format baseline is empty. The server baseline keeps the 35 files that Prettier would grow past their lint:size limit (they need a split first, which is not a formatting change), and the generated entity files stay as their generator writes them.
690 lines
28 KiB
TypeScript
690 lines
28 KiB
TypeScript
/**
|
|
* Encryption key migration script.
|
|
*
|
|
* Re-encrypts all at-rest secrets in the TREK database from one ENCRYPTION_KEY
|
|
* to another without requiring the application to be running.
|
|
*
|
|
* Usage (host):
|
|
* cd server
|
|
* node --import tsx scripts/migrate-encryption.ts
|
|
*
|
|
* Usage (Docker):
|
|
* docker exec -it trek node --import tsx scripts/migrate-encryption.ts
|
|
*
|
|
* The script will prompt for the old and new keys interactively so they never
|
|
* appear in shell history, process arguments, or log output.
|
|
*/
|
|
import Database from 'better-sqlite3';
|
|
import crypto from 'crypto';
|
|
import fs from 'fs';
|
|
import path from 'path';
|
|
import readline from 'readline';
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Crypto helpers — mirrors apiKeyCrypto.ts and mfaCrypto.ts but with
|
|
// explicit key arguments so the script is independent of config.ts / env vars.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
const ENCRYPTED_PREFIX = 'enc:v1:';
|
|
|
|
function apiKey(encryptionKey: string): Buffer {
|
|
return crypto.createHash('sha256').update(`${encryptionKey}:api_keys:v1`).digest();
|
|
}
|
|
|
|
function mfaKey(encryptionKey: string): Buffer {
|
|
return crypto.createHash('sha256').update(`${encryptionKey}:mfa:v1`).digest();
|
|
}
|
|
|
|
function encryptApiKey(plain: string, encryptionKey: string): string {
|
|
const iv = crypto.randomBytes(12);
|
|
const cipher = crypto.createCipheriv('aes-256-gcm', apiKey(encryptionKey), iv);
|
|
const enc = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
|
|
const tag = cipher.getAuthTag();
|
|
return `${ENCRYPTED_PREFIX}${Buffer.concat([iv, tag, enc]).toString('base64')}`;
|
|
}
|
|
|
|
function decryptApiKey(value: string, encryptionKey: string): string | null {
|
|
if (!value.startsWith(ENCRYPTED_PREFIX)) return null;
|
|
try {
|
|
const buf = Buffer.from(value.slice(ENCRYPTED_PREFIX.length), 'base64');
|
|
const decipher = crypto.createDecipheriv('aes-256-gcm', apiKey(encryptionKey), buf.subarray(0, 12));
|
|
decipher.setAuthTag(buf.subarray(12, 28));
|
|
return Buffer.concat([decipher.update(buf.subarray(28)), decipher.final()]).toString('utf8');
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function encryptMfa(plain: string, encryptionKey: string): string {
|
|
const iv = crypto.randomBytes(12);
|
|
const cipher = crypto.createCipheriv('aes-256-gcm', mfaKey(encryptionKey), iv);
|
|
const enc = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
|
|
const tag = cipher.getAuthTag();
|
|
return Buffer.concat([iv, tag, enc]).toString('base64');
|
|
}
|
|
|
|
function decryptMfa(value: string, encryptionKey: string): string | null {
|
|
try {
|
|
const buf = Buffer.from(value, 'base64');
|
|
if (buf.length < 28) return null;
|
|
const decipher = crypto.createDecipheriv('aes-256-gcm', mfaKey(encryptionKey), buf.subarray(0, 12));
|
|
decipher.setAuthTag(buf.subarray(12, 28));
|
|
return Buffer.concat([decipher.update(buf.subarray(28)), decipher.final()]).toString('utf8');
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Prompt helpers
|
|
// ---------------------------------------------------------------------------
|
|
// A single readline interface is shared for the entire script lifetime so
|
|
// stdin is never paused between prompts.
|
|
//
|
|
// Lines are collected into a queue as soon as readline emits them — this
|
|
// prevents the race where a line event fires before the next listener is
|
|
// registered (common with piped / pasted input that arrives all at once).
|
|
|
|
const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
|
|
|
|
const lineQueue: string[] = [];
|
|
const lineWaiters: ((line: string) => void)[] = [];
|
|
|
|
rl.on('line', (line) => {
|
|
if (lineWaiters.length > 0) {
|
|
lineWaiters.shift()!(line);
|
|
} else {
|
|
lineQueue.push(line);
|
|
}
|
|
});
|
|
|
|
function nextLine(): Promise<string> {
|
|
return new Promise((resolve) => {
|
|
if (lineQueue.length > 0) {
|
|
resolve(lineQueue.shift()!);
|
|
} else {
|
|
lineWaiters.push(resolve);
|
|
}
|
|
});
|
|
}
|
|
|
|
// Muted prompt — typed/pasted characters are not echoed.
|
|
// _writeToOutput is suppressed only while waiting for this line.
|
|
async function promptSecret(question: string): Promise<string> {
|
|
process.stdout.write(question);
|
|
(rl as any)._writeToOutput = () => {};
|
|
const line = await nextLine();
|
|
(rl as any)._writeToOutput = (s: string) => process.stdout.write(s);
|
|
process.stdout.write('\n');
|
|
return line.trim();
|
|
}
|
|
|
|
async function prompt(question: string): Promise<string> {
|
|
process.stdout.write(question);
|
|
const line = await nextLine();
|
|
return line.trim();
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Migration
|
|
// ---------------------------------------------------------------------------
|
|
|
|
interface MigrationResult {
|
|
migrated: number;
|
|
alreadyMigrated: number;
|
|
skipped: number;
|
|
errors: string[];
|
|
}
|
|
|
|
async function main() {
|
|
console.log('=== TREK Encryption Key Migration ===\n');
|
|
console.log('This script re-encrypts all stored secrets under a new ENCRYPTION_KEY.');
|
|
console.log('A backup of the database will be created before any changes are made.\n');
|
|
|
|
// Resolve DB path
|
|
const dbPath = path.resolve(process.env.DB_PATH ?? path.join(__dirname, '../data/travel.db'));
|
|
|
|
if (!fs.existsSync(dbPath)) {
|
|
console.error(`Database not found at: ${dbPath}`);
|
|
console.error('Set DB_PATH env var if your database is in a non-standard location.');
|
|
process.exit(1);
|
|
}
|
|
|
|
console.log(`Database: ${dbPath}\n`);
|
|
|
|
// Collect keys interactively
|
|
const oldKey = await promptSecret('Old ENCRYPTION_KEY: ');
|
|
const newKey = await promptSecret('New ENCRYPTION_KEY: ');
|
|
|
|
if (!oldKey || !newKey) {
|
|
rl.close();
|
|
console.error('Both keys are required.');
|
|
process.exit(1);
|
|
}
|
|
|
|
if (oldKey === newKey) {
|
|
rl.close();
|
|
console.error('Old and new keys are identical — nothing to do.');
|
|
process.exit(0);
|
|
}
|
|
|
|
// Confirm
|
|
const confirm = await prompt('\nProceed with migration? This will modify the database. Type "yes" to confirm: ');
|
|
if (confirm.trim().toLowerCase() !== 'yes') {
|
|
rl.close();
|
|
console.log('Aborted.');
|
|
process.exit(0);
|
|
}
|
|
|
|
// Backup
|
|
const backupPath = `${dbPath}.backup-${Date.now()}`;
|
|
|
|
const db = new Database(dbPath);
|
|
db.pragma('busy_timeout = 5000');
|
|
// Temp files in memory, like every connection src/db/connection.ts opens: a
|
|
// container with a read-only root and no tmpfs on /tmp has nowhere to put
|
|
// them, and the rotation below runs as one long transaction (#2518).
|
|
db.pragma('temp_store = MEMORY');
|
|
|
|
// The rollback copy has to be a consistent snapshot, not a plain file copy:
|
|
// this script is documented as running against a live server, so in WAL mode
|
|
// the committed tail sits in the -wal sidecar a copy would leave behind.
|
|
// VACUUM INTO snapshots even while the server writes; the checkpoint plus
|
|
// copy is only the fallback for when it cannot (disk, lock).
|
|
try {
|
|
db.exec(`VACUUM INTO '${backupPath.replace(/'/g, "''")}'`);
|
|
} catch {
|
|
db.exec('PRAGMA wal_checkpoint(TRUNCATE)');
|
|
fs.copyFileSync(dbPath, backupPath);
|
|
}
|
|
console.log(`\nBackup created: ${backupPath}`);
|
|
|
|
// journal_mode lives in the file header, so hardcoding WAL here would quietly
|
|
// undo a deliberate DELETE/TRUNCATE setup (network storage) on the first key
|
|
// rotation. This script ships without src/ in the image and cannot import
|
|
// src/app-config, so it reads the same variables directly — keep the defaults
|
|
// in step with parsers.resolveDurability().
|
|
const journalModes = ['DELETE', 'TRUNCATE', 'PERSIST', 'MEMORY', 'WAL', 'OFF'];
|
|
const syncLevels = ['OFF', 'NORMAL', 'FULL', 'EXTRA'];
|
|
|
|
const wantedJournal = (process.env.TREK_DB_JOURNAL_MODE ?? '').trim().toUpperCase();
|
|
const journalMode = journalModes.includes(wantedJournal) ? wantedJournal : 'WAL';
|
|
if (wantedJournal && journalMode !== wantedJournal) {
|
|
console.warn(
|
|
`TREK_DB_JOURNAL_MODE="${process.env.TREK_DB_JOURNAL_MODE}" is not a SQLite journal mode — using ${journalMode}.`,
|
|
);
|
|
}
|
|
|
|
const wantedSync = (process.env.TREK_DB_SYNCHRONOUS ?? '').trim().toUpperCase();
|
|
const defaultSync = journalMode === 'WAL' ? 'NORMAL' : 'FULL';
|
|
const synchronous = syncLevels.includes(wantedSync) ? wantedSync : defaultSync;
|
|
if (wantedSync && synchronous !== wantedSync) {
|
|
console.warn(
|
|
`TREK_DB_SYNCHRONOUS="${process.env.TREK_DB_SYNCHRONOUS}" is not a SQLite synchronous level — using ${synchronous}.`,
|
|
);
|
|
}
|
|
|
|
db.pragma(`journal_mode = ${journalMode}`);
|
|
db.pragma(`synchronous = ${synchronous}`);
|
|
console.log(`Journal mode: ${db.pragma('journal_mode', { simple: true })}\n`);
|
|
|
|
const result: MigrationResult = { migrated: 0, alreadyMigrated: 0, skipped: 0, errors: [] };
|
|
|
|
// Helper: migrate a single api-key-style value (enc:v1: prefix)
|
|
function migrateApiKeyValue(raw: string, label: string): string | null {
|
|
if (!raw || !raw.startsWith(ENCRYPTED_PREFIX)) {
|
|
result.skipped++;
|
|
console.warn(` SKIP ${label}: not an encrypted value (missing enc:v1: prefix)`);
|
|
return null;
|
|
}
|
|
|
|
const plain = decryptApiKey(raw, oldKey);
|
|
if (plain !== null) {
|
|
result.migrated++;
|
|
return encryptApiKey(plain, newKey);
|
|
}
|
|
|
|
// Try new key — already migrated?
|
|
const check = decryptApiKey(raw, newKey);
|
|
if (check !== null) {
|
|
result.alreadyMigrated++;
|
|
return null; // no change needed
|
|
}
|
|
|
|
result.errors.push(`${label}: decryption failed with both keys`);
|
|
console.error(` ERROR ${label}: could not decrypt with either key — skipping`);
|
|
return null;
|
|
}
|
|
|
|
// Helper: migrate a single MFA value (no prefix, raw base64)
|
|
function migrateMfaValue(raw: string, label: string): string | null {
|
|
if (!raw) {
|
|
result.skipped++;
|
|
return null;
|
|
}
|
|
|
|
const plain = decryptMfa(raw, oldKey);
|
|
if (plain !== null) {
|
|
result.migrated++;
|
|
return encryptMfa(plain, newKey);
|
|
}
|
|
|
|
const check = decryptMfa(raw, newKey);
|
|
if (check !== null) {
|
|
result.alreadyMigrated++;
|
|
return null;
|
|
}
|
|
|
|
result.errors.push(`${label}: decryption failed with both keys`);
|
|
console.error(` ERROR ${label}: could not decrypt with either key — skipping`);
|
|
return null;
|
|
}
|
|
|
|
db.transaction(() => {
|
|
// --- app_settings: oidc_client_secret, smtp_pass, admin_webhook_url, admin_ntfy_token,
|
|
// plus the instance-wide provider keys (#1939) ---
|
|
//
|
|
// The last two mirror INSTANCE_API_KEY_NAMES in
|
|
// src/nest/settings/instance-api-keys.ts. Spelled out rather than imported,
|
|
// because that module pulls in DatabaseService and this script deliberately
|
|
// stays independent of src/ (see the crypto note above). Miss one and a
|
|
// rotation leaves it encrypted under the old key, which reads back as "no
|
|
// key" and silently drops the install to OpenStreetMap, so the copy is
|
|
// pinned by tests/unit/db/migrate-encryption-parity.test.ts.
|
|
//
|
|
// web_push_vapid_private_key is the Web Push signing key VapidKeysService
|
|
// generates. Missed here it would no longer decrypt under the new key, and
|
|
// push would stay off on every device until the old key came back.
|
|
for (const key of [
|
|
'oidc_client_secret',
|
|
'smtp_pass',
|
|
'admin_webhook_url',
|
|
'admin_ntfy_token',
|
|
'maps_api_key',
|
|
'unsplash_api_key',
|
|
'amap_api_key',
|
|
'web_push_vapid_private_key',
|
|
]) {
|
|
const row = db.prepare('SELECT value FROM app_settings WHERE key = ?').get(key) as { value: string } | undefined;
|
|
if (!row?.value) continue;
|
|
const newVal = migrateApiKeyValue(row.value, `app_settings.${key}`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE app_settings SET value = ? WHERE key = ?').run(newVal, key);
|
|
}
|
|
}
|
|
|
|
// --- users: api key columns + synology credentials ---
|
|
// unsplash_api_key was missing here for as long as the column has existed. It
|
|
// matters now that the resolver reads it as the per-user fallback (#1939): left
|
|
// out of a rotation it stays encrypted under the old key and reads back as unset.
|
|
// airtrail_api_key arrived with a later migration, so an older database may
|
|
// not have the column at all — filter the list against the real table rather
|
|
// than letting one missing column throw the whole rotation.
|
|
const userColumns = new Set(
|
|
(db.prepare("SELECT name FROM pragma_table_info('users')").all() as { name: string }[]).map((r) => r.name),
|
|
);
|
|
const apiKeyColumns = [
|
|
'maps_api_key',
|
|
'unsplash_api_key',
|
|
// Added with the Amap provider; filtered against the real table below, so a
|
|
// database that has not run that migration yet is not a rotation failure.
|
|
'amap_api_key',
|
|
'openweather_api_key',
|
|
'immich_api_key',
|
|
'synology_password',
|
|
'synology_sid',
|
|
'synology_did',
|
|
'airtrail_api_key',
|
|
].filter((c) => userColumns.has(c));
|
|
const users = db.prepare('SELECT id FROM users').all() as { id: number }[];
|
|
|
|
for (const user of users) {
|
|
const row = db.prepare(`SELECT ${apiKeyColumns.join(', ')} FROM users WHERE id = ?`).get(user.id) as Record<
|
|
string,
|
|
string
|
|
>;
|
|
|
|
for (const col of apiKeyColumns) {
|
|
if (!row[col]) continue;
|
|
const newVal = migrateApiKeyValue(row[col], `users[${user.id}].${col}`);
|
|
if (newVal !== null) {
|
|
db.prepare(`UPDATE users SET ${col} = ? WHERE id = ?`).run(newVal, user.id);
|
|
}
|
|
}
|
|
|
|
// mfa_secret (mfa crypto)
|
|
const mfaRow = db.prepare('SELECT mfa_secret FROM users WHERE id = ? AND mfa_secret IS NOT NULL').get(user.id) as
|
|
{ mfa_secret: string } | undefined;
|
|
if (mfaRow?.mfa_secret) {
|
|
const newVal = migrateMfaValue(mfaRow.mfa_secret, `users[${user.id}].mfa_secret`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE users SET mfa_secret = ? WHERE id = ?').run(newVal, user.id);
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- app_settings: storage.backends ---
|
|
// Storage backend secrets live encrypted INSIDE the storage.backends JSON
|
|
// array (BACKENDS_KEY in src/nest/storage/storage-registry.service.ts is
|
|
// its own app_settings row — 'storage.categories' is a sibling row with no
|
|
// secrets), on the fields the shared type registry marks `secret` (only
|
|
// options.secretAccessKey for s3 today; src/nest/storage/storage-secrets.ts
|
|
// encrypts it with the same enc:v1: scheme as the api-key columns above).
|
|
// This script can't import storageSecretFields from @trek/shared (kept
|
|
// independent of the app, see the header note), so the field list per
|
|
// backend type is pinned here. Miss one and that backend's secret stays
|
|
// encrypted under the old key after rotation, then fails to decrypt on the
|
|
// next read (StorageBackendError) — pinned by
|
|
// tests/unit/db/migrate-encryption-parity.test.ts.
|
|
const STORAGE_BACKEND_SECRET_FIELDS: Record<string, readonly string[]> = {
|
|
s3: ['secretAccessKey'],
|
|
};
|
|
{
|
|
const row = db.prepare("SELECT value FROM app_settings WHERE key = 'storage.backends'").get() as
|
|
{ value: string } | undefined;
|
|
if (row?.value) {
|
|
let backends: unknown;
|
|
try {
|
|
backends = JSON.parse(row.value);
|
|
} catch {
|
|
result.errors.push('app_settings.storage.backends: invalid JSON — skipping');
|
|
backends = undefined;
|
|
}
|
|
if (backends !== undefined) {
|
|
if (Array.isArray(backends)) {
|
|
let changed = false;
|
|
for (const backend of backends as Record<string, unknown>[]) {
|
|
if (!backend || typeof backend !== 'object') continue;
|
|
const type = typeof backend.type === 'string' ? backend.type : undefined;
|
|
const fields = type ? STORAGE_BACKEND_SECRET_FIELDS[type] : undefined;
|
|
if (!fields || fields.length === 0) continue;
|
|
const options = backend.options;
|
|
if (!options || typeof options !== 'object') continue;
|
|
const name = typeof backend.name === 'string' ? backend.name : '?';
|
|
for (const field of fields) {
|
|
const raw = (options as Record<string, unknown>)[field];
|
|
if (typeof raw !== 'string' || !raw) continue;
|
|
const newVal = migrateApiKeyValue(raw, `app_settings.storage.backends[${name}].${field}`);
|
|
if (newVal !== null) {
|
|
(options as Record<string, unknown>)[field] = newVal;
|
|
changed = true;
|
|
}
|
|
}
|
|
}
|
|
if (changed) {
|
|
db.prepare("UPDATE app_settings SET value = ? WHERE key = 'storage.backends'").run(
|
|
JSON.stringify(backends),
|
|
);
|
|
}
|
|
} else {
|
|
result.errors.push('app_settings.storage.backends: not an array — skipping');
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- settings: per-user encrypted keys ---
|
|
const encryptedSettingKeys = ['webhook_url', 'ntfy_token', 'mapbox_access_token', 'carto_api_key', 'llm_api_key'];
|
|
const settingRows = db
|
|
.prepare(
|
|
`SELECT user_id, key, value FROM settings WHERE key IN (${encryptedSettingKeys.map(() => '?').join(', ')})`,
|
|
)
|
|
.all(...encryptedSettingKeys) as { user_id: number; key: string; value: string }[];
|
|
|
|
for (const row of settingRows) {
|
|
if (!row.value) continue;
|
|
const newVal = migrateApiKeyValue(row.value, `settings[user=${row.user_id}].${row.key}`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE settings SET value = ? WHERE user_id = ? AND key = ?').run(newVal, row.user_id, row.key);
|
|
}
|
|
}
|
|
|
|
// --- plugins: OAuth tokens and secret settings fields ---
|
|
// The plugin host encrypts with the same enc:v1: scheme as everything above:
|
|
// plugin-oauth.service stores both tokens encrypted, and plugins.service
|
|
// encrypts every settings field the manifest marked secret (instance scope in
|
|
// plugins.config, user scope in plugin_user_config.config). Left out of a
|
|
// rotation, a connected plugin reads back as "not connected" and a secret
|
|
// setting as unset, with nothing in the log to say why. Every table here
|
|
// arrived with a later migration, so each block checks that it exists.
|
|
const tableExists = (name: string): boolean =>
|
|
!!db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(name);
|
|
|
|
if (tableExists('plugin_oauth_tokens')) {
|
|
const tokenRows = db
|
|
.prepare('SELECT plugin_id, user_id, access_token, refresh_token FROM plugin_oauth_tokens')
|
|
.all() as { plugin_id: string; user_id: number; access_token: string | null; refresh_token: string | null }[];
|
|
for (const row of tokenRows) {
|
|
for (const col of ['access_token', 'refresh_token'] as const) {
|
|
const raw = row[col];
|
|
if (!raw) continue;
|
|
const newVal = migrateApiKeyValue(raw, `plugin_oauth_tokens[${row.plugin_id},${row.user_id}].${col}`);
|
|
if (newVal !== null) {
|
|
db.prepare(`UPDATE plugin_oauth_tokens SET ${col} = ? WHERE plugin_id = ? AND user_id = ?`).run(
|
|
newVal,
|
|
row.plugin_id,
|
|
row.user_id,
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (tableExists('plugin_settings_fields')) {
|
|
// Which keys are secret is per plugin and per scope, and it lives in the DB
|
|
// rather than in this script, so nothing has to be pinned by hand here.
|
|
const secretFields = db
|
|
.prepare('SELECT plugin_id, field_key, scope FROM plugin_settings_fields WHERE secret = 1')
|
|
.all() as { plugin_id: string; field_key: string; scope: string | null }[];
|
|
const secretKeysFor = (pluginId: string, scope: string): string[] =>
|
|
secretFields
|
|
.filter((f) => f.plugin_id === pluginId && (f.scope ?? 'instance') === scope)
|
|
.map((f) => f.field_key);
|
|
|
|
const migrateConfigJson = (raw: string | null, keys: string[], label: string): string | null => {
|
|
if (!raw || keys.length === 0) return null;
|
|
let parsed: unknown;
|
|
try {
|
|
parsed = JSON.parse(raw);
|
|
} catch {
|
|
result.errors.push(`${label}: invalid JSON — skipping`);
|
|
return null;
|
|
}
|
|
if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
|
|
result.errors.push(`${label}: not an object — skipping`);
|
|
return null;
|
|
}
|
|
const config = parsed as Record<string, unknown>;
|
|
let changed = false;
|
|
for (const key of keys) {
|
|
const value = config[key];
|
|
if (typeof value !== 'string' || !value) continue;
|
|
const newVal = migrateApiKeyValue(value, `${label}.${key}`);
|
|
if (newVal !== null) {
|
|
config[key] = newVal;
|
|
changed = true;
|
|
}
|
|
}
|
|
return changed ? JSON.stringify(config) : null;
|
|
};
|
|
|
|
if (tableExists('plugins')) {
|
|
const pluginRows = db.prepare('SELECT id, config FROM plugins').all() as {
|
|
id: string;
|
|
config: string | null;
|
|
}[];
|
|
for (const row of pluginRows) {
|
|
const next = migrateConfigJson(row.config, secretKeysFor(row.id, 'instance'), `plugins[${row.id}].config`);
|
|
if (next !== null) {
|
|
db.prepare('UPDATE plugins SET config = ? WHERE id = ?').run(next, row.id);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (tableExists('plugin_user_config')) {
|
|
const userConfigRows = db.prepare('SELECT plugin_id, user_id, config FROM plugin_user_config').all() as {
|
|
plugin_id: string;
|
|
user_id: number;
|
|
config: string | null;
|
|
}[];
|
|
for (const row of userConfigRows) {
|
|
const next = migrateConfigJson(
|
|
row.config,
|
|
secretKeysFor(row.plugin_id, 'user'),
|
|
`plugin_user_config[${row.plugin_id},${row.user_id}].config`,
|
|
);
|
|
if (next !== null) {
|
|
db.prepare('UPDATE plugin_user_config SET config = ? WHERE plugin_id = ? AND user_id = ?').run(
|
|
next,
|
|
row.plugin_id,
|
|
row.user_id,
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- addons: the AI Parsing addon's instance-wide API key ---
|
|
// Stored encrypted as `apiKey` inside the addon's JSON config
|
|
// (llm-parse/llm-config.ts). Left out, LLM parsing quietly runs without a
|
|
// key after the rotation, since a failed decrypt reads as "no key".
|
|
if (tableExists('addons')) {
|
|
const addonRows = db.prepare('SELECT id, config FROM addons WHERE config IS NOT NULL').all() as {
|
|
id: string;
|
|
config: string;
|
|
}[];
|
|
for (const row of addonRows) {
|
|
let config: unknown;
|
|
try {
|
|
config = JSON.parse(row.config);
|
|
} catch {
|
|
continue;
|
|
}
|
|
if (!config || typeof config !== 'object' || Array.isArray(config)) continue;
|
|
const apiKey = (config as Record<string, unknown>).apiKey;
|
|
if (typeof apiKey !== 'string' || !apiKey) continue;
|
|
const newVal = migrateApiKeyValue(apiKey, `addons[${row.id}].config.apiKey`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE addons SET config = ? WHERE id = ?').run(
|
|
JSON.stringify({ ...(config as Record<string, unknown>), apiKey: newVal }),
|
|
row.id,
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- trip_album_links: passphrase ---
|
|
const albumLinks = db.prepare('SELECT id, passphrase FROM trip_album_links WHERE passphrase IS NOT NULL').all() as {
|
|
id: number;
|
|
passphrase: string;
|
|
}[];
|
|
for (const row of albumLinks) {
|
|
const newVal = migrateApiKeyValue(row.passphrase, `trip_album_links[${row.id}].passphrase`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE trip_album_links SET passphrase = ? WHERE id = ?').run(newVal, row.id);
|
|
}
|
|
}
|
|
|
|
// --- dawarich_connections: api_key ---
|
|
// Its own table rather than a users column, so it needs its own block. The
|
|
// table arrived with a later migration, hence the existence check: an older
|
|
// database simply has nothing to rotate here.
|
|
if (tableExists('dawarich_connections')) {
|
|
const connections = db
|
|
.prepare('SELECT user_id, api_key FROM dawarich_connections WHERE api_key IS NOT NULL')
|
|
.all() as { user_id: number; api_key: string }[];
|
|
for (const row of connections) {
|
|
const newVal = migrateApiKeyValue(row.api_key, `dawarich_connections[${row.user_id}].api_key`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE dawarich_connections SET api_key = ? WHERE user_id = ?').run(newVal, row.user_id);
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- trek_photos: passphrase ---
|
|
const photos = db.prepare('SELECT id, passphrase FROM trek_photos WHERE passphrase IS NOT NULL').all() as {
|
|
id: number;
|
|
passphrase: string;
|
|
}[];
|
|
for (const row of photos) {
|
|
const newVal = migrateApiKeyValue(row.passphrase, `trek_photos[${row.id}].passphrase`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE trek_photos SET passphrase = ? WHERE id = ?').run(newVal, row.id);
|
|
}
|
|
}
|
|
|
|
// --- document_connections: secrets ---
|
|
// Every credential of a document connection sits in ONE encrypted JSON blob
|
|
// (src/nest/doc-sync/doc-sync-secrets.ts) rather than in a column per
|
|
// provider, so a new provider changes nothing here: the blob is rotated as
|
|
// an opaque value. It also holds secrets the provider handed out itself,
|
|
// such as the DSM device token, which no form can re-enter. Left out of a
|
|
// rotation, every trip binding on the instance reads back as unauthorized
|
|
// and Synology needs a fresh OTP pairing. The table arrived with a later
|
|
// migration, hence the existence check.
|
|
if (tableExists('document_connections')) {
|
|
const documentConnections = db
|
|
.prepare('SELECT id, secrets FROM document_connections WHERE secrets IS NOT NULL')
|
|
.all() as { id: number; secrets: string }[];
|
|
for (const row of documentConnections) {
|
|
const newVal = migrateApiKeyValue(row.secrets, `document_connections[${row.id}].secrets`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE document_connections SET secrets = ? WHERE id = ?').run(newVal, row.id);
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- trip_document_links: webhook_secret ---
|
|
// The secret a provider signs its webhook calls with, stored through the
|
|
// same blob helper. It is written once when the link is created and never
|
|
// regenerated, so a rotation that misses it leaves the link with nothing to
|
|
// check a signature against.
|
|
if (tableExists('trip_document_links')) {
|
|
const documentLinks = db
|
|
.prepare('SELECT id, webhook_secret FROM trip_document_links WHERE webhook_secret IS NOT NULL')
|
|
.all() as { id: number; webhook_secret: string }[];
|
|
for (const row of documentLinks) {
|
|
const newVal = migrateApiKeyValue(row.webhook_secret, `trip_document_links[${row.id}].webhook_secret`);
|
|
if (newVal !== null) {
|
|
db.prepare('UPDATE trip_document_links SET webhook_secret = ? WHERE id = ?').run(newVal, row.id);
|
|
}
|
|
}
|
|
}
|
|
})();
|
|
|
|
db.close();
|
|
rl.close();
|
|
|
|
console.log('\n=== Migration complete ===');
|
|
console.log(` Migrated: ${result.migrated}`);
|
|
console.log(` Already on new key: ${result.alreadyMigrated}`);
|
|
console.log(` Skipped (empty): ${result.skipped}`);
|
|
if (result.errors.length > 0) {
|
|
console.warn(` Errors: ${result.errors.length}`);
|
|
result.errors.forEach((e) => console.warn(` - ${e}`));
|
|
console.warn('\nSome secrets could not be migrated. Check the errors above.');
|
|
console.warn(`Your original database is backed up at: ${backupPath}`);
|
|
process.exit(1);
|
|
} else {
|
|
console.log('\nAll secrets successfully re-encrypted.');
|
|
// The server refuses to start when ENCRYPTION_KEY and the key file disagree
|
|
// (src/config.ts), so the file follows the rotation. Only an existing file
|
|
// next to the database is touched; anything else is left to the operator.
|
|
const keyFile = path.join(path.dirname(dbPath), '.encryption_key');
|
|
if (fs.existsSync(keyFile)) {
|
|
fs.writeFileSync(keyFile, newKey, { mode: 0o600 });
|
|
console.log(`Key file updated: ${keyFile}`);
|
|
} else {
|
|
console.log(
|
|
'No key file next to the database. Store the new key wherever TREK reads it from (ENCRYPTION_KEY or data/.encryption_key).',
|
|
);
|
|
}
|
|
console.log(`Backup retained at: ${backupPath}`);
|
|
}
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error('Unexpected error:', err);
|
|
process.exit(1);
|
|
});
|