Jeroen UbbinkandClaude Opus 4.8 eb6a612e5a fix(secrets): make nsec ownership explicit and claim the admin password atomically ...

Two bootstrap-correctness fixes on the encrypted Secret store:

- Track nsec ownership with an explicit nsec_state (legacy | encrypted |
  cleared) instead of a nsec_managed bool. The bool could not tell "never
  migrated" apart from "intentionally cleared" — both leave encrypted_nsec
  empty — so a cleared identity could be resurrected on a fresh process from a
  stale legacy NSEC (env or old settings blob) and re-derive its npub. Bootstrap
  now branches purely on the state: encrypted decrypts (a missing ciphertext is
  a fail-fast inconsistency, never a silent fall-through to legacy), cleared
  actively empties the live nsec and npub, and legacy imports the plaintext
  once.
- Claim a generated admin password atomically. When no password exists, the
  generated one is written via a conditional UPDATE (WHERE admin_password_hash
  IS NULL) and only the worker that wins the update (rowcount 1) prints it. A
  racing worker on a shared database adopts the winner's hash and stays silent,
  so the operator never sees a second password that was never stored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-23 10:51:21 +02:00

..

versions

fix(secrets): make nsec ownership explicit and claim the admin password atomically

2026-07-23 10:51:21 +02:00

env.py

ruff fmt

2025-08-23 17:01:28 -03:00

script.py.mako

auto run migrations on startup

2025-08-09 13:50:05 -03:00