mirror of
https://github.com/Routstr/routstr-core.git
synced 2026-08-09 02:54:37 +00:00
Jeroen UbbinkandClaude Opus 4.8
eb6a612e5a
Two bootstrap-correctness fixes on the encrypted Secret store: - Track nsec ownership with an explicit nsec_state (legacy | encrypted | cleared) instead of a nsec_managed bool. The bool could not tell "never migrated" apart from "intentionally cleared" — both leave encrypted_nsec empty — so a cleared identity could be resurrected on a fresh process from a stale legacy NSEC (env or old settings blob) and re-derive its npub. Bootstrap now branches purely on the state: encrypted decrypts (a missing ciphertext is a fail-fast inconsistency, never a silent fall-through to legacy), cleared actively empties the live nsec and npub, and legacy imports the plaintext once. - Claim a generated admin password atomically. When no password exists, the generated one is written via a conditional UPDATE (WHERE admin_password_hash IS NULL) and only the worker that wins the update (rowcount 1) prints it. A racing worker on a shared database adopts the winner's hash and stays silent, so the operator never sees a second password that was never stored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>