mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André BombeckandClaude Opus 4.7
7dc9dbaa44
`scripts/rotate-encryption-key.ts` enumerated columns manually and predated three of them: - `User.aiOpenaiKeyEncrypted` (`prisma/schema.prisma:86`, added in v1.4.3 alongside the other AI provider keys but never threaded into the rotation list). - `IntegrationStatus.lastError` (`prisma/schema.prisma:1441`) — the AES-256-GCM ciphertext of upstream error payloads from the Withings / moodLog sync paths. Skipped on rotation, every row stayed on whichever key wrote it. - `CoachMessage.encryptedContent` (`prisma/schema.prisma:1983`) — the only `Bytes` column in the encrypted set, so it needed a Buffer round-trip rather than the standard string path. Mirrors the `encryptToBytes` / `decryptFromBytes` pattern at `src/lib/ai/coach/persistence.ts:60-71`. Without these three, the documented rotation flow ends with the operator removing `v1` from `ENCRYPTION_KEYS` while rows still live on the legacy key — and the next read of an affected row throws, breaking AI Settings, the integration-status panel, or the Coach history page depending on which column was missed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>