commit 5d95d7f3e7c9d6ee733439d69ec3cfc278d9592a · bretton.dev/coves

+39

internal/db/migrations/006_encrypt_community_credentials.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Enable pgcrypto extension for encryption at rest

     

       3
       3
       +
       CREATE EXTENSION IF NOT EXISTS pgcrypto;

     

       4
       4
       +
       

     

       5
       5
       +
       -- Create encryption key table (single-row config table)

     

       6
       6
       +
       -- SECURITY: In production, use environment variable or external key management

     

       7
       7
       +
       CREATE TABLE encryption_keys (

     

       8
       8
       +
           id INTEGER PRIMARY KEY CHECK (id = 1),

     

       9
       9
       +
           key_data BYTEA NOT NULL,

     

       10
       10
       +
           created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,

     

       11
       11
       +
           rotated_at TIMESTAMP WITH TIME ZONE

     

       12
       12
       +
       );

     

       13
       13
       +
       

     

       14
       14
       +
       -- Insert default encryption key

     

       15
       15
       +
       INSERT INTO encryption_keys (id, key_data)

     

       16
       16
       +
       VALUES (1, gen_random_bytes(32))

     

       17
       17
       +
       ON CONFLICT (id) DO NOTHING;

     

       18
       18
       +
       

     

       19
       19
       +
       -- Add encrypted columns

     

       20
       20
       +
       ALTER TABLE communities

     

       21
       21
       +
           ADD COLUMN pds_access_token_encrypted BYTEA,

     

       22
       22
       +
           ADD COLUMN pds_refresh_token_encrypted BYTEA;

     

       23
       23
       +
       

     

       24
       24
       +
       -- Add index for communities with credentials

     

       25
       25
       +
       CREATE INDEX idx_communities_encrypted_tokens ON communities(did) WHERE pds_access_token_encrypted IS NOT NULL;

     

       26
       26
       +
       

     

       27
       27
       +
       -- Security comments

     

       28
       28
       +
       COMMENT ON TABLE encryption_keys IS 'Encryption keys for sensitive data - RESTRICT ACCESS';

     

       29
       29
       +
       COMMENT ON COLUMN communities.pds_access_token_encrypted IS 'Encrypted JWT - decrypt with pgp_sym_decrypt';

     

       30
       30
       +
       COMMENT ON COLUMN communities.pds_refresh_token_encrypted IS 'Encrypted refresh token - decrypt with pgp_sym_decrypt';

     

       31
       31
       +
       

     

       32
       32
       +
       -- +goose Down

     

       33
       33
       +
       DROP INDEX IF EXISTS idx_communities_encrypted_tokens;

     

       34
       34
       +
       

     

       35
       35
       +
       ALTER TABLE communities

     

       36
       36
       +
           DROP COLUMN IF EXISTS pds_access_token_encrypted,

     

       37
       37
       +
           DROP COLUMN IF EXISTS pds_refresh_token_encrypted;

     

       38
       38
       +
       

     

       39
       39
       +
       DROP TABLE IF EXISTS encryption_keys;

+29 -2

internal/db/postgres/community_repo.go

···

       25
       25
        
       		INSERT INTO communities (

     

       26
       26
        
       			did, handle, name, display_name, description, description_facets,

     

       27
       27
        
       			avatar_cid, banner_cid, owner_did, created_by_did, hosted_by_did,

     

       28
       28
       +
       			pds_email, pds_password_hash,

     

       29
       29
       +
       			pds_access_token_encrypted, pds_refresh_token_encrypted, pds_url,

     

       28
       30
        
       			visibility, allow_external_discovery, moderation_type, content_warnings,

     

       29
       31
        
       			member_count, subscriber_count, post_count,

     

       30
       32
        
       			federated_from, federated_id, created_at, updated_at,

     

       31
       33
        
       			record_uri, record_cid

     

       32
       34
        
       		) VALUES (

     

       33
       33
       -
       			$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,

     

       34
       34
       -
       			$16, $17, $18, $19, $20, $21, $22, $23, $24

     

       35
       35
       +
       			$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11,

     

       36
       36
       +
       			$12, $13,

     

       37
       37
       +
       			CASE WHEN $14 != '' THEN pgp_sym_encrypt($14, (SELECT encode(key_data, 'hex') FROM encryption_keys WHERE id = 1)) ELSE NULL END,

     

       38
       38
       +
       			CASE WHEN $15 != '' THEN pgp_sym_encrypt($15, (SELECT encode(key_data, 'hex') FROM encryption_keys WHERE id = 1)) ELSE NULL END,

     

       39
       39
       +
       			$16,

     

       40
       40
       +
       			$17, $18, $19, $20,

     

       41
       41
       +
       			$21, $22, $23, $24, $25, $26, $27, $28, $29

     

       35
       42
        
       		)

     

       36
       43
        
       		RETURNING id, created_at, updated_at`

     

       37
       44
        
       

     
···

       55
       62
        
       		community.OwnerDID,

     

       56
       63
        
       		community.CreatedByDID,

     

       57
       64
        
       		community.HostedByDID,

     

       65
       65
       +
       		// V2: PDS credentials for community account

     

       66
       66
       +
       		nullString(community.PDSEmail),

     

       67
       67
       +
       		nullString(community.PDSPasswordHash),

     

       68
       68
       +
       		nullString(community.PDSAccessToken),

     

       69
       69
       +
       		nullString(community.PDSRefreshToken),

     

       70
       70
       +
       		nullString(community.PDSURL),

     

       58
       71
        
       		community.Visibility,

     

       59
       72
        
       		community.AllowExternalDiscovery,

     

       60
       73
        
       		nullString(community.ModerationType),

     
···

       87
       100
        
       }

     

       88
       101
        
       

     

       89
       102
        
       // GetByDID retrieves a community by its DID

     

       103
       103
       +
       // Note: PDS credentials are included (for internal service use only)

     

       104
       104
       +
       // Handlers MUST use json:"-" tags to prevent credential exposure in APIs

     

       90
       105
        
       func (r *postgresCommunityRepo) GetByDID(ctx context.Context, did string) (*communities.Community, error) {

     

       91
       106
        
       	community := &communities.Community{}

     

       92
       107
        
       	query := `

     

       93
       108
        
       		SELECT id, did, handle, name, display_name, description, description_facets,

     

       94
       109
        
       			avatar_cid, banner_cid, owner_did, created_by_did, hosted_by_did,

     

       110
       110
       +
       			pds_email, pds_password_hash,

     

       111
       111
       +
       			COALESCE(pgp_sym_decrypt(pds_access_token_encrypted, (SELECT encode(key_data, 'hex') FROM encryption_keys WHERE id = 1)), '') as pds_access_token,

     

       112
       112
       +
       			COALESCE(pgp_sym_decrypt(pds_refresh_token_encrypted, (SELECT encode(key_data, 'hex') FROM encryption_keys WHERE id = 1)), '') as pds_refresh_token,

     

       113
       113
       +
       			pds_url,

     

       95
       114
        
       			visibility, allow_external_discovery, moderation_type, content_warnings,

     

       96
       115
        
       			member_count, subscriber_count, post_count,

     

       97
       116
        
       			federated_from, federated_id, created_at, updated_at,

     
···

       101
       120
        
       

     

       102
       121
        
       	var displayName, description, avatarCID, bannerCID, moderationType sql.NullString

     

       103
       122
        
       	var federatedFrom, federatedID, recordURI, recordCID sql.NullString

     

       123
       123
       +
       	var pdsEmail, pdsPasswordHash, pdsAccessToken, pdsRefreshToken, pdsURL sql.NullString

     

       104
       124
        
       	var descFacets []byte

     

       105
       125
        
       	var contentWarnings []string

     

       106
       126
        
       

     
···

       109
       129
        
       		&displayName, &description, &descFacets,

     

       110
       130
        
       		&avatarCID, &bannerCID,

     

       111
       131
        
       		&community.OwnerDID, &community.CreatedByDID, &community.HostedByDID,

     

       132
       132
       +
       		// V2: PDS credentials

     

       133
       133
       +
       		&pdsEmail, &pdsPasswordHash, &pdsAccessToken, &pdsRefreshToken, &pdsURL,

     

       112
       134
        
       		&community.Visibility, &community.AllowExternalDiscovery,

     

       113
       135
        
       		&moderationType, pq.Array(&contentWarnings),

     

       114
       136
        
       		&community.MemberCount, &community.SubscriberCount, &community.PostCount,

     
···

       129
       151
        
       	community.Description = description.String

     

       130
       152
        
       	community.AvatarCID = avatarCID.String

     

       131
       153
        
       	community.BannerCID = bannerCID.String

     

       154
       154
       +
       	community.PDSEmail = pdsEmail.String

     

       155
       155
       +
       	community.PDSPasswordHash = pdsPasswordHash.String

     

       156
       156
       +
       	community.PDSAccessToken = pdsAccessToken.String

     

       157
       157
       +
       	community.PDSRefreshToken = pdsRefreshToken.String

     

       158
       158
       +
       	community.PDSURL = pdsURL.String

     

       132
       159
        
       	community.ModerationType = moderationType.String

     

       133
       160
        
       	community.ContentWarnings = contentWarnings

     

       134
       161
        
       	community.FederatedFrom = federatedFrom.String