webgrip/unfold
5
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases 56 Packages 8 Wiki Activity Actions 2

fix(unfold): carry the database's encryption key when adopting the former name #237

Merged
ryangr0 merged 1 commit from ryangr0/fix/adopt-database-key into development 2026-10-04 20:21:16 +00:00 AGit
Conversation 0 Commits 1 Files changed 2 +17 -2
ryangr0 commented 2026-10-04 20:19:58 +00:00
Owner
Copy link

Blocks the homelab switch to rc.39. When an install upgrades from the Vloer era, adoptRenamedDatabase renames vloer.sqlite (with -wal and -shm) to unfold.sqlite, but it left vloer.sqlite.key behind. Store then found no unfold.sqlite.key and generated a new random key. Every secret encrypted before the rename stopped decrypting (Unsupported state or unable to authenticate data). Today those secrets are the VS Code editor sign-in tokens (ahp-token:*).

The homelab data directory has exactly these files: vloer.sqlite, -wal, -shm and vloer.sqlite.key. Production has not run rc.39 yet.

The fix adds .key to the files that move together. A new test writes a secret through a real Store under the former name, adopts it and reads the secret back. Without the fix it fails with the error above; with the fix it passes.

Verified: npm run check, npm test (751 pass, 0 fail).

I introduced this in #223.

🤖 Generated with Claude Code

**Blocks the homelab switch to rc.39.** When an install upgrades from the Vloer era, `adoptRenamedDatabase` renames `vloer.sqlite` (with `-wal` and `-shm`) to `unfold.sqlite`, but it left `vloer.sqlite.key` behind. `Store` then found no `unfold.sqlite.key` and generated a new random key. Every secret encrypted before the rename stopped decrypting (`Unsupported state or unable to authenticate data`). Today those secrets are the VS Code editor sign-in tokens (`ahp-token:*`). The homelab data directory has exactly these files: `vloer.sqlite`, `-wal`, `-shm` and `vloer.sqlite.key`. Production has not run rc.39 yet. The fix adds `.key` to the files that move together. A new test writes a secret through a real `Store` under the former name, adopts it and reads the secret back. Without the fix it fails with the error above; with the fix it passes. Verified: `npm run check`, `npm test` (751 pass, 0 fail). I introduced this in #223. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(unfold): carry the database's encryption key when adopting the former name
Some checks failed
[Workflow] On Pull Request / checks (pull_request) Has been cancelled
Details
[Workflow] On Pull Request / warnings (pull_request) Has been cancelled
Details
[Workflow] On Pull Request / ploeg-pin (pull_request) Has been cancelled
Details
[Workflow] On Pull Request / release-policy (pull_request) Has been cancelled
Details
29513d9c09
 
adoptRenamedDatabase moved vloer.sqlite with its -wal and -shm files but
left vloer.sqlite.key behind. The Store then generated a new key for
unfold.sqlite, and every secret written before the rename (editor
sign-in tokens) failed to decrypt. The homelab install has that key file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ryangr0 merged commit 281bfcb354 into development 2026-10-04 20:21:16 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/unfold!237
No description provided.