Rogeeandrogee
f719529d66
* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
11 lines
979 B
Markdown
11 lines
979 B
Markdown
## Sensitive-field key rotation
|
|
|
|
1. Keep the old key under `encryption.previous_keys.<old-version>`.
|
|
2. Set a new `encryption.current_key_version` and `encryption.aes_key`, then restart GoChat. New writes immediately use the new key; reads accept both.
|
|
3. Back up PostgreSQL, then run `cd backend && GOCHAT_ENV=prod go run ./cmd/rotate_secrets`.
|
|
4. Verify normal channel, webhook and integration traffic. Remove the old key only after every application and worker instance runs the new version.
|
|
|
|
The rotation command includes WhatsApp `provider_config` together with the channel access and webhook credentials.
|
|
|
|
Configuration rollback: restore the previous key version/key as current while retaining the new key in `previous_keys`, then restart all instances. The schema rollback does not narrow ciphertext-bearing columns. Rolling back to a binary that predates encrypted-field support requires restoring the pre-rotation database backup; that binary cannot decrypt ciphertext.
|