Simpler migration, no support for dev versions.

paskia/db/migrations.py

@@ -8,7 +8,7 @@ Each migration should be idempotent and only run when needed.
 import base64
 from collections.abc import Awaitable, Callable
 
-from paskia.util.crypto import hash_secret, secret_key
+from paskia.util.crypto import secret_key
 
 
 def migrate_v1(d: dict, **kwargs) -> None:
@@ -31,23 +31,10 @@ def migrate_v3(d: dict, **kwargs) -> None:
 
 def migrate_v4(d: dict, **kwargs) -> None:
     """OpenID Connect support and hardened session keys."""
-    # Migrate existing oid_clients and oidc_key if present (from old format)
-    existing_clients = d.pop("oid_clients", {})
-    existing_key = d.pop("oidc_key", None)
-    # Create OIDC structure
-    d["oidc"] = {"clients": existing_clients, "key": existing_key}
-    # Generate OIDC signing key if not present
-    if d["oidc"]["key"] is None:
-        key_bytes = secret_key()
-        d["oidc"]["key"] = base64.standard_b64encode(key_bytes).decode()
-    elif isinstance(d["oidc"]["key"], bytes):
-        # Existing key is bytes, encode to base64 string
-        d["oidc"]["key"] = base64.standard_b64encode(d["oidc"]["key"]).decode()
-    # Migrate sessions
-    d["sessions"] = {
-        base64.standard_b64encode(hash_secret("cookie", k)).decode(): v
-        for k, v in d["sessions"].items()
-    }
+    # Session keys changed to hashes, drop old sessions
+    d["sessions"] = {}
+    # Create OIDC structure with a generated new key
+    d["oidc"] = {"clients": {}, "key": base64.standard_b64encode(secret_key()).decode()}
 
 
 migrations = sorted(