From 3a7ba09dddb4f1f0015ad08ac6b787423cd899bd Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Wed, 9 Sep 2026 17:35:04 +0000
Subject: [PATCH] Fix legacy conversion dropping 'empty origins = allow all'
 when an auth host was set

The **.{rp-id} wildcard was only added when the resulting origins dict
was empty, so a legacy database with a dedicated auth host but no
configured origins ended up allowing only the auth host.
---
 paskia/db/legacy.py   |  5 +++--
 tests/test_domains.py | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/paskia/db/legacy.py b/paskia/db/legacy.py
index 5f3d75a..eacd2da 100644
--- a/paskia/db/legacy.py
+++ b/paskia/db/legacy.py
@@ -128,9 +128,10 @@ def _legacy_to_db(old: LegacyDB) -> DB:
         origins[origin_key(origin)] = True
     if old.config.auth_host:
         origins[origin_key(old.config.auth_host)] = OriginEntry(auth_host=True)
-    if not origins:
+    if not old.config.origins:
         # Legacy semantics: no origins configured = the whole rp-id domain
-        # allowed. The new format requires explicit entries.
+        # allowed, regardless of a dedicated auth host. The new format
+        # requires explicit entries.
         origins[f"**.{rp_id}"] = True
 
     new_config = Config(
diff --git a/tests/test_domains.py b/tests/test_domains.py
index 3517eae..b0ebbf3 100644
--- a/tests/test_domains.py
+++ b/tests/test_domains.py
@@ -941,6 +941,22 @@ class TestLegacyConversion:
         config = convert_legacy_database(src_file, tmp_path / "paskia.kantadb")
         assert config.domains["example.com"].origins == {"**.example.com": True}
 
+    def test_convert_auth_host_with_empty_origins_keeps_wildcard(self, tmp_path):
+        """A dedicated auth host with no configured origins still allowed
+        the whole rp-id domain in the legacy format — the auth host must
+        not become the only allowed origin."""
+        src_file = tmp_path / "main.db"
+        asyncio.run(
+            _write_legacy(
+                src_file,
+                LegacyConfig(rp_id="example.com", auth_host="auth.example.com"),
+            )
+        )
+        config = convert_legacy_database(src_file, tmp_path / "paskia.kantadb")
+        origins = config.domains["example.com"].origins
+        assert origins["**.example.com"] is True
+        assert origins["auth.example.com"] == OriginEntry(auth_host=True)
+
 
 # -------------------------------------------------------------------------
 # Transaction log censoring