From d653a1db355f7259f80c47b6ae6affc739091987 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Sun, 15 Feb 2026 21:10:10 +0000
Subject: [PATCH] Database migration to add OIDC and convert to hardened
 sessions.

---
 paskia/db/migrations.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/paskia/db/migrations.py b/paskia/db/migrations.py
index 570e380..ddba29b 100644
--- a/paskia/db/migrations.py
+++ b/paskia/db/migrations.py
@@ -5,8 +5,11 @@ Migrations are applied during database load based on the version field.
 Each migration should be idempotent and only run when needed.
 """
 
+import base64
 from collections.abc import Awaitable, Callable
 
+from paskia.util.crypto import hash_secret
+
 
 def migrate_v1(d: dict, **kwargs) -> None:
     """Remove Org.created_at fields."""
@@ -20,6 +23,15 @@ def migrate_v2(d: dict, *, rp_id: str = "localhost") -> None:
         d["config"] = {"rp_id": rp_id}
 
 
+def migrate_v3(d: dict, **kwargs) -> None:
+    """OpenID Connect support and hardened session keys."""
+    d["oid_clients"] = {}
+    d["sessions"] = {
+        base64.standard_b64encode(hash_secret("cookie", k)).decode(): v
+        for k, v in d["sessions"].items()
+    }
+
+
 migrations = sorted(
     [f for n, f in globals().items() if n.startswith("migrate_v")],
     key=lambda f: int(f.__name__.removeprefix("migrate_v")),