paskia/db/migrations.py

@@ -5,8 +5,11 @@ Migrations are applied during database load based on the version field.
 Each migration should be idempotent and only run when needed.
 """
 
+import base64
 from collections.abc import Awaitable, Callable
 
+from paskia.util.crypto import hash_secret
+
 
 def migrate_v1(d: dict, **kwargs) -> None:
     """Remove Org.created_at fields."""
@@ -20,6 +23,15 @@ def migrate_v2(d: dict, *, rp_id: str = "localhost") -> None:
         d["config"] = {"rp_id": rp_id}
 
 
+def migrate_v3(d: dict, **kwargs) -> None:
+    """OpenID Connect support and hardened session keys."""
+    d["oid_clients"] = {}
+    d["sessions"] = {
+        base64.standard_b64encode(hash_secret("cookie", k)).decode(): v
+        for k, v in d["sessions"].items()
+    }
+
+
 migrations = sorted(
     [f for n, f in globals().items() if n.startswith("migrate_v")],
     key=lambda f: int(f.__name__.removeprefix("migrate_v")),