Hash remoteStorage access tokens at rest #262

2026-11-04T05:34:18Z

raucao commented

2026-11-04 05:34:18 +00:00

Hashes remoteStorage access tokens at rest (ref #259, part of #254).

New token_digest column with a unique index on remote_storage_authorizations; the model keeps the plaintext in an in-memory accessor and stores only SHA256(token).
Redis authorization keys become authorizations:<cn>:<digest>.
New idempotent rs:rekey_tokens task backfills missing digests, re-keys existing authorizations from the plaintext to the digest form, and sweeps leftover plaintext keys.
Revocation and expiry delete by digest, falling back to the persisted plaintext while the legacy column still exists.

This is the expand half of an expand/contract rollout: the plaintext token column is intentionally kept so the old code can keep running during the deploy. A follow-up PR will drop it once rs:rekey_tokens reports a clean sweep.

Deploy order, together with the Liquor Cabinet PR: enable LC's RS_HASHED_ACCESS_TOKENS, deploy this, run rs:rekey_tokens, then ship the contract migration and later retire LC's plaintext fallback.

Tests: the remoteStorage model/service/job/controller specs pass (91 examples, 0 failures).

Hashes remoteStorage access tokens at rest (ref #259, part of #254). - New `token_digest` column with a unique index on `remote_storage_authorizations`; the model keeps the plaintext in an in-memory accessor and stores only `SHA256(token)`. - Redis authorization keys become `authorizations:<cn>:<digest>`. - New idempotent `rs:rekey_tokens` task backfills missing digests, re-keys existing authorizations from the plaintext to the digest form, and sweeps leftover plaintext keys. - Revocation and expiry delete by digest, falling back to the persisted plaintext while the legacy column still exists. This is the expand half of an expand/contract rollout: the plaintext `token` column is intentionally kept so the old code can keep running during the deploy. A follow-up PR will drop it once `rs:rekey_tokens` reports a clean sweep. Deploy order, together with the Liquor Cabinet PR: enable LC's `RS_HASHED_ACCESS_TOKENS`, deploy this, run `rs:rekey_tokens`, then ship the contract migration and later retire LC's plaintext fallback. Tests: the remoteStorage model/service/job/controller specs pass (91 examples, 0 failures).

raucao added 1 commit 2026-11-04 05:34:18 +00:00

Hash remoteStorage access tokens at rest

CI / Test (pull_request) Successful in 45s

Details

Release Drafter / Update release notes draft (pull_request) Successful in 4s

Details

4bca003983

Store only SHA256(token) in a new token_digest column and use the digest for the Redis authorization keys instead of the plaintext token. The plaintext is now held in memory only for issuance.

This is the expand step: the plaintext token column stays in place so the old code can keep running during the deploy. A follow-up migration will drop it once rs:rekey_tokens has re-keyed Redis and confirmed no plaintext keys remain.

Refs #259

raucao added the enhancement security

integration

remotestorage

labels 2026-11-04 05:42:15 +00:00

raucao added the kredits-1 label 2026-11-04 05:44:42 +00:00

raucao merged commit 71b44a0453 into master

2026-11-04 09:49:56 +00:00

raucao deleted branch feature/hashed_rs_access_tokens

2026-11-04 09:49:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/akkounts#262