feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill

2026-03-30 00:17:04 +02:00
parent e5be55e141
commit a02ef68a70
11 changed files with 434 additions and 13 deletions
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -242,6 +242,7 @@ pub struct UseragentClient {
    pub id: i32,
    pub nonce: i32,
    pub public_key: Vec<u8>,
+    pub pubkey_integrity_tag: Option<Vec<u8>>,
    pub created_at: SqliteTimestamp,
    pub updated_at: SqliteTimestamp,
    pub key_type: KeyType,