feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill

2026-03-30 00:17:04 +02:00
parent e5be55e141
commit a02ef68a70
11 changed files with 434 additions and 13 deletions
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -178,6 +178,7 @@ diesel::table! {
        id -> Integer,
        nonce -> Integer,
        public_key -> Binary,
+        pubkey_integrity_tag -> Nullable<Binary>,
        key_type -> Integer,
        created_at -> Integer,
        updated_at -> Integer,