mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
cf85dce89f
The published privacy policy states that IP addresses are retained only as a salted one-way hash for rate limiting. That was true of the login-event path but not of sessions.ip_address or audit_logs.ip_address, both of which stored a raw client IP tied to user_id on every login. Drop both columns and all writer/model code, so the schema enforces the policy rather than relying on convention. The hashed rate-limit path (login_events, restore_attempts) is unchanged and remains the only IP retention. Also drops the `wallets` table, which was created in the initial schema and never read or written: a latent user_id -> address / view_key store. The operator forensic trail (admin_audit_logs, admin_sessions) deliberately keeps its raw IP. Privileged-action forensics is a different threat model and is not covered by the user-facing claim.