mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
jwinterm
cf85dce89f
The published privacy policy states that IP addresses are retained only as a salted one-way hash for rate limiting. That was true of the login-event path but not of sessions.ip_address or audit_logs.ip_address, both of which stored a raw client IP tied to user_id on every login. Drop both columns and all writer/model code, so the schema enforces the policy rather than relying on convention. The hashed rate-limit path (login_events, restore_attempts) is unchanged and remains the only IP retention. Also drops the `wallets` table, which was created in the initial schema and never read or written: a latent user_id -> address / view_key store. The operator forensic trail (admin_audit_logs, admin_sessions) deliberately keeps its raw IP. Privileged-action forensics is a different threat model and is not covered by the user-facing claim.
23 lines
1.3 KiB
SQL
23 lines
1.3 KiB
SQL
-- Privacy hardening: drop raw-IP PII columns and a dead table.
|
|
--
|
|
-- Rationale: the published privacy policy (smirk.cash/privacy, PRIVACY.md) states
|
|
-- that IP addresses are retained ONLY as a salted one-way hash (for rate limiting,
|
|
-- via login_events / restore_attempts). These columns instead stored a RAW client
|
|
-- IP tied to user_id, contradicting that promise. Dropping them makes the schema
|
|
-- enforce the policy. The hashed rate-limit path (login_events.ip_hash) is untouched.
|
|
--
|
|
-- The operator forensic trail (admin_audit_logs, admin_sessions) is intentionally
|
|
-- left as-is: a tamper-evident record of privileged actions is a different threat
|
|
-- model from end-user data and is covered separately.
|
|
|
|
-- 1. sessions.ip_address — was written raw on every user login (extension + web).
|
|
ALTER TABLE sessions DROP COLUMN IF EXISTS ip_address;
|
|
|
|
-- 2. audit_logs.ip_address — raw-IP column on the (currently unwired) user audit
|
|
-- table. If security logging is wired up later, hash the IP like login_events.
|
|
ALTER TABLE audit_logs DROP COLUMN IF EXISTS ip_address;
|
|
|
|
-- 3. Dead `wallets` table — created in the initial schema but never read or written
|
|
-- by any code path (a latent user_id -> address / view_key PII store). Remove it.
|
|
DROP TABLE IF EXISTS wallets;
|