kevinveenbirkenbachandClaude Opus 5.5 0a6b6f9130 fix(web-app-bluesky): reset a stored app-password the rotated key cannot decrypt ...

The login-broker keeps each user's PDS app-password in BROKER_STORE_PATH, encrypted with BLUESKY_BRIDGE_ENCRYPTION_KEY (aadc96561b). A credential rotation changes that key while the broker_data volume keeps the old ciphertext, so decrypt() threw "Unsupported state or unable to authenticate data" inside sessionFor. storedSession recovered only from the PDS answer "Invalid identifier or password", so every handoff after the rotation answered a 62-byte 500.

storedPassword() now returns null when the entry does not decrypt, and storedSession takes the existing admin-reset path by DID for it: updateAccountPassword, then the new password is stored encrypted with the current key. Account, handle and posts stay; every other PDS error still fails. The README's failure list describes the new recovery.

Found by the store-i18n lane in CI run 40979252521 (Bluesky#0): PASS 1 green, 65 values rotated, then 30 decrypt errors in the broker log and the handoff spec red in PASS 2. A new node test restarts the broker with a rotated key and expects one reset by DID, no new account and no second reset; it fails against the old storedSession, and all 22 broker tests pass with the fix.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-30 08:42:30 +01:00

..

roles

fix(web-app-bluesky): reset a stored app-password the rotated key cannot decrypt

2026-10-30 08:42:30 +01:00