tiku-backend.net/Tiku.Infrastructure/Persistence/Migrations/20260727062859_EncryptTenantSecretPayloads.cs

using System.Text.Json;
using Microsoft.EntityFrameworkCore.Migrations;

#nullable disable

namespace Tiku.Infrastructure.Persistence.Migrations
{
    /// <inheritdoc />
    public partial class EncryptTenantSecretPayloads : Migration
    {
        /// <inheritdoc />
        protected override void Up(MigrationBuilder migrationBuilder)
        {
            migrationBuilder.DropColumn(
                name: "secret_payload",
                table: "tenant_secrets");

            migrationBuilder.AddColumn<byte[]>(
                name: "encrypted_payload",
                table: "tenant_secrets",
                type: "bytea",
                nullable: false,
                defaultValue: new byte[0]);

            migrationBuilder.AddColumn<string>(
                name: "encryption_key_id",
                table: "tenant_secrets",
                type: "character varying(100)",
                maxLength: 100,
                nullable: false,
                defaultValue: "");

            migrationBuilder.AddColumn<byte[]>(
                name: "encryption_nonce",
                table: "tenant_secrets",
                type: "bytea",
                nullable: false,
                defaultValue: new byte[0]);

            migrationBuilder.AddColumn<byte[]>(
                name: "encryption_tag",
                table: "tenant_secrets",
                type: "bytea",
                nullable: false,
                defaultValue: new byte[0]);

            migrationBuilder.AddCheckConstraint(
                name: "ck_tenant_secrets_encryption_envelope",
                table: "tenant_secrets",
                sql: "octet_length(encrypted_payload) > 0 and octet_length(encryption_nonce) = 12 and octet_length(encryption_tag) = 16 and encryption_key_id <> ''");
        }

        /// <inheritdoc />
        protected override void Down(MigrationBuilder migrationBuilder)
        {
            migrationBuilder.DropCheckConstraint(
                name: "ck_tenant_secrets_encryption_envelope",
                table: "tenant_secrets");

            migrationBuilder.DropColumn(
                name: "encrypted_payload",
                table: "tenant_secrets");

            migrationBuilder.DropColumn(
                name: "encryption_key_id",
                table: "tenant_secrets");

            migrationBuilder.DropColumn(
                name: "encryption_nonce",
                table: "tenant_secrets");

            migrationBuilder.DropColumn(
                name: "encryption_tag",
                table: "tenant_secrets");

            migrationBuilder.AddColumn<JsonElement>(
                name: "secret_payload",
                table: "tenant_secrets",
                type: "jsonb",
                nullable: false,
                defaultValueSql: "'{}'::jsonb");
        }
    }
}