enc1 said what a value was but not where it belonged. The blob in one
user's nextcloud_token would decrypt perfectly if copied onto another
user's row, and that account's exports would then go into someone else's
storage. Nothing about the ciphertext objected.
Adds enc2, which binds a context string — 'users:nextcloud_token:41' —
as AES-GCM additional authenticated data. The auth tag covers it, so a
moved ciphertext fails to open rather than opening somewhere wrong. The
context is authenticated, not encrypted: it is not a secret, it is a
claim about location.
enc1 is still read, unchanged and forever — every existing row is enc1.
Bound rows are distinguishable (isBound), so the Nextcloud token is
rebound in place the next time it is successfully used, the same way a
legacy plaintext one was already upgraded. That gate moved from
isEncrypted to isBound; isEncrypted is true for enc1, so it would have
skipped exactly the rows that need rebinding.
Bound so far: Nextcloud app passwords, and invite codes — which bind to
their own code_hash, since unlike the row id that exists at INSERT time.
Decrypting an invite moved into list(), so the cipher and the hash that
opens it no longer leave the module together.
Mutation-tested: dropping the AAD, dropping the guard, gating on
isEncrypted, or dropping a context at a call site each fail a test.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
A .pptx landing in someone's own storage is worth having; a markdown blob is
not, and it is not what they would have downloaded. So this renders through
exactly the path the download uses — stored deck, its figures, the chosen
theme — and PUTs the bytes. The file never travels through the browser.
Offered only when a Nextcloud is connected: an action that always fails is
worse than one that is not offered. An article offers Word, a deck PowerPoint,
and asking for slides from an article is refused with the reason.
Putting a file in Nextcloud now lives in src/utils/nextcloudFiles.js. Two
callers want it and neither should grow its own copy of the WebDAV dance — make
the dated folder a segment at a time, PUT, migrate a legacy plaintext token —
because it reaches into storage that is not ours and a second slightly
different copy is how the two drift. It also replaces a route importing another
route.
Also: a model that leaves the roster now leaves every list that names it.
clinical_assistant.allowed_models and the image roster are advisory copies of
the roster, and a stale id there was invisible until someone asked a clinical
question and the request failed at the gateway. Removing or disabling a model
prunes it; clearing the roster clears them. Re-enabling deliberately does not
re-allow it — that is a separate decision.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
