From 0ac140bf51c0db49e8a7b84245f186318d0eebcd Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Tue, 31 Mar 2026 20:40:06 +0200
Subject: [PATCH] feat(federation): add secret rotation columns to
 federation_peers (FED-011)

---
 packages/server/src/db/migrate.ts | 9 +++++++++
 packages/server/src/db/schema.ts  | 4 ++++
 2 files changed, 13 insertions(+)

diff --git a/packages/server/src/db/migrate.ts b/packages/server/src/db/migrate.ts
index ddea186d..c6819839 100644
--- a/packages/server/src/db/migrate.ts
+++ b/packages/server/src/db/migrate.ts
@@ -215,6 +215,15 @@ export function runMigrations(db: Database.Database): void {
         { name: 'federation_relay_ttl_days', type: 'INTEGER NOT NULL DEFAULT 30' },
       ]
     },
+    {
+      name: 'federation_peers',
+      columns: [
+        { name: 'pending_hmac_secret', type: 'TEXT' },
+        { name: 'secret_rotation_at', type: 'INTEGER' },
+        { name: 'secret_rotated_at', type: 'INTEGER' },
+        { name: 'auto_rotate_interval_days', type: 'INTEGER NOT NULL DEFAULT 90' },
+      ]
+    },
   ];
 
   for (const table of tables) {
diff --git a/packages/server/src/db/schema.ts b/packages/server/src/db/schema.ts
index c8d9ea22..315bf70c 100644
--- a/packages/server/src/db/schema.ts
+++ b/packages/server/src/db/schema.ts
@@ -320,6 +320,10 @@ export const federationPeers = sqliteTable('federation_peers', {
   lastSyncedAt: integer('last_synced_at').default(0),
   remoteMaxUploadSize: integer('remote_max_upload_size'),
   nonceSupported: integer('nonce_supported').notNull().default(0),
+  pendingHmacSecret: text('pending_hmac_secret'),
+  secretRotationAt: integer('secret_rotation_at'),
+  secretRotatedAt: integer('secret_rotated_at'),
+  autoRotateIntervalDays: integer('auto_rotate_interval_days').notNull().default(90),
   createdAt: integer('created_at').notNull(),
 });