From 2f9cce9d389a467eddc357e2f515405f3fbcf77c Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Tue, 31 Mar 2026 18:09:40 +0200
Subject: [PATCH] feat(federation): add nonceSupported column to
 federation_peers (FED-008)

Adds nonce_supported INTEGER column to the federation_peers table in both
the Drizzle schema definition and via a safe ALTER TABLE migration, enabling
the auto-ratchet mechanism for replay attack protection.
---
 packages/server/src/db/migrate.ts | 5 +++++
 packages/server/src/db/schema.ts  | 1 +
 2 files changed, 6 insertions(+)

diff --git a/packages/server/src/db/migrate.ts b/packages/server/src/db/migrate.ts
index 35aa53ba..ddea186d 100644
--- a/packages/server/src/db/migrate.ts
+++ b/packages/server/src/db/migrate.ts
@@ -2098,4 +2098,9 @@ function migrateGeneralizeOutbox(db: Database.Database): void {
       db.exec(`PRAGMA foreign_keys = ON`);
     }
   }
+
+  // ─── FED-008: Add nonceSupported column for replay attack protection ───────
+  try {
+    db.exec(`ALTER TABLE federation_peers ADD COLUMN nonce_supported INTEGER NOT NULL DEFAULT 0`);
+  } catch { /* column already exists */ }
 }
diff --git a/packages/server/src/db/schema.ts b/packages/server/src/db/schema.ts
index 0a28211e..c8d9ea22 100644
--- a/packages/server/src/db/schema.ts
+++ b/packages/server/src/db/schema.ts
@@ -319,6 +319,7 @@ export const federationPeers = sqliteTable('federation_peers', {
   consecutiveFailures: integer('consecutive_failures').default(0),
   lastSyncedAt: integer('last_synced_at').default(0),
   remoteMaxUploadSize: integer('remote_max_upload_size'),
+  nonceSupported: integer('nonce_supported').notNull().default(0),
   createdAt: integer('created_at').notNull(),
 });