From 537b8758ff541a88731d391d3ac6a1b02fd09221 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Mon, 3 Aug 2026 14:11:42 +0100 Subject: [PATCH] fix: purge auth_providers when reaping an instance auth_providers was missing from ScopedCollections, so reap.go's scopedCollectionsForPurge() (derived from that list) never deleted an instance's providers, leaving orphaned rows holding encrypted client secrets forever. Verified migration 0004's $rename over org_id->instance_id is a no-op here since auth_providers never carried org_id. --- server/internal/services/migrate_instance.go | 1 + 1 file changed, 1 insertion(+) diff --git a/server/internal/services/migrate_instance.go b/server/internal/services/migrate_instance.go index 0aff678..defe65f 100644 --- a/server/internal/services/migrate_instance.go +++ b/server/internal/services/migrate_instance.go @@ -39,6 +39,7 @@ var ScopedCollections = []string{ "notification_channels", "console_sessions", "audit_logs", + "auth_providers", } // collectionRenames maps the two collections whose names change. Ordered so the