function migrateUserToV2Kek
migrateUserToV2Kek(
userId: number,
dataKey: CryptoKey,
password: string,
passwordHash: PasswordHash,
): Promise<void>

Re-wrap a user's DATA_KEY under the password-bound (v2) KEK. Called at login — the one place both the raw password and the freshly-unwrapped DATA_KEY are in hand — for users still on the legacy v1 wrap, replacing the DB-recoverable wrap in place without touching any encrypted data.

Parameters

userId: number
dataKey: CryptoKey
password: string
passwordHash: PasswordHash

Return Type

Promise<void>

Usage

import { migrateUserToV2Kek } from "docs/database.ts";