Redact legacy migration verifier and preserve V2 TOTP in V3

[antuz123]

Summary

• Redact the stored authenticator verifier from the V2→V3 migration response while preserving migrationSuccessful and signer setup metadata.
• Normalize a persisted V2 verification.verifier.twoFAKey to the scalar string required by the V3 model when creating a V3 signer. Preserve the V2 policy and restrictions; leave an existing V3 signer unchanged on retry.
• Cover first migration and retry, including a valid synthetic TOTP token for the value passed to V3.

Compatibility and verification

• Checked Keeper tags v1.1.9–v2.1.1: the upgrade saga consumes migrationSuccessful; new Server Key enrollment is unchanged.
• A disposable MongoDB 7 fixture using the repository's actual V2 and V3 schemas confirmed the old migration cast the nested V2 verifier to an unusable V3 string. The fixture used a synthetic secret and was discarded.
• A second disposable MongoDB 7 replica-set fixture at the same exact head exercised SignerV3.migrateSignersV2ToV3 with real Mongoose V2/V3 schemas and synthetic data. The persisted V3 verifier equals the original scalar key, a synthetic TOTP validates, restrictions and the V2 record remain intact, first/retry responses are redacted, and retry leaves one V3 signer/map. The unique database was dropped. This was a direct service check with wallet/cloud dependencies stubbed, not an HTTP or hosted test.
• At 7c14b6e, Node 22 compilation and the full local suite pass: 110/110 tests (2 suites). Source secret scan and git diff --check pass.
• An isolated local merge of SigningServer Patch runtime dependency advisories and verify caller compatibility #1 (3cc7728c), Redact Signing Server access and operational logs #2 (73399398), and this PR (7c14b6e) was conflict-free; Node 22 compile and 127/127 tests across 6 suites passed. This merge was not pushed.
• Exact-head GitHub Run Tests and Source readiness both passed at 7c14b6e (test, current-source scan, and history scan jobs).

Review and rollout

This PR does not authorize a wallet operation, change route policy, or deploy. The post-fix persisted service fixture passed, while HTTP authorization and hosted configuration remain untested. Existing V3 documents created by an earlier migration attempt are not rewritten here. The backend operator must inventory any such malformed records and obtain a separately reviewed repair/compatibility decision before rollout, then attest the running artifact, effective route controls, and aggregate old-route usage. Utkarsh approved exact head 7c14b6e67325eab6be95fa1a5e03e855d96e985b on 9 October 2026; that source approval does not establish hosted HTTP/operator acceptance.

Cloud continuation (12 October 2026): this source head is unchanged and was approved by Utkarsh on 9 October. Exact-head GitHub source/test checks remain successful. An isolated unpushed integration of #1/#2/#5 at 8de93e58358d0f9066c4ccda27fbeac474c9279d passed Node 22.23.3 compile and 127/127 tests across six suites. This is compatibility evidence only, not a deployment or production route/log/provider attestation. Mac-native testing is not needed for backend source review; staging/operator and app/hardware integration acceptance remain open.

[Copilot]

🟢 Approval recommended

The focused security change preserves migration state and is adequately covered by regression tests.

0 open findings

What changed in this PR

Redacts legacy stored verifiers from migration responses while preserving migration behavior and persisted policy data.

Changes:

• Returns null instead of the stored verifier.
• Adds regression coverage for redaction, persistence, and mapping updates.

File	Description
src/​services/​assistedKeys.ts/​ss-signer/​signerV3.ts	Redacts the verifier in migration responses.
tests/​unit/​signerV3.test.ts	Tests migration compatibility and verifier redaction.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[antuz123]

R4 backend acceptance handoff — 12 October 2026

State: BLOCKED_ON_STAGING_OPERATOR_ACCEPTANCE
Scope: Existing R4 source only. New Assisted Multisig remains pending Adam.

Source/compatibility evidence: Public Relay runtime pin ee935359f22ff7932ea0a62e9084d4b49801f4aa passed Node 22 compile, 105/105 baseline/local-mode and 104/104 Mongo 7 replica-set backup tests during this continuation. SigningServer #1 3cc7728, #2 7339939 and #5 7c14b6e merged without conflicts into isolated unpushed verification SHA 8de93e58358d0f9066c4ccda27fbeac474c9279d; Node 22.23.3 compile and 127/127 tests in 6 suites passed. All three source PRs and Relay #3 have Utkarsh's 9 October approvals on the pinned heads; hosted source/test checks on those unchanged heads are green. These are source/local-fixture results, not a deployed-service claim.

Operator/staging acceptance still required:

• Attest running source/artifact identity, effective route authorization and environment, dependency inventory, provider roles and log/access visibility using an approved private read-only process. Publish only non-sensitive SHA/build IDs and aggregate outcome categories.
• On a disposable staging replica set, attest transaction support and the actual account-scoped index; exercise readback/conditional repair, two writes from one revision, delete/recreate and A→B→A generation invalidation, cross-account isolation, malformed IDs, signer-map cleanup, archive/unlink and old-client walletObject/signersObjects aliases. Ambiguous old/current field pairs must reject before mutation; stale writes must preserve concurrent data.
• Verify synthetic old-client restore through mobile and hosted HTTP; the current contributor stack pin is not proof of production route parity. Use an independent contributor's own fork/identity to demonstrate clean setup and a scoped PR; never share a maintainer credential.
• For SigningServer migration, use synthetic V2 fixtures via staged HTTP with real route controls: unauthorized/invalid-token requests rejected, first migration and retry preserve migrationSuccessful/setup metadata and V2 policy/restrictions, outbound responses omit verifier, migrated scalar TOTP validates, retry leaves one V3/map.
• Inventory potentially malformed preexisting V3 records privately and obtain a separate reviewed repair decision. Redact legacy migration verifier and preserve V2 TOTP in V3 #5 leaves existing V3 records untouched.
• Verify staged SES and Google provider success/failure with scoped non-production roles; fixed operational log categories and method/status/size/duration access logs must omit request URLs, IDs, raw exceptions and secret/config values. AWS SDK v2 migration remains separate.
• Keep source approval, hosted CI, staging acceptance, deployment approval and running-artifact postflight as separate decisions. No deployment, credential change, owner backup mutation, production index action or funded operation has been authorized by this handoff.

Native Mac testing is not required to review backend source itself. The final app/Desktop Local handoff must separately record iOS/Android/physical signer round trips against explicitly identified compatible services.