Update

backend/src/migrations.ts

@@ -1,4 +1,7 @@
 import { query } from "./db.js";
+import { encryptSecret, isEncryptedSecret } from "./secrets.js";
+
+const zammadApiKeySettingKey = "zammad.api_key";
 
 async function findMigrationAdmin() {
   const adminResult = await query<{ id: string }>("SELECT id FROM users WHERE role = 'admin' ORDER BY id ASC LIMIT 1;");
@@ -39,6 +42,27 @@ async function ensureClosureOwnership(table: string, column: string, primaryKeyC
   await query(`CREATE INDEX IF NOT EXISTS idx_${table}_${column}_user ON ${table}(${column}, user_id);`);
 }
 
+async function encryptStoredApiSecrets() {
+  const userTokenResult = await query<{ id: string; zammad_api_token: string | null }>(`
+    SELECT id::text AS id, zammad_api_token
+    FROM users
+    WHERE zammad_api_token IS NOT NULL;
+  `);
+
+  for (const row of userTokenResult.rows) {
+    if (row.zammad_api_token && !isEncryptedSecret(row.zammad_api_token)) {
+      await query("UPDATE users SET zammad_api_token = $1, updated_at = now() WHERE id = $2;", [encryptSecret(row.zammad_api_token), row.id]);
+    }
+  }
+
+  const zammadApiKeyResult = await query<{ value: string }>("SELECT value FROM app_settings WHERE key = $1;", [zammadApiKeySettingKey]);
+  const zammadApiKey = zammadApiKeyResult.rows[0]?.value ?? null;
+
+  if (zammadApiKey && !isEncryptedSecret(zammadApiKey)) {
+    await query("UPDATE app_settings SET value = $1, updated_at = now() WHERE key = $2;", [encryptSecret(zammadApiKey), zammadApiKeySettingKey]);
+  }
+}
+
 export async function migrate() {
   await query(`
     CREATE TABLE IF NOT EXISTS users (
@@ -91,6 +115,8 @@ export async function migrate() {
     );
   `);
 
+  await encryptStoredApiSecrets();
+
   await query(`
     CREATE TABLE IF NOT EXISTS user_preferences (
       user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,