database: Add nullable users.gh_encrypted_token column

Author: Turbo87

crates/crates_io_database/src/models/user.rs

@@ -23,6 +23,8 @@ pub struct User {
     #[diesel(deserialize_as = String)]
     #[serde(skip)]
     pub gh_access_token: SecretString,
+    #[serde(skip)]
+    pub gh_encrypted_token: Option<Vec<u8>>,
     pub account_lock_reason: Option<String>,
     pub account_lock_until: Option<DateTime<Utc>>,
     pub is_admin: bool,
@@ -94,6 +96,7 @@ pub struct NewUser<'a> {
     pub name: Option<&'a str>,
     pub gh_avatar: Option<&'a str>,
     pub gh_access_token: &'a str,
+    pub gh_encrypted_token: Option<&'a [u8]>,
 }
 
 impl NewUser<'_> {
@@ -125,6 +128,7 @@ impl NewUser<'_> {
                 users::name.eq(excluded(users::name)),
                 users::gh_avatar.eq(excluded(users::gh_avatar)),
                 users::gh_access_token.eq(excluded(users::gh_access_token)),
+                users::gh_encrypted_token.eq(excluded(users::gh_encrypted_token)),
             ))
             .returning(User::as_returning())
             .get_result(conn)

crates/crates_io_database/src/schema.rs

@@ -880,6 +880,8 @@ diesel::table! {
         is_admin -> Bool,
         /// Whether or not the user wants to receive notifications when a package they own is published
         publish_notifications -> Bool,
+        /// Encrypted GitHub access token
+        gh_encrypted_token -> Nullable<Bytea>,
     }
 }
 

crates/crates_io_database_dump/src/dump-db.toml

@@ -232,6 +232,7 @@ account_lock_reason = "private"
 account_lock_until = "private"
 is_admin = "private"
 publish_notifications = "private"
+gh_encrypted_token = "private"
 [users.column_defaults]
 gh_access_token = "''"
 

migrations/2025-07-16-123330_add_gh_encrypted_token/down.sql

@@ -0,0 +1 @@
+alter table users drop column gh_encrypted_token;

migrations/2025-07-16-123330_add_gh_encrypted_token/up.sql

@@ -0,0 +1,4 @@
+alter table users
+    add column gh_encrypted_token bytea;
+
+comment on column users.gh_encrypted_token is 'Encrypted GitHub access token';