refactor: rename StoredCredential.id to session_id to avoid confusion

SimonThormeyer · SimonThormeyer · commit 62ea1edcfd7c · 2025-12-10T15:20:50.000+01:00
diff --git a/crypto/src/mls/credential/credential_ref/find.rs b/crypto/src/mls/credential/credential_ref/find.rs
@@ -72,7 +72,7 @@ impl CredentialRef {
             .map_err(KeystoreError::wrap("finding all credentials"))?
             .into_iter()
             .filter(|stored| {
-                client_id.is_none_or(|client_id| client_id.as_ref() == stored.id)
+                client_id.is_none_or(|client_id| client_id.as_ref() == stored.session_id)
                     && earliest_validity.is_none_or(|earliest_validity| earliest_validity == stored.created_at)
                     && ciphersuite.is_none_or(|ciphersuite| u16::from(ciphersuite) == stored.ciphersuite)
                     && public_key.is_none_or(|public_key| public_key == stored.public_key)
@@ -96,7 +96,7 @@ impl CredentialRef {
                 && let Ok(ciphersuite) = stored_credential.ciphersuite.try_into()
             {
                 out.push(Self {
-                    client_id: ClientId(stored_credential.id.clone()),
+                    client_id: ClientId(stored_credential.session_id.clone()),
                     r#type,
                     ciphersuite,
                     earliest_validity: stored_credential.created_at,
diff --git a/crypto/src/mls/credential/credential_ref/persistence.rs b/crypto/src/mls/credential/credential_ref/persistence.rs
@@ -63,7 +63,7 @@ impl CredentialRef {
             // these are the only checks we can currently do at the DB level: match the client id, creation timestamp,
             // public key and signature scheme
             .filter(|stored_credential|
-                        stored_credential.id == self.client_id().as_slice()
+                        stored_credential.session_id == self.client_id().as_slice()
                         && stored_credential.created_at == self.earliest_validity
                         && stored_credential.public_key == self.public_key
                         && stored_credential.ciphersuite == u16::from(self.ciphersuite)
diff --git a/crypto/src/mls/credential/persistence.rs b/crypto/src/mls/credential/persistence.rs
@@ -28,7 +28,7 @@ impl Credential {
 
         let stored_credential = database
             .save(StoredCredential {
-                id: self.client_id().to_owned().into_inner(),
+                session_id: self.client_id().to_owned().into_inner(),
                 credential: credential_data,
                 created_at: Default::default(), // updated by the `.save` impl
                 ciphersuite: u16::from(self.ciphersuite),
diff --git a/keystore-dump/src/main.rs b/keystore-dump/src/main.rs
@@ -62,7 +62,7 @@ async fn main() -> anyhow::Result<()> {
             .ok_or_else(|| anyhow!("Cannot parse credential creation date"))?;
 
         credentials.push(serde_json::json!({
-            "id": cred.id,
+            "session_id": cred.session_id,
             "credential": mls_credential,
             "created_at": date,
             "mls_keypair": mls_keypair,
diff --git a/keystore/src/connection/platform/generic/meta_migrations/v16.rs b/keystore/src/connection/platform/generic/meta_migrations/v16.rs
@@ -49,7 +49,7 @@ pub(crate) fn meta_migration(conn: &mut rusqlite::Connection) -> CryptoKeystoreR
         if let Some(c) = migrate_to_new_credential(&v5, &kp)? {
             tx.execute(
                 "INSERT INTO mls_credentials_new (
-                        id,
+                        session_id,
                         credential,
                         created_at,
                         signature_scheme,
@@ -58,7 +58,7 @@ pub(crate) fn meta_migration(conn: &mut rusqlite::Connection) -> CryptoKeystoreR
                     )
                     VALUES (?1, ?2, datetime(?3, 'unixepoch'), ?4, ?5, ?6)",
                 (
-                    c.id.clone(),
+                    c.session_id.clone(),
                     c.credential.clone(),
                     c.created_at,
                     c.signature_scheme,
diff --git a/keystore/src/connection/platform/generic/meta_migrations/v18.rs b/keystore/src/connection/platform/generic/meta_migrations/v18.rs
@@ -26,7 +26,7 @@ pub(crate) fn meta_migration(conn: &mut rusqlite::Connection) -> CryptoKeystoreR
 
     let mut credential_stmt = tx.prepare(&format!(
         "SELECT
-            id,
+            session_id,
             credential,
             unixepoch(created_at) AS created_at,
             signature_scheme,
@@ -39,7 +39,7 @@ pub(crate) fn meta_migration(conn: &mut rusqlite::Connection) -> CryptoKeystoreR
     let mut rows = credential_stmt.query([])?;
     while let Some(row) = rows.next()? {
         let v6 = V6Credential {
-            id: row.get("id")?,
+            session_id: row.get("session_id")?,
             credential: row.get("credential")?,
             created_at: row.get("created_at")?,
             signature_scheme: row.get("signature_scheme")?,
@@ -52,7 +52,7 @@ pub(crate) fn meta_migration(conn: &mut rusqlite::Connection) -> CryptoKeystoreR
         if let Some(ciphersuite) = ciphersuite_for_signature_scheme(v6.signature_scheme) {
             tx.execute(
                 "INSERT INTO mls_credentials_new (
-                        id,
+                        session_id,
                         credential,
                         created_at,
                         ciphersuite,
@@ -61,7 +61,7 @@ pub(crate) fn meta_migration(conn: &mut rusqlite::Connection) -> CryptoKeystoreR
                     )
                     VALUES (?1, ?2, datetime(?3, 'unixepoch'), ?4, ?5, ?6)",
                 (
-                    v6.id.clone(),
+                    v6.session_id.clone(),
                     v6.credential.clone(),
                     v6.created_at,
                     ciphersuite,
diff --git a/keystore/src/connection/platform/generic/meta_migrations/v19.rs b/keystore/src/connection/platform/generic/meta_migrations/v19.rs
@@ -34,7 +34,7 @@ pub(crate) fn meta_migration(conn: &mut rusqlite::Connection) -> CryptoKeystoreR
             Ok(StoredCredential {
                 ciphersuite: row.get("ciphersuite")?,
                 public_key: row.get("public_key")?,
-                id: Vec::new(),          // not relevant for this application
+                session_id: Vec::new(),  // not relevant for this application
                 credential: Vec::new(),  // not relevant for this application
                 created_at: 0,           // not relevant for this application
                 private_key: Vec::new(), // not relevant for this application
diff --git a/keystore/src/connection/platform/generic/migrations/V16__prepare_credential_merge.sql b/keystore/src/connection/platform/generic/migrations/V16__prepare_credential_merge.sql
@@ -1,5 +1,5 @@
 CREATE TABLE mls_credentials_new (
-    id BLOB NOT NULL,
+    session_id BLOB NOT NULL,
     credential BLOB NOT NULL,
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     signature_scheme INT NOT NULL,
diff --git a/keystore/src/connection/platform/generic/migrations/V18__prepare_credential_ciphersuite.sql b/keystore/src/connection/platform/generic/migrations/V18__prepare_credential_ciphersuite.sql
@@ -1,5 +1,5 @@
 CREATE TABLE mls_credentials_new (
-    id BLOB NOT NULL,
+    session_id BLOB NOT NULL,
     credential BLOB NOT NULL,
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     ciphersuite INT NOT NULL,
diff --git a/keystore/src/connection/platform/generic/migrations/V20__credentials_new_primary_key.sql b/keystore/src/connection/platform/generic/migrations/V20__credentials_new_primary_key.sql
@@ -1,7 +1,7 @@
 CREATE TABLE mls_credentials_new (
     public_key_sha256 TEXT UNIQUE NOT NULL,
     public_key BLOB NOT NULL,
-    id BLOB NOT NULL,
+    session_id BLOB NOT NULL,
     credential BLOB NOT NULL,
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     ciphersuite INT NOT NULL,
@@ -11,15 +11,15 @@ CREATE TABLE mls_credentials_new (
 INSERT INTO mls_credentials_new (
     public_key_sha256,
     public_key,
-    id,
+    session_id,
     credential,
     created_at,
     ciphersuite,
     private_key
 )
 SELECT sha256_blob(public_key),
     public_key,
-    id,
+    session_id,
     credential,
     created_at,
     ciphersuite,
diff --git a/keystore/src/connection/platform/generic/mod.rs b/keystore/src/connection/platform/generic/mod.rs
@@ -368,7 +368,7 @@ mod migration_test {
             let mut stmt = conn
                 .prepare(&format!(
                     "SELECT
-                        id,
+                        session_id,
                         credential,
                         unixepoch(created_at) AS created_at,
                         ciphersuite,
@@ -382,7 +382,7 @@ mod migration_test {
             let credential = stmt
                 .query_one([], |row| {
                     Ok(StoredCredential {
-                        id: row.get("id")?,
+                        session_id: row.get("session_id")?,
                         credential: row.get("credential")?,
                         created_at: row.get("created_at")?,
                         ciphersuite: row.get("ciphersuite")?,
@@ -402,7 +402,7 @@ mod migration_test {
             // Create a duplicate from this credential
             conn.execute(
                 "INSERT INTO mls_credentials_new (
-                        id,
+                        session_id,
                         credential,
                         created_at,
                         ciphersuite,
@@ -411,7 +411,7 @@ mod migration_test {
                     )
                     VALUES (?1, ?2, datetime(?3, 'unixepoch'), ?4, ?5, ?6)",
                 (
-                    credential.id.clone(),
+                    credential.session_id.clone(),
                     credential.credential.clone(),
                     credential.created_at,
                     Ciphersuite::MLS_128_DHKEMX25519_CHACHA20POLY1305_SHA256_Ed25519 as u16,
diff --git a/keystore/src/connection/platform/wasm/migrations/v7/mod.rs b/keystore/src/connection/platform/wasm/migrations/v7/mod.rs
@@ -23,7 +23,7 @@ pub(super) async fn migrate(name: &str, key: &DatabaseKey) -> CryptoKeystoreResu
             if let Some(ciphersuite) = ciphersuite_for_signature_scheme(v6_credential.signature_scheme) {
                 let new_credential = StoredCredential {
                     ciphersuite,
-                    id: v6_credential.id.clone(),
+                    session_id: v6_credential.session_id.clone(),
                     credential: v6_credential.credential.clone(),
                     created_at: v6_credential.created_at,
                     public_key: v6_credential.public_key.clone(),
diff --git a/keystore/src/connection/platform/wasm/migrations/v7/v6_entities.rs b/keystore/src/connection/platform/wasm/migrations/v7/v6_entities.rs
@@ -40,7 +40,7 @@ impl EntityTransactionExt for V6Credential {
 #[async_trait::async_trait(?Send)]
 impl Entity for V6Credential {
     fn id_raw(&self) -> &[u8] {
-        self.id.as_slice()
+        self.session_id.as_slice()
     }
 
     async fn find_all(conn: &mut Self::ConnectionType, params: EntityFindParams) -> CryptoKeystoreResult<Vec<Self>> {
@@ -103,7 +103,7 @@ impl MlsCredentialExt for V6Credential {
                 let mut credential = serde_wasm_bindgen::from_value::<V6Credential>(entity_raw)?;
                 credential.decrypt(cipher)?;
 
-                let id = JsValue::from(credential.id.clone());
+                let id = JsValue::from(credential.session_id.clone());
                 let request = store.delete(id)?;
                 request.await?;
             }
diff --git a/keystore/src/entities/mls.rs b/keystore/src/entities/mls.rs
@@ -132,7 +132,7 @@ impl StoredBufferedCommit {
 pub struct StoredCredential {
     /// Note: this is not a unique identifier, but the session id this credential belongs to.
     #[sensitive]
-    pub id: Vec<u8>,
+    pub session_id: Vec<u8>,
     #[sensitive]
     pub credential: Vec<u8>,
     pub created_at: u64,
diff --git a/keystore/src/entities/platform/generic/mls/credential.rs b/keystore/src/entities/platform/generic/mls/credential.rs
@@ -21,9 +21,9 @@ impl StoredCredential {
         created_at: u64,
         ciphersuite: u16,
     ) -> CryptoKeystoreResult<Self> {
-        let mut blob = transaction.blob_open(rusqlite::MAIN_DB, Self::COLLECTION_NAME, "id", rowid, true)?;
-        let mut id = vec![];
-        blob.read_to_end(&mut id)?;
+        let mut blob = transaction.blob_open(rusqlite::MAIN_DB, Self::COLLECTION_NAME, "session_id", rowid, true)?;
+        let mut session_id = vec![];
+        blob.read_to_end(&mut session_id)?;
         blob.close()?;
 
         let mut blob = transaction.blob_open(rusqlite::MAIN_DB, Self::COLLECTION_NAME, "credential", rowid, true)?;
@@ -42,7 +42,7 @@ impl StoredCredential {
         blob.close()?;
 
         Ok(Self {
-            id,
+            session_id,
             credential,
             ciphersuite,
             created_at,
@@ -128,14 +128,14 @@ impl EntityBase for StoredCredential {
 #[async_trait::async_trait]
 impl EntityTransactionExt for StoredCredential {
     async fn save(&self, transaction: &TransactionWrapper<'_>) -> crate::CryptoKeystoreResult<()> {
-        Self::ConnectionType::check_buffer_size(self.id.len())?;
+        Self::ConnectionType::check_buffer_size(self.session_id.len())?;
         Self::ConnectionType::check_buffer_size(self.credential.len())?;
         Self::ConnectionType::check_buffer_size(self.private_key.len())?;
         Self::ConnectionType::check_buffer_size(self.public_key.len())?;
 
         let pk_sha256 = self.id_sha256();
         let zb_pk = rusqlite::blob::ZeroBlob(self.public_key.len() as i32);
-        let zb_id = rusqlite::blob::ZeroBlob(self.id.len() as i32);
+        let zb_id = rusqlite::blob::ZeroBlob(self.session_id.len() as i32);
         let zb_cred = rusqlite::blob::ZeroBlob(self.credential.len() as i32);
         let zb_sk = rusqlite::blob::ZeroBlob(self.private_key.len() as i32);
 
@@ -153,7 +153,7 @@ impl EntityTransactionExt for StoredCredential {
         let sql = "INSERT INTO mls_credentials (
                 public_key_sha256,
                 public_key,
-                id,
+                session_id,
                 credential,
                 created_at,
                 ciphersuite,
@@ -163,9 +163,9 @@ impl EntityTransactionExt for StoredCredential {
         transaction.execute(sql, params)?;
         let row_id = transaction.last_insert_rowid();
 
-        let mut blob = transaction.blob_open(rusqlite::MAIN_DB, Self::COLLECTION_NAME, "id", row_id, false)?;
+        let mut blob = transaction.blob_open(rusqlite::MAIN_DB, Self::COLLECTION_NAME, "session_id", row_id, false)?;
 
-        blob.write_all(&self.id)?;
+        blob.write_all(&self.session_id)?;
         blob.close()?;
 
         let mut blob = transaction.blob_open(rusqlite::MAIN_DB, Self::COLLECTION_NAME, "credential", row_id, false)?;
diff --git a/keystore/src/entities/platform/wasm/mls/credential.rs b/keystore/src/entities/platform/wasm/mls/credential.rs
@@ -37,7 +37,7 @@ impl EntityTransactionExt for StoredCredential {
 #[async_trait::async_trait(?Send)]
 impl Entity for StoredCredential {
     fn id_raw(&self) -> &[u8] {
-        self.id.as_slice()
+        self.session_id.as_slice()
     }
 
     async fn find_all(conn: &mut Self::ConnectionType, params: EntityFindParams) -> CryptoKeystoreResult<Vec<Self>> {
diff --git a/keystore/src/migrations.rs b/keystore/src/migrations.rs
@@ -29,7 +29,7 @@ pub(crate) struct V5Credential {
 pub(crate) struct V6Credential {
     /// Note: this is not a unique identifier, but the session id this credential belongs to.
     #[sensitive]
-    pub id: Vec<u8>,
+    pub session_id: Vec<u8>,
     #[sensitive]
     pub credential: Vec<u8>,
     pub created_at: u64,
@@ -68,7 +68,7 @@ pub(crate) fn migrate_to_new_credential(
     }
 
     let new_credential = V6Credential {
-        id: v5_credential.id.clone(),
+        session_id: v5_credential.id.clone(),
         credential: v5_credential.credential.clone(),
         created_at: v5_credential.created_at,
         signature_scheme: stored_keypair.signature_scheme,
diff --git a/keystore/tests/mls.rs b/keystore/tests/mls.rs
@@ -80,7 +80,7 @@ mod tests {
         .unwrap();
 
         let store_credential = StoredCredential {
-            id: credential_id.clone(),
+            session_id: credential_id.clone(),
             credential: credential.tls_serialize_detached().unwrap(),
             created_at: 0,
             ciphersuite: ciphersuite as u16,
@@ -96,7 +96,7 @@ mod tests {
             .await
             .unwrap()
             .into_iter()
-            .filter(|cred| cred.id == credential_id)
+            .filter(|cred| cred.session_id == credential_id)
             .collect_tuple()
             .expect("credentials should be exactly one");
 
diff --git a/keystore/tests/z_entities.rs b/keystore/tests/z_entities.rs
@@ -328,7 +328,7 @@ pub mod utils {
             }
 
     impl_entity_random_update_ext!(StoredKeypackage, blob_fields=[keypackage,], additional_fields=[(keypackage_ref: uuid::Uuid::new_v4().hyphenated().to_string().into()),]);
-    impl_entity_random_update_ext!(StoredCredential, blob_fields=[credential,public_key,private_key,], additional_fields=[(id: uuid::Uuid::new_v4().hyphenated().to_string().into()),(created_at: 0; auto-generated:true),(ciphersuite: rand::random()),]);
+    impl_entity_random_update_ext!(StoredCredential, blob_fields=[credential,public_key,private_key,], additional_fields=[(session_id: uuid::Uuid::new_v4().hyphenated().to_string().into()),(created_at: 0; auto-generated:true),(ciphersuite: rand::random()),]);
     impl_entity_random_update_ext!(StoredHpkePrivateKey, blob_fields=[pk id_like:true,sk,]);
     impl_entity_random_update_ext!(StoredEncryptionKeyPair, blob_fields=[pk id_like:true,sk,]);
     impl_entity_random_update_ext!(StoredPskBundle, blob_fields=[psk,psk_id id_like:true,]);
