@@ -134,12 +134,28 @@ def reencrypt_with_pbkdf2hmac(argon2id_bundle: str) -> Optional[str]:
134134 raise ValueError ("Invalid Argon2id bundle" ) from e
135135
136136def _reflect (conn ):
137+ """Reflect relevant tables.
138+
139+ Args:
140+ conn: The database connection.
141+
142+ Returns:
143+ A dict of reflected tables.
144+ """
137145 md = sa .MetaData ()
138146 gateways = sa .Table ("gateways" , md , autoload_with = conn )
139147 a2a_agents = sa .Table ("a2a_agents" , md , autoload_with = conn )
140148 return {"gateways" : gateways , "a2a_agents" : a2a_agents }
141149
142150def _is_json (col ):
151+ """Check if a column is of JSON type.
152+
153+ Args:
154+ col: The column to check.
155+
156+ Returns:
157+ True if the column is of JSON type.
158+ """
143159 return isinstance (col .type , sa .JSON )
144160
145161def _looks_argon2_bundle (val : Optional [str ]) -> bool :
@@ -222,6 +238,12 @@ def _downgrade_value(old: Optional[str]) -> Optional[str]:
222238
223239
224240def _upgrade_json_client_secret (conn , table ):
241+ """Upgrade JSON client_secret fields in the given table.
242+
243+ Args:
244+ conn: The database connection.
245+ table: The table to upgrade.
246+ """
225247 t = table
226248 sel = sa .select (t .c .id , t .c .oauth_config ).where (t .c .oauth_config .isnot (None ))
227249 for row in conn .execute (sel ).mappings ():
@@ -246,6 +268,12 @@ def _upgrade_json_client_secret(conn, table):
246268
247269
248270def _downgrade_json_client_secret (conn , table ):
271+ """Downgrade JSON client_secret fields in the given table.
272+
273+ Args:
274+ conn: The database connection.
275+ table: The table to downgrade.
276+ """
249277 t = table
250278 sel = sa .select (t .c .id , t .c .oauth_config ).where (t .c .oauth_config .isnot (None ))
251279 for row in conn .execute (sel ).mappings ():
@@ -270,6 +298,7 @@ def _downgrade_json_client_secret(conn, table):
270298
271299
272300def upgrade () -> None :
301+ """Use Argon2id KDF for encryption key re-encryption."""
273302 bind = op .get_bind ()
274303
275304 conn = op .get_bind ()
@@ -385,6 +414,7 @@ def upgrade() -> None:
385414
386415
387416def downgrade () -> None :
417+ """Revert to PBKDF2HMAC KDF for encryption key re-encryption."""
388418 bind = op .get_bind ()
389419
390420 # JSON: gateways.oauth_config.client_secret
0 commit comments