@bevel-software/platform-core-backend 0.23.0 → 0.24.0

package/dist/tenancy/tenant-secrets.d.ts

@@ -2,7 +2,7 @@
 export interface TenantSecrets {
     /** Signs the tenant's login sessions and OAuth state. */
     jwtSecret: string;
-    /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens and stored git credential. */
+    /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens, stored git credential and personal-data columns. */
     secretsEncKey: string;
     /** HMAC key for the tenant's internal (loopback) tool tokens. */
     internalTokenSecret: string;
@@ -19,6 +19,10 @@ export interface TenantSecrets {
  * export, and nothing per tenant has to be kept safe in the meantime. The
  * cloud app's registry calls this with the same inputs and gets the same
  * answer.
+ *
+ * The personal-data columns are sealed under `secretsEncKey` too (each
+ * tenant's database handle is built with it), so the same one key opens the
+ * whole of a tenant's dump.
  */
 export declare function deriveTenantSecrets(masterKey: string, slug: string): TenantSecrets;
 //# sourceMappingURL=tenant-secrets.d.ts.map

package/dist/tenancy/tenant-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-secrets.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAYlF"}
+{"version":3,"file":"tenant-secrets.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,+HAA+H;IAC/H,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAYlF"}

package/dist/tenancy/tenant-secrets.js

@@ -13,6 +13,10 @@ const MIN_MASTER_KEY_LENGTH = 32;
  * export, and nothing per tenant has to be kept safe in the meantime. The
  * cloud app's registry calls this with the same inputs and gets the same
  * answer.
+ *
+ * The personal-data columns are sealed under `secretsEncKey` too (each
+ * tenant's database handle is built with it), so the same one key opens the
+ * whole of a tenant's dump.
  */
 export function deriveTenantSecrets(masterKey, slug) {
     if (masterKey.length < MIN_MASTER_KEY_LENGTH) {

package/dist/tenancy/tenant-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-secrets.js","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYvC,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,qBAAqB,4BAA4B,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC,uBAAuB,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tenant-secrets.js","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYvC,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,qBAAqB,4BAA4B,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC,uBAAuB,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/kb-template/AGENTS.md

@@ -198,6 +198,8 @@ Write access is not evidence that a file belongs somewhere.
   folder you happen to be able to write to; a wrong guess is discovered much
   later than a question.
 
+{{sharedFileRules}}
+
 ## Access control
 
 Access to any path — reading it as much as writing it — is governed by

package/migrations/0016_pii_encryption.sql

@@ -0,0 +1,20 @@
+-- PII column encryption: add the blind-index companion columns, NULLABLE and
+-- unconstrained. The columns are populated — and existing plaintext PII rows
+-- rewritten to AES-256-GCM ciphertext — by the programmatic backfill that runs
+-- right after the SQL history on every start, under the same lock
+-- (`runPiiEncryptionBackfill` in migrate.ts). That same step then applies SET
+-- NOT NULL and swaps the unique constraints (`users_email_unique` →
+-- `users_email_bidx_unq`, `pr_file_approvals_unq` → `pr_file_approvals_bidx_unq`,
+-- `plugin_join_requests_requester_plugin_unq` →
+-- `plugin_join_requests_requester_bidx_plugin_unq`), because a unique index on
+-- a blind-index column can only go up once every row has one. The snapshot
+-- beside this file describes the END state, which is what the next migration
+-- is generated against.
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_file_approvals" ADD COLUMN IF NOT EXISTS "approver_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_merge_log" ADD COLUMN IF NOT EXISTS "triggered_by_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_comments" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "change_requests" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "change_requests" ADD COLUMN IF NOT EXISTS "apply_failed_by_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pending_commits" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "plugin_join_requests" ADD COLUMN IF NOT EXISTS "requester_email_bidx" text;