@coffre/cli 0.1.1 → 0.1.2

package/dist/migrations/postgres/0000_baseline.sql

@@ -0,0 +1,505 @@
+-- The schema on Postgres. Generated by `pnpm db:generate` from
+-- baseline/postgres.sql and src/schema.ts; edit those, not this.
+
+CREATE TABLE "audit_chain_head" (
+	"only_row" boolean PRIMARY KEY DEFAULT true NOT NULL,
+	"next_seq" bigint DEFAULT 0 NOT NULL,
+	"head_hash" "bytea" NOT NULL,
+	CONSTRAINT "audit_chain_head_only_row_check" CHECK ("audit_chain_head"."only_row"),
+	CONSTRAINT "audit_chain_head_next_seq_check" CHECK ("audit_chain_head"."next_seq" >= 0),
+	CONSTRAINT "audit_chain_head_head_hash_check" CHECK (octet_length("audit_chain_head"."head_hash") = 32)
+);
+--> statement-breakpoint
+CREATE TABLE "audit_log" (
+	"seq" bigint PRIMARY KEY NOT NULL,
+	"author" text NOT NULL,
+	"key_id" text NOT NULL,
+	"occurred_at" bigint NOT NULL,
+	"actor" text NOT NULL,
+	"action" text NOT NULL,
+	"decision" text NOT NULL,
+	"code" text,
+	"subject_principal" text,
+	"project_id" uuid,
+	"environment_id" uuid,
+	"secret_id" uuid,
+	"secret_version_id" uuid,
+	"operation_id" uuid,
+	"request_id" text,
+	"source_ip" text,
+	"related_seq" bigint,
+	"metadata" text DEFAULT '{}' NOT NULL,
+	"prev_hash" "bytea" NOT NULL,
+	"mac" "bytea" NOT NULL,
+	"hash" "bytea" NOT NULL,
+	CONSTRAINT "audit_log_author_check" CHECK ("audit_log"."author" IN ('app', 'vault')),
+	CONSTRAINT "audit_log_actor_check" CHECK ("audit_log"."actor" ~ '^(user|token|sync|system):.+$'),
+	CONSTRAINT "audit_log_decision_check" CHECK ("audit_log"."decision" IN ('allow', 'deny')),
+	CONSTRAINT "audit_log_metadata_check" CHECK ("audit_log"."metadata"::jsonb IS NOT NULL),
+	CONSTRAINT "audit_log_prev_hash_check" CHECK (octet_length("audit_log"."prev_hash") = 32),
+	CONSTRAINT "audit_log_mac_check" CHECK (octet_length("audit_log"."mac") = 32),
+	CONSTRAINT "audit_log_hash_check" CHECK (octet_length("audit_log"."hash") = 32)
+);
+--> statement-breakpoint
+CREATE TABLE "credentials" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"kind" text NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"token_hash" "bytea" NOT NULL,
+	"token_hint" text NOT NULL,
+	"generation" integer NOT NULL,
+	"principal" text NOT NULL,
+	"identity_id" uuid,
+	"label" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"last_used_at" timestamp with time zone,
+	"last_used_ip" text,
+	"revoked_at" timestamp with time zone,
+	"revoked_by" text,
+	CONSTRAINT "credentials_token_hash_key" UNIQUE("token_hash"),
+	CONSTRAINT "credentials_kind_check" CHECK ("credentials"."kind" IN ('browser', 'cli', 'service')),
+	CONSTRAINT "credentials_principal_check" CHECK ("credentials"."principal" LIKE 'user:%' OR "credentials"."principal" LIKE 'token:%'),
+	CONSTRAINT "credentials_kind_matches_principal" CHECK (("credentials"."kind" = 'service') = ("credentials"."principal" LIKE 'token:%')),
+	CONSTRAINT "credentials_token_hash_check" CHECK (octet_length("credentials"."token_hash") = 32),
+	CONSTRAINT "credentials_auth_mac_check" CHECK (octet_length("credentials"."auth_mac") = 32)
+);
+--> statement-breakpoint
+CREATE TABLE "device_authorizations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"device_code_hash" "bytea" NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"user_code" text NOT NULL,
+	"client_label" text,
+	"client_ip" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"decided_at" timestamp with time zone,
+	"decision" text,
+	"generation" integer DEFAULT 0 NOT NULL,
+	"principal" text,
+	"consumed_at" timestamp with time zone,
+	CONSTRAINT "device_authorizations_device_code_hash_key" UNIQUE("device_code_hash"),
+	CONSTRAINT "device_authorizations_user_code_key" UNIQUE("user_code"),
+	CONSTRAINT "device_authorizations_auth_mac_check" CHECK (octet_length("device_authorizations"."auth_mac") = 32),
+	CONSTRAINT "device_authorizations_decision_check" CHECK ("device_authorizations"."decision" IS NULL OR "device_authorizations"."decision" IN ('approved', 'denied')),
+	CONSTRAINT "device_authorizations_approval_names_principal" CHECK (("device_authorizations"."decision" IS NULL AND "device_authorizations"."decided_at" IS NULL AND "device_authorizations"."principal" IS NULL AND "device_authorizations"."generation" = 0 AND "device_authorizations"."consumed_at" IS NULL)
+        OR ("device_authorizations"."decision" IS NOT NULL AND "device_authorizations"."decided_at" IS NOT NULL AND (
+          ("device_authorizations"."decision" = 'denied' AND "device_authorizations"."principal" IS NULL AND "device_authorizations"."generation" = 0 AND "device_authorizations"."consumed_at" IS NULL)
+          OR ("device_authorizations"."decision" = 'approved' AND "device_authorizations"."principal" IS NOT NULL AND "device_authorizations"."principal" LIKE 'user:%')
+        )))
+);
+--> statement-breakpoint
+CREATE TABLE "environments" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"project_id" uuid NOT NULL,
+	"slug" text NOT NULL,
+	"name" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"archived_at" timestamp with time zone,
+	CONSTRAINT "environments_project_id_slug_key" UNIQUE("project_id","slug"),
+	CONSTRAINT "environments_project_scoped" UNIQUE("id","project_id"),
+	CONSTRAINT "environments_slug_check" CHECK ("environments"."slug" ~ '^[a-z0-9][a-z0-9-]{0,62}$')
+);
+--> statement-breakpoint
+CREATE TABLE "identities" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"provider" text NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"subject" text NOT NULL,
+	"issuer_hash" text NOT NULL,
+	"generation" integer NOT NULL,
+	"principal" text NOT NULL,
+	"email" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"last_sign_in_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"revoked_by" text,
+	"active_subject" text GENERATED ALWAYS AS (CASE WHEN revoked_at IS NULL THEN subject END) STORED,
+	CONSTRAINT "identities_member_generation_key" UNIQUE("id","principal","generation"),
+	CONSTRAINT "identities_principal_check" CHECK ("identities"."principal" LIKE 'user:%'),
+	CONSTRAINT "identities_provider_check" CHECK ("identities"."provider" ~ '^[a-z0-9][a-z0-9-]{0,31}$'),
+	CONSTRAINT "identities_auth_mac_check" CHECK (octet_length("identities"."auth_mac") = 32)
+);
+--> statement-breakpoint
+CREATE TABLE "projects" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"slug" text NOT NULL,
+	"name" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"archived_at" timestamp with time zone,
+	CONSTRAINT "projects_slug_key" UNIQUE("slug"),
+	CONSTRAINT "projects_slug_check" CHECK ("projects"."slug" ~ '^[a-z0-9][a-z0-9-]{0,62}$')
+);
+--> statement-breakpoint
+CREATE TABLE "secret_versions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"secret_id" uuid NOT NULL,
+	"version" integer NOT NULL,
+	"envelope_version" integer NOT NULL,
+	"ciphertext" "bytea" NOT NULL,
+	"iv" "bytea" NOT NULL,
+	"auth_tag" "bytea" NOT NULL,
+	"wrapped_dek" "bytea" NOT NULL,
+	"kek_provider" text NOT NULL,
+	"kek_id" text NOT NULL,
+	"kek_version" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	CONSTRAINT "secret_versions_secret_id_version_key" UNIQUE("secret_id","version"),
+	CONSTRAINT "secret_versions_version_check" CHECK ("secret_versions"."version" > 0),
+	CONSTRAINT "secret_versions_iv_check" CHECK (octet_length("secret_versions"."iv") = 12),
+	CONSTRAINT "secret_versions_auth_tag_check" CHECK (octet_length("secret_versions"."auth_tag") = 16)
+);
+--> statement-breakpoint
+CREATE TABLE "secrets" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"project_id" uuid NOT NULL,
+	"environment_id" uuid NOT NULL,
+	"key" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"current_version_id" uuid,
+	"current_version" integer DEFAULT 0 NOT NULL,
+	"archived_at" timestamp with time zone,
+	CONSTRAINT "secrets_project_id_environment_id_key_key" UNIQUE("project_id","environment_id","key"),
+	CONSTRAINT "secrets_key_check" CHECK ("secrets"."key" ~ '^[A-Za-z_][A-Za-z0-9_]{0,127}$')
+);
+--> statement-breakpoint
+CREATE TABLE "sync_keys" (
+	"sync_id" uuid NOT NULL,
+	"key" text NOT NULL,
+	"secret_version_id" uuid,
+	"pushed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"removed_at" timestamp with time zone,
+	CONSTRAINT "sync_keys_pkey" PRIMARY KEY("sync_id","key")
+);
+--> statement-breakpoint
+CREATE TABLE "syncs" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"project_id" uuid NOT NULL,
+	"environment_id" uuid NOT NULL,
+	"provider" text NOT NULL,
+	"config" text NOT NULL,
+	"credential_secret_id" uuid NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"paused_at" timestamp with time zone,
+	"archived_at" timestamp with time zone,
+	"lease_until" timestamp with time zone,
+	"last_run_at" timestamp with time zone,
+	"last_status" text,
+	"last_error" text,
+	CONSTRAINT "syncs_config_check" CHECK ("syncs"."config"::jsonb IS NOT NULL),
+	CONSTRAINT "syncs_last_status_check" CHECK ("syncs"."last_status" IS NULL OR "syncs"."last_status" IN ('ok', 'partial', 'failed'))
+);
+--> statement-breakpoint
+CREATE TABLE "vault_grants" (
+	"principal" text NOT NULL,
+	"project_id" uuid,
+	"environment_id" uuid,
+	"role" text NOT NULL,
+	"expires_at" bigint,
+	"granted_at" bigint NOT NULL,
+	"granted_by" text NOT NULL,
+	CONSTRAINT "vault_grants_on_project" UNIQUE("principal","project_id"),
+	CONSTRAINT "vault_grants_on_environment" UNIQUE("principal","environment_id"),
+	CONSTRAINT "vault_grants_one_place" CHECK (("vault_grants"."project_id" IS NULL) <> ("vault_grants"."environment_id" IS NULL)),
+	CONSTRAINT "vault_grants_role_check" CHECK ("vault_grants"."role" IN ('viewer', 'developer', 'maintainer', 'access-manager', 'auditor', 'owner')),
+	CONSTRAINT "vault_grants_environment_role_check" CHECK ("vault_grants"."environment_id" IS NULL OR "vault_grants"."role" IN ('viewer', 'developer', 'auditor'))
+);
+--> statement-breakpoint
+CREATE TABLE "vault_members" (
+	"principal" text PRIMARY KEY NOT NULL,
+	"status" text NOT NULL,
+	"owner" boolean DEFAULT false NOT NULL,
+	"generation" integer DEFAULT 0 NOT NULL,
+	"created_at" bigint NOT NULL,
+	"created_by" text NOT NULL,
+	"status_changed_at" bigint NOT NULL,
+	"status_changed_by" text NOT NULL,
+	"access_seq" bigint NOT NULL,
+	"mac" "bytea" NOT NULL,
+	CONSTRAINT "vault_members_mac_check" CHECK (octet_length("vault_members"."mac") = 32),
+	CONSTRAINT "vault_members_principal_check" CHECK ("vault_members"."principal" ~ '^(user|token|sync):[^[:space:]:][^[:space:]]*$'),
+	CONSTRAINT "vault_members_user_lowercase" CHECK ("vault_members"."principal" NOT LIKE 'user:%' OR "vault_members"."principal" = lower("vault_members"."principal")),
+	CONSTRAINT "vault_members_status_check" CHECK ("vault_members"."status" IN ('active', 'removed')),
+	CONSTRAINT "vault_members_owner_check" CHECK (NOT "vault_members"."owner" OR ("vault_members"."status" = 'active' AND "vault_members"."principal" LIKE 'user:%')),
+	CONSTRAINT "vault_members_generation_check" CHECK ("vault_members"."generation" >= 0)
+);
+--> statement-breakpoint
+ALTER TABLE "audit_log" ADD CONSTRAINT "audit_log_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "audit_log" ADD CONSTRAINT "audit_log_environment_id_fkey" FOREIGN KEY ("environment_id") REFERENCES "public"."environments"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "audit_log" ADD CONSTRAINT "audit_log_secret_id_fkey" FOREIGN KEY ("secret_id") REFERENCES "public"."secrets"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "audit_log" ADD CONSTRAINT "audit_log_secret_version_id_fkey" FOREIGN KEY ("secret_version_id") REFERENCES "public"."secret_versions"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "audit_log" ADD CONSTRAINT "audit_log_related_seq_fkey" FOREIGN KEY ("related_seq") REFERENCES "public"."audit_log"("seq") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_identity_id_fkey" FOREIGN KEY ("identity_id","principal","generation") REFERENCES "public"."identities"("id","principal","generation") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "device_authorizations" ADD CONSTRAINT "device_authorizations_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "environments" ADD CONSTRAINT "environments_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "identities" ADD CONSTRAINT "identities_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "secret_versions" ADD CONSTRAINT "secret_versions_secret_id_fkey" FOREIGN KEY ("secret_id") REFERENCES "public"."secrets"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "secrets" ADD CONSTRAINT "secrets_current_version_id_secret_versions_id_fk" FOREIGN KEY ("current_version_id") REFERENCES "public"."secret_versions"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "secrets" ADD CONSTRAINT "secrets_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "secrets" ADD CONSTRAINT "secrets_environment_id_fkey" FOREIGN KEY ("environment_id") REFERENCES "public"."environments"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "secrets" ADD CONSTRAINT "secrets_environment_in_project" FOREIGN KEY ("environment_id","project_id") REFERENCES "public"."environments"("id","project_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sync_keys" ADD CONSTRAINT "sync_keys_sync_id_fkey" FOREIGN KEY ("sync_id") REFERENCES "public"."syncs"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sync_keys" ADD CONSTRAINT "sync_keys_secret_version_id_fkey" FOREIGN KEY ("secret_version_id") REFERENCES "public"."secret_versions"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "syncs" ADD CONSTRAINT "syncs_environment_in_project" FOREIGN KEY ("environment_id","project_id") REFERENCES "public"."environments"("id","project_id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "syncs" ADD CONSTRAINT "syncs_credential_secret_id_fkey" FOREIGN KEY ("credential_secret_id") REFERENCES "public"."secrets"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_environment_id_fkey" FOREIGN KEY ("environment_id") REFERENCES "public"."environments"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "audit_log_project_idx" ON "audit_log" USING btree ("project_id","seq");--> statement-breakpoint
+CREATE INDEX "audit_log_environment_idx" ON "audit_log" USING btree ("environment_id","seq");--> statement-breakpoint
+CREATE INDEX "audit_log_secret_idx" ON "audit_log" USING btree ("secret_id","seq");--> statement-breakpoint
+CREATE INDEX "audit_log_actor_idx" ON "audit_log" USING btree ("actor","seq");--> statement-breakpoint
+CREATE INDEX "audit_log_operation_idx" ON "audit_log" USING btree ("operation_id","seq");--> statement-breakpoint
+CREATE INDEX "audit_log_action_idx" ON "audit_log" USING btree ("author","action","seq");--> statement-breakpoint
+CREATE INDEX "audit_log_releases_idx" ON "audit_log" USING btree ("author","actor","action","decision","occurred_at");--> statement-breakpoint
+CREATE INDEX "audit_log_subject_idx" ON "audit_log" USING btree ("author","subject_principal","seq");--> statement-breakpoint
+CREATE INDEX "credentials_principal_idx" ON "credentials" USING btree ("principal","generation");--> statement-breakpoint
+CREATE UNIQUE INDEX "identities_active_subject" ON "identities" USING btree ("provider","issuer_hash","active_subject");--> statement-breakpoint
+CREATE INDEX "identities_principal_idx" ON "identities" USING btree ("principal","generation");--> statement-breakpoint
+CREATE INDEX "secret_versions_secret_idx" ON "secret_versions" USING btree ("secret_id","version" DESC NULLS LAST);--> statement-breakpoint
+CREATE INDEX "secrets_lookup_idx" ON "secrets" USING btree ("project_id","environment_id","key");--> statement-breakpoint
+CREATE INDEX "syncs_environment_idx" ON "syncs" USING btree ("environment_id");--> statement-breakpoint
+
+-- The chain starts at sequence 0 from 32 zero bytes.
+INSERT INTO audit_chain_head (only_row, next_seq, head_hash)
+VALUES (true, 0, decode(repeat('00', 32), 'hex'));
+--> statement-breakpoint
+
+-- The audit log only grows, for every login, its owner's included. The
+-- grants below already keep the runtime login from changing it; this stops
+-- a bug or a careless statement by the owner too, who can still lift it
+-- with ALTER TABLE ... DISABLE TRIGGER. What an owner changes anyway, the
+-- entries' MACs and chain show.
+CREATE FUNCTION audit_log_append_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    RAISE EXCEPTION 'audit_log is append-only' USING ERRCODE = 'insufficient_privilege';
+END
+$$;
+--> statement-breakpoint
+CREATE TRIGGER audit_log_no_change BEFORE UPDATE OR DELETE ON audit_log
+    FOR EACH ROW EXECUTE FUNCTION audit_log_append_only();
+--> statement-breakpoint
+CREATE TRIGGER audit_log_no_truncate BEFORE TRUNCATE ON audit_log
+    FOR EACH STATEMENT EXECUTE FUNCTION audit_log_append_only();
+--> statement-breakpoint
+
+-- Two logins, provisioned outside coffre (their passwords are never ours),
+-- each with only the rights of its group:
+--
+--   coffre_runtime        the server, through coffre_app: read and insert,
+--                         UPDATE on named columns only, and never DELETE. A
+--                         revoked session, a used device code and a removed
+--                         sync key are rows that say so, not gaps.
+--   coffre_vault_runtime  the vault, through coffre_vault: its members and
+--                         grants, and reading what it decides on.
+--
+-- Both append to the audit log, each only as its own author (row-level
+-- security, below), and neither may change or delete an entry.
+DO $$
+DECLARE
+    name text;
+BEGIN
+    FOREACH name IN ARRAY ARRAY['coffre_app', 'coffre_vault'] LOOP
+        IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = name) THEN
+            EXECUTE format('CREATE ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
+        ELSE
+            -- Managed owners cannot ALTER the superuser-only attributes, even to turn them off.
+            IF EXISTS (
+                SELECT 1 FROM pg_roles WHERE rolname = name
+                AND (rolsuper OR rolreplication OR rolbypassrls)
+            ) THEN
+                RAISE EXCEPTION '% has unsafe role attributes: SUPERUSER, REPLICATION and BYPASSRLS must be off', name;
+            END IF;
+            EXECUTE format('ALTER ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
+        END IF;
+    END LOOP;
+END
+$$;
+--> statement-breakpoint
+
+
+DO $$
+DECLARE
+    name text;
+    runtime_role oid;
+BEGIN
+    FOREACH name IN ARRAY ARRAY['coffre_runtime', 'coffre_vault_runtime'] LOOP
+        SELECT oid INTO runtime_role FROM pg_roles WHERE rolname = name;
+        IF runtime_role IS NULL THEN
+            RAISE EXCEPTION '% must be provisioned before migrations', name;
+        END IF;
+
+        IF EXISTS (
+            SELECT 1
+              FROM pg_roles
+             WHERE oid = runtime_role
+               AND (rolsuper OR rolcreatedb OR rolcreaterole OR rolreplication OR rolbypassrls)
+        ) THEN
+            RAISE EXCEPTION '% has unsafe role attributes', name;
+        END IF;
+
+        IF EXISTS (
+            SELECT 1
+              FROM pg_shdepend
+             WHERE refclassid = 'pg_authid'::regclass
+               AND refobjid = runtime_role
+               AND deptype = 'o'
+        ) THEN
+            RAISE EXCEPTION '% owns database objects', name;
+        END IF;
+    END LOOP;
+END
+$$;
+--> statement-breakpoint
+
+REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public
+    FROM coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public
+    FROM coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+REVOKE ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public
+    FROM coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+REVOKE ALL PRIVILEGES ON SCHEMA public
+    FROM coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+GRANT USAGE ON SCHEMA public TO coffre_app, coffre_vault;
+--> statement-breakpoint
+GRANT USAGE ON SCHEMA drizzle TO coffre_app, coffre_vault;
+--> statement-breakpoint
+GRANT SELECT ON drizzle.__drizzle_migrations TO coffre_app, coffre_vault;
+--> statement-breakpoint
+
+GRANT SELECT, INSERT ON
+    projects,
+    environments,
+    secrets,
+    secret_versions,
+    audit_log,
+    identities,
+    credentials,
+    device_authorizations,
+    syncs,
+    sync_keys
+TO coffre_app;
+--> statement-breakpoint
+
+GRANT SELECT ON
+    audit_chain_head,
+    vault_members,
+    vault_grants
+TO coffre_app;
+--> statement-breakpoint
+
+GRANT UPDATE (slug, name, archived_at) ON projects TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (slug, name, archived_at) ON environments TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (key, current_version_id, current_version, updated_at, archived_at) ON secrets TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (next_seq, head_hash) ON audit_chain_head TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (email, last_sign_in_at, revoked_at, revoked_by, auth_mac) ON identities TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (last_used_at, last_used_ip, revoked_at, revoked_by, auth_mac) ON credentials TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (decided_at, decision, generation, principal, consumed_at, auth_mac)
+    ON device_authorizations TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (config, credential_secret_id, paused_at, archived_at, lease_until,
+              last_run_at, last_status, last_error)
+    ON syncs TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (secret_version_id, pushed_at, removed_at) ON sync_keys TO coffre_app;
+--> statement-breakpoint
+
+-- The vault reads what it decides on and the log it chains to, and writes
+-- its members and grants. A revoked grant is deleted: the log keeps it.
+GRANT SELECT ON
+    projects,
+    environments,
+    secrets,
+    secret_versions,
+    audit_chain_head
+TO coffre_vault;
+--> statement-breakpoint
+GRANT SELECT, INSERT ON audit_log TO coffre_vault;
+--> statement-breakpoint
+GRANT SELECT, INSERT, UPDATE (status, owner, generation, created_at, created_by, status_changed_at, status_changed_by, access_seq, mac)
+    ON vault_members TO coffre_vault;
+--> statement-breakpoint
+GRANT SELECT, INSERT, DELETE ON vault_grants TO coffre_vault;
+--> statement-breakpoint
+GRANT UPDATE (next_seq, head_hash) ON audit_chain_head TO coffre_vault;
+--> statement-breakpoint
+
+REVOKE DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public FROM coffre_app;
+--> statement-breakpoint
+REVOKE TRUNCATE ON ALL TABLES IN SCHEMA public FROM coffre_vault;
+--> statement-breakpoint
+REVOKE UPDATE ON audit_log, secret_versions FROM coffre_app, coffre_vault;
+--> statement-breakpoint
+REVOKE CREATE ON SCHEMA public FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+
+-- Each login appends only as its own author. Its MAC is still what proves
+-- who wrote an entry: the table's owner passes these policies, as owners do.
+ALTER TABLE audit_log ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+CREATE POLICY audit_log_read ON audit_log FOR SELECT TO coffre_app, coffre_vault USING (true);
+--> statement-breakpoint
+CREATE POLICY audit_log_app_appends ON audit_log FOR INSERT TO coffre_app WITH CHECK (author = 'app');
+--> statement-breakpoint
+CREATE POLICY audit_log_vault_appends ON audit_log FOR INSERT TO coffre_vault WITH CHECK (author = 'vault');
+--> statement-breakpoint
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+    REVOKE ALL PRIVILEGES ON TABLES FROM coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+    REVOKE ALL PRIVILEGES ON SEQUENCES FROM coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+    REVOKE ALL PRIVILEGES ON ROUTINES FROM coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
+--> statement-breakpoint
+
+-- Each login is a member of its own group and of nothing else.
+DO $$
+DECLARE
+    login record;
+    membership record;
+BEGIN
+    EXECUTE format(
+        'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
+        current_database()
+    );
+
+    FOR login IN
+        SELECT * FROM (VALUES ('coffre_runtime', 'coffre_app'), ('coffre_vault_runtime', 'coffre_vault')) AS logins (name, grp)
+    LOOP
+        FOR membership IN
+            SELECT granted.rolname
+              FROM pg_auth_members member_of
+              JOIN pg_roles member ON member.oid = member_of.member
+              JOIN pg_roles granted ON granted.oid = member_of.roleid
+             WHERE member.rolname = login.name
+               AND granted.rolname <> login.grp
+        LOOP
+            EXECUTE format('REVOKE %I FROM %I', membership.rolname, login.name);
+        END LOOP;
+    END LOOP;
+END
+$$;
+--> statement-breakpoint
+
+GRANT coffre_app TO coffre_runtime WITH ADMIN FALSE, INHERIT TRUE, SET FALSE;
+--> statement-breakpoint
+GRANT coffre_vault TO coffre_vault_runtime WITH ADMIN FALSE, INHERIT TRUE, SET FALSE;