@coffre/db 0.0.0-stage → 0.1.0

package/src/migrations/postgres/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1790874461895,
+      "tag": "0000_baseline",
+      "breakpoints": true
+    }
+  ]
+}

package/src/migrations/sqlite/0000_baseline.sql

@@ -0,0 +1,293 @@
+-- The schema on SQLite. Generated by `pnpm db:generate` from
+-- baseline/sqlite.sql and src/schema.sqlite.ts; edit those, not this.
+
+CREATE TABLE `audit_chain_head` (
+	`only_row` integer PRIMARY KEY DEFAULT true NOT NULL,
+	`next_seq` integer DEFAULT 0 NOT NULL,
+	`head_hash` blob NOT NULL,
+	CONSTRAINT "audit_chain_head_only_row_check" CHECK("audit_chain_head"."only_row"),
+	CONSTRAINT "audit_chain_head_next_seq_check" CHECK("audit_chain_head"."next_seq" >= 0),
+	CONSTRAINT "audit_chain_head_head_hash_check" CHECK(octet_length("audit_chain_head"."head_hash") = 32)
+);
+--> statement-breakpoint
+CREATE TABLE `audit_log` (
+	`seq` integer PRIMARY KEY NOT NULL,
+	`author` text NOT NULL,
+	`key_id` text NOT NULL,
+	`occurred_at` integer NOT NULL,
+	`actor` text NOT NULL,
+	`action` text NOT NULL,
+	`decision` text NOT NULL,
+	`code` text,
+	`subject_principal` text,
+	`project_id` text,
+	`environment_id` text,
+	`secret_id` text,
+	`secret_version_id` text,
+	`operation_id` text,
+	`request_id` text,
+	`source_ip` text,
+	`related_seq` integer,
+	`metadata` text DEFAULT '{}' NOT NULL,
+	`prev_hash` blob NOT NULL,
+	`mac` blob NOT NULL,
+	`hash` blob NOT NULL,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`environment_id`) REFERENCES `environments`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`secret_id`) REFERENCES `secrets`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`secret_version_id`) REFERENCES `secret_versions`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`related_seq`) REFERENCES `audit_log`(`seq`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "audit_log_author_check" CHECK("audit_log"."author" IN ('app', 'vault')),
+	CONSTRAINT "audit_log_actor_check" CHECK("audit_log"."actor" GLOB 'user:?*' OR "audit_log"."actor" GLOB 'token:?*' OR "audit_log"."actor" GLOB 'sync:?*' OR "audit_log"."actor" GLOB 'system:?*'),
+	CONSTRAINT "audit_log_decision_check" CHECK("audit_log"."decision" IN ('allow', 'deny')),
+	CONSTRAINT "audit_log_metadata_check" CHECK(json_valid("audit_log"."metadata")),
+	CONSTRAINT "audit_log_prev_hash_check" CHECK(octet_length("audit_log"."prev_hash") = 32),
+	CONSTRAINT "audit_log_mac_check" CHECK(octet_length("audit_log"."mac") = 32),
+	CONSTRAINT "audit_log_hash_check" CHECK(octet_length("audit_log"."hash") = 32)
+);
+--> statement-breakpoint
+CREATE INDEX `audit_log_project_idx` ON `audit_log` (`project_id`,`seq`);--> statement-breakpoint
+CREATE INDEX `audit_log_environment_idx` ON `audit_log` (`environment_id`,`seq`);--> statement-breakpoint
+CREATE INDEX `audit_log_secret_idx` ON `audit_log` (`secret_id`,`seq`);--> statement-breakpoint
+CREATE INDEX `audit_log_actor_idx` ON `audit_log` (`actor`,`seq`);--> statement-breakpoint
+CREATE INDEX `audit_log_operation_idx` ON `audit_log` (`operation_id`,`seq`);--> statement-breakpoint
+CREATE INDEX `audit_log_action_idx` ON `audit_log` (`author`,`action`,`seq`);--> statement-breakpoint
+CREATE INDEX `audit_log_releases_idx` ON `audit_log` (`author`,`actor`,`action`,`decision`,`occurred_at`);--> statement-breakpoint
+CREATE INDEX `audit_log_subject_idx` ON `audit_log` (`author`,`subject_principal`,`seq`);--> statement-breakpoint
+CREATE TABLE `credentials` (
+	`id` text PRIMARY KEY NOT NULL,
+	`kind` text NOT NULL,
+	`auth_mac` blob NOT NULL,
+	`token_hash` blob NOT NULL,
+	`token_hint` text NOT NULL,
+	`generation` integer NOT NULL,
+	`principal` text NOT NULL,
+	`identity_id` text,
+	`label` text,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`created_by` text NOT NULL,
+	`expires_at` integer NOT NULL,
+	`last_used_at` integer,
+	`last_used_ip` text,
+	`revoked_at` integer,
+	`revoked_by` text,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`identity_id`,`principal`,`generation`) REFERENCES `identities`(`id`,`principal`,`generation`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "credentials_kind_check" CHECK("credentials"."kind" IN ('browser', 'cli', 'service')),
+	CONSTRAINT "credentials_principal_check" CHECK("credentials"."principal" LIKE 'user:%' OR "credentials"."principal" LIKE 'token:%'),
+	CONSTRAINT "credentials_kind_matches_principal" CHECK(("credentials"."kind" = 'service') = ("credentials"."principal" LIKE 'token:%')),
+	CONSTRAINT "credentials_token_hash_check" CHECK(octet_length("credentials"."token_hash") = 32),
+	CONSTRAINT "credentials_auth_mac_check" CHECK(octet_length("credentials"."auth_mac") = 32)
+);
+--> statement-breakpoint
+CREATE INDEX `credentials_principal_idx` ON `credentials` (`principal`,`generation`);--> statement-breakpoint
+CREATE UNIQUE INDEX `credentials_token_hash_key` ON `credentials` (`token_hash`);--> statement-breakpoint
+CREATE TABLE `device_authorizations` (
+	`id` text PRIMARY KEY NOT NULL,
+	`device_code_hash` blob NOT NULL,
+	`auth_mac` blob NOT NULL,
+	`user_code` text NOT NULL,
+	`client_label` text,
+	`client_ip` text,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`expires_at` integer NOT NULL,
+	`decided_at` integer,
+	`decision` text,
+	`generation` integer DEFAULT 0 NOT NULL,
+	`principal` text,
+	`consumed_at` integer,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "device_authorizations_auth_mac_check" CHECK(octet_length("device_authorizations"."auth_mac") = 32),
+	CONSTRAINT "device_authorizations_decision_check" CHECK("device_authorizations"."decision" IS NULL OR "device_authorizations"."decision" IN ('approved', 'denied')),
+	CONSTRAINT "device_authorizations_approval_names_principal" CHECK(("device_authorizations"."decision" IS NULL AND "device_authorizations"."decided_at" IS NULL AND "device_authorizations"."principal" IS NULL AND "device_authorizations"."generation" = 0 AND "device_authorizations"."consumed_at" IS NULL)
+        OR ("device_authorizations"."decision" IS NOT NULL AND "device_authorizations"."decided_at" IS NOT NULL AND (
+          ("device_authorizations"."decision" = 'denied' AND "device_authorizations"."principal" IS NULL AND "device_authorizations"."generation" = 0 AND "device_authorizations"."consumed_at" IS NULL)
+          OR ("device_authorizations"."decision" = 'approved' AND "device_authorizations"."principal" IS NOT NULL AND "device_authorizations"."principal" LIKE 'user:%')
+        )))
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `device_authorizations_device_code_hash_key` ON `device_authorizations` (`device_code_hash`);--> statement-breakpoint
+CREATE UNIQUE INDEX `device_authorizations_user_code_key` ON `device_authorizations` (`user_code`);--> statement-breakpoint
+CREATE TABLE `environments` (
+	`id` text PRIMARY KEY NOT NULL,
+	`project_id` text NOT NULL,
+	`slug` text NOT NULL,
+	`name` text NOT NULL,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`archived_at` integer,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "environments_slug_check" CHECK(length("environments"."slug") BETWEEN 1 AND 63 AND "environments"."slug" GLOB '[a-z0-9]*' AND "environments"."slug" NOT GLOB '*[^a-z0-9-]*')
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `environments_project_id_slug_key` ON `environments` (`project_id`,`slug`);--> statement-breakpoint
+CREATE UNIQUE INDEX `environments_project_scoped` ON `environments` (`id`,`project_id`);--> statement-breakpoint
+CREATE TABLE `identities` (
+	`id` text PRIMARY KEY NOT NULL,
+	`provider` text NOT NULL,
+	`auth_mac` blob NOT NULL,
+	`subject` text NOT NULL,
+	`issuer_hash` text NOT NULL,
+	`generation` integer NOT NULL,
+	`principal` text NOT NULL,
+	`email` text,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`created_by` text NOT NULL,
+	`last_sign_in_at` integer,
+	`revoked_at` integer,
+	`revoked_by` text,
+	`active_subject` text GENERATED ALWAYS AS (CASE WHEN revoked_at IS NULL THEN subject END) STORED,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "identities_principal_check" CHECK("identities"."principal" LIKE 'user:%'),
+	CONSTRAINT "identities_provider_check" CHECK(length("identities"."provider") BETWEEN 1 AND 32 AND "identities"."provider" GLOB '[a-z0-9]*' AND "identities"."provider" NOT GLOB '*[^a-z0-9-]*'),
+	CONSTRAINT "identities_auth_mac_check" CHECK(octet_length("identities"."auth_mac") = 32)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `identities_active_subject` ON `identities` (`provider`,`issuer_hash`,`active_subject`);--> statement-breakpoint
+CREATE INDEX `identities_principal_idx` ON `identities` (`principal`,`generation`);--> statement-breakpoint
+CREATE UNIQUE INDEX `identities_member_generation_key` ON `identities` (`id`,`principal`,`generation`);--> statement-breakpoint
+CREATE TABLE `projects` (
+	`id` text PRIMARY KEY NOT NULL,
+	`slug` text NOT NULL,
+	`name` text NOT NULL,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`archived_at` integer,
+	CONSTRAINT "projects_slug_check" CHECK(length("projects"."slug") BETWEEN 1 AND 63 AND "projects"."slug" GLOB '[a-z0-9]*' AND "projects"."slug" NOT GLOB '*[^a-z0-9-]*')
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `projects_slug_key` ON `projects` (`slug`);--> statement-breakpoint
+CREATE TABLE `secret_versions` (
+	`id` text PRIMARY KEY NOT NULL,
+	`secret_id` text NOT NULL,
+	`version` integer NOT NULL,
+	`envelope_version` integer NOT NULL,
+	`ciphertext` blob NOT NULL,
+	`iv` blob NOT NULL,
+	`auth_tag` blob NOT NULL,
+	`wrapped_dek` blob NOT NULL,
+	`kek_provider` text NOT NULL,
+	`kek_id` text NOT NULL,
+	`kek_version` text NOT NULL,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`created_by` text NOT NULL,
+	FOREIGN KEY (`secret_id`) REFERENCES `secrets`(`id`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "secret_versions_version_check" CHECK("secret_versions"."version" > 0),
+	CONSTRAINT "secret_versions_iv_check" CHECK(octet_length("secret_versions"."iv") = 12),
+	CONSTRAINT "secret_versions_auth_tag_check" CHECK(octet_length("secret_versions"."auth_tag") = 16)
+);
+--> statement-breakpoint
+CREATE INDEX `secret_versions_secret_idx` ON `secret_versions` (`secret_id`,`version`);--> statement-breakpoint
+CREATE UNIQUE INDEX `secret_versions_secret_id_version_key` ON `secret_versions` (`secret_id`,`version`);--> statement-breakpoint
+CREATE TABLE `secrets` (
+	`id` text PRIMARY KEY NOT NULL,
+	`project_id` text NOT NULL,
+	`environment_id` text NOT NULL,
+	`key` text NOT NULL,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`updated_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`current_version_id` text,
+	`current_version` integer DEFAULT 0 NOT NULL,
+	`archived_at` integer,
+	FOREIGN KEY (`current_version_id`) REFERENCES `secret_versions`(`id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`environment_id`) REFERENCES `environments`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`environment_id`,`project_id`) REFERENCES `environments`(`id`,`project_id`) ON UPDATE no action ON DELETE no action,
+	CONSTRAINT "secrets_key_check" CHECK(length("secrets"."key") BETWEEN 1 AND 128 AND "secrets"."key" GLOB '[A-Za-z_]*' AND "secrets"."key" NOT GLOB '*[^A-Za-z0-9_]*')
+);
+--> statement-breakpoint
+CREATE INDEX `secrets_lookup_idx` ON `secrets` (`project_id`,`environment_id`,`key`);--> statement-breakpoint
+CREATE UNIQUE INDEX `secrets_project_id_environment_id_key_key` ON `secrets` (`project_id`,`environment_id`,`key`);--> statement-breakpoint
+CREATE TABLE `sync_keys` (
+	`sync_id` text NOT NULL,
+	`key` text NOT NULL,
+	`secret_version_id` text,
+	`pushed_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`removed_at` integer,
+	PRIMARY KEY(`sync_id`, `key`),
+	FOREIGN KEY (`sync_id`) REFERENCES `syncs`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`secret_version_id`) REFERENCES `secret_versions`(`id`) ON UPDATE no action ON DELETE restrict
+);
+--> statement-breakpoint
+CREATE TABLE `syncs` (
+	`id` text PRIMARY KEY NOT NULL,
+	`project_id` text NOT NULL,
+	`environment_id` text NOT NULL,
+	`provider` text NOT NULL,
+	`config` text NOT NULL,
+	`credential_secret_id` text NOT NULL,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`created_by` text NOT NULL,
+	`paused_at` integer,
+	`archived_at` integer,
+	`lease_until` integer,
+	`last_run_at` integer,
+	`last_status` text,
+	`last_error` text,
+	FOREIGN KEY (`environment_id`,`project_id`) REFERENCES `environments`(`id`,`project_id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`credential_secret_id`) REFERENCES `secrets`(`id`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "syncs_config_check" CHECK(json_valid("syncs"."config")),
+	CONSTRAINT "syncs_last_status_check" CHECK("syncs"."last_status" IS NULL OR "syncs"."last_status" IN ('ok', 'partial', 'failed'))
+);
+--> statement-breakpoint
+CREATE INDEX `syncs_environment_idx` ON `syncs` (`environment_id`);--> statement-breakpoint
+CREATE TABLE `vault_grants` (
+	`principal` text NOT NULL,
+	`project_id` text,
+	`environment_id` text,
+	`role` text NOT NULL,
+	`expires_at` integer,
+	`granted_at` integer NOT NULL,
+	`granted_by` text NOT NULL,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`environment_id`) REFERENCES `environments`(`id`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "vault_grants_one_place" CHECK(("vault_grants"."project_id" IS NULL) <> ("vault_grants"."environment_id" IS NULL)),
+	CONSTRAINT "vault_grants_role_check" CHECK("vault_grants"."role" IN ('viewer', 'developer', 'maintainer', 'access-manager', 'auditor', 'owner')),
+	CONSTRAINT "vault_grants_environment_role_check" CHECK("vault_grants"."environment_id" IS NULL OR "vault_grants"."role" IN ('viewer', 'developer', 'auditor'))
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_project` ON `vault_grants` (`principal`,`project_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_environment` ON `vault_grants` (`principal`,`environment_id`);--> statement-breakpoint
+CREATE TABLE `vault_members` (
+	`principal` text PRIMARY KEY NOT NULL,
+	`status` text NOT NULL,
+	`owner` integer DEFAULT false NOT NULL,
+	`generation` integer DEFAULT 0 NOT NULL,
+	`created_at` integer NOT NULL,
+	`created_by` text NOT NULL,
+	`status_changed_at` integer NOT NULL,
+	`status_changed_by` text NOT NULL,
+	`access_seq` integer NOT NULL,
+	`mac` blob NOT NULL,
+	CONSTRAINT "vault_members_mac_check" CHECK(octet_length("vault_members"."mac") = 32),
+	CONSTRAINT "vault_members_principal_check" CHECK(("vault_members"."principal" GLOB 'user:?*' OR "vault_members"."principal" GLOB 'token:?*' OR "vault_members"."principal" GLOB 'sync:?*')
+        AND substr("vault_members"."principal", instr("vault_members"."principal", ':') + 1, 1) <> ':'
+        AND instr("vault_members"."principal", ' ') = 0 AND instr("vault_members"."principal", char(9)) = 0
+        AND instr("vault_members"."principal", char(10)) = 0 AND instr("vault_members"."principal", char(13)) = 0),
+	CONSTRAINT "vault_members_user_lowercase" CHECK("vault_members"."principal" NOT LIKE 'user:%' OR "vault_members"."principal" = lower("vault_members"."principal")),
+	CONSTRAINT "vault_members_status_check" CHECK("vault_members"."status" IN ('active', 'removed')),
+	CONSTRAINT "vault_members_owner_check" CHECK(NOT "vault_members"."owner" OR ("vault_members"."status" = 'active' AND "vault_members"."principal" LIKE 'user:%')),
+	CONSTRAINT "vault_members_generation_check" CHECK("vault_members"."generation" >= 0)
+);--> statement-breakpoint
+
+-- The chain starts at sequence 0 from 32 zero bytes.
+INSERT INTO `audit_chain_head` (`only_row`, `next_seq`, `head_hash`) VALUES (true, 0, zeroblob(32));
+--> statement-breakpoint
+
+-- The audit log only grows: no statement may change or delete an entry.
+-- What gets past this anyway, the entries' MACs and chain show.
+-- REPLACE can delete without firing DELETE triggers, so refuse it before insert.
+CREATE TRIGGER `audit_log_no_replace` BEFORE INSERT ON `audit_log`
+WHEN EXISTS (SELECT 1 FROM `audit_log` WHERE `seq` = NEW.`seq`)
+BEGIN
+    SELECT RAISE(ABORT, 'audit_log is append-only');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `audit_log_no_update` BEFORE UPDATE ON `audit_log`
+BEGIN
+    SELECT RAISE(ABORT, 'audit_log is append-only');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `audit_log_no_delete` BEFORE DELETE ON `audit_log`
+BEGIN
+    SELECT RAISE(ABORT, 'audit_log is append-only');
+END;