@coffre/db 0.0.0 → 0.1.1

package/src/schema.ts

@@ -0,0 +1,548 @@
+import { assignableToEnvironment, ROLE_NAMES } from '@coffre/core/access';
+import { sql } from 'drizzle-orm';
+import {
+  bigint,
+  boolean,
+  check,
+  customType,
+  foreignKey,
+  index,
+  integer,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  unique,
+  uniqueIndex,
+  uuid,
+  type AnyPgColumn,
+} from 'drizzle-orm/pg-core';
+
+import { ACTIVE_SUBJECT, relationsOf } from './relations.ts';
+
+const bytea = customType<{ data: Buffer }>({
+  dataType: () => 'bytea',
+});
+
+const createdAt = () => timestamp('created_at', { withTimezone: true }).notNull().defaultNow();
+
+export const projects = pgTable(
+  'projects',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    slug: text().notNull(),
+    name: text().notNull(),
+    createdAt: createdAt(),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+  },
+  (table) => [
+    unique('projects_slug_key').on(table.slug),
+    check('projects_slug_check', sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
+  ],
+);
+
+export const environments = pgTable(
+  'environments',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    projectId: uuid('project_id').notNull(),
+    slug: text().notNull(),
+    name: text().notNull(),
+    createdAt: createdAt(),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+  },
+  (table) => [
+    unique('environments_project_id_slug_key').on(table.projectId, table.slug),
+    unique('environments_project_scoped').on(table.id, table.projectId),
+    check('environments_slug_check', sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
+    foreignKey({
+      name: 'environments_project_id_fkey',
+      columns: [table.projectId],
+      foreignColumns: [projects.id],
+    }).onDelete('restrict'),
+  ],
+);
+
+export const secrets = pgTable(
+  'secrets',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    projectId: uuid('project_id').notNull(),
+    environmentId: uuid('environment_id').notNull(),
+    key: text().notNull(),
+    createdAt: createdAt(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+    currentVersionId: uuid('current_version_id').references(
+      (): AnyPgColumn => secretVersions.id,
+      { onDelete: 'no action' },
+    ),
+    // The number of the current version, 0 before the first. Versions only
+    // append, so it is also the highest: the next one is this plus one.
+    currentVersion: integer('current_version').notNull().default(0),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+  },
+  (table) => [
+    unique('secrets_project_id_environment_id_key_key').on(
+      table.projectId,
+      table.environmentId,
+      table.key,
+    ),
+    check('secrets_key_check', sql`${table.key} ~ '^[A-Za-z_][A-Za-z0-9_]{0,127}$'`),
+    foreignKey({
+      name: 'secrets_project_id_fkey',
+      columns: [table.projectId],
+      foreignColumns: [projects.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'secrets_environment_id_fkey',
+      columns: [table.environmentId],
+      foreignColumns: [environments.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'secrets_environment_in_project',
+      columns: [table.environmentId, table.projectId],
+      foreignColumns: [environments.id, environments.projectId],
+    }),
+    index('secrets_lookup_idx').on(table.projectId, table.environmentId, table.key),
+  ],
+);
+
+export const secretVersions = pgTable(
+  'secret_versions',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    secretId: uuid('secret_id').notNull(),
+    version: integer().notNull(),
+    envelopeVersion: integer('envelope_version').notNull(),
+    ciphertext: bytea().notNull(),
+    iv: bytea().notNull(),
+    authTag: bytea('auth_tag').notNull(),
+    wrappedDek: bytea('wrapped_dek').notNull(),
+    kekProvider: text('kek_provider').notNull(),
+    kekId: text('kek_id').notNull(),
+    kekVersion: text('kek_version').notNull(),
+    createdAt: createdAt(),
+    createdBy: text('created_by').notNull(),
+  },
+  (table) => [
+    unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
+    check('secret_versions_version_check', sql`${table.version} > 0`),
+    check('secret_versions_iv_check', sql`octet_length(${table.iv}) = 12`),
+    check('secret_versions_auth_tag_check', sql`octet_length(${table.authTag}) = 16`),
+    foreignKey({
+      name: 'secret_versions_secret_id_fkey',
+      columns: [table.secretId],
+      foreignColumns: [secrets.id],
+    }).onDelete('restrict'),
+    index('secret_versions_secret_idx').on(table.secretId, table.version.desc()),
+  ],
+);
+
+/** The role catalogue, as SQL: every role, and those an environment may be granted. */
+const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
+const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
+
+/**
+ * The vault's member directory: everyone it has admitted, written by the
+ * vault alone, read by both. A principal with no row is no member.
+ * Principals are the strings coffre uses at its edges: `user:<email>`,
+ * `token:<id>`, `sync:<id>`. Times are milliseconds since the epoch, each
+ * the time of the vault's log entry that set it, so the log replays to
+ * these rows exactly.
+ */
+export const vaultMembers = pgTable(
+  'vault_members',
+  {
+    principal: text().primaryKey(),
+    status: text().notNull(),
+    // An instance owner, who manages every project and member. Root admins
+    // come from the vault's configuration, never from a row.
+    owner: boolean().notNull().default(false),
+    // Advanced by each removal. A session, token or linked account issued
+    // under an older generation is dead, whatever its own row says.
+    generation: integer().notNull().default(0),
+    createdAt: bigint('created_at', { mode: 'number' }).notNull(),
+    createdBy: text('created_by').notNull(),
+    statusChangedAt: bigint('status_changed_at', { mode: 'number' }).notNull(),
+    statusChangedBy: text('status_changed_by').notNull(),
+    // The vault's last access entry about the member: a row put back from
+    // before a later change names an older one than the log has.
+    accessSeq: bigint('access_seq', { mode: 'bigint' }).notNull(),
+    // The vault's MAC over the row and the member's grants, lapsed ones too:
+    // a grant added, edited or deleted outside the vault fails it.
+    mac: bytea().notNull(),
+  },
+  (table) => [
+    check('vault_members_mac_check', sql`octet_length(${table.mac}) = 32`),
+    check('vault_members_principal_check', sql`${table.principal} ~ '^(user|token|sync):[^[:space:]:][^[:space:]]*$'`),
+    // A person is their email address, lowercased, as in sign-in.
+    check('vault_members_user_lowercase', sql`${table.principal} NOT LIKE 'user:%' OR ${table.principal} = lower(${table.principal})`),
+    check('vault_members_status_check', sql`${table.status} IN ('active', 'removed')`),
+    check('vault_members_owner_check', sql`NOT ${table.owner} OR (${table.status} = 'active' AND ${table.principal} LIKE 'user:%')`),
+    check('vault_members_generation_check', sql`${table.generation} >= 0`),
+  ],
+);
+
+/**
+ * One role per member per place: a project, or one of its environments,
+ * never both. A revoked grant is deleted; an expired one stays until its
+ * place is granted again, so the members page can say it lapsed.
+ */
+export const vaultGrants = pgTable(
+  'vault_grants',
+  {
+    principal: text().notNull(),
+    projectId: uuid('project_id'),
+    environmentId: uuid('environment_id'),
+    role: text().notNull(),
+    expiresAt: bigint('expires_at', { mode: 'number' }),
+    grantedAt: bigint('granted_at', { mode: 'number' }).notNull(),
+    grantedBy: text('granted_by').notNull(),
+  },
+  (table) => [
+    check('vault_grants_one_place', sql`(${table.projectId} IS NULL) <> (${table.environmentId} IS NULL)`),
+    check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
+    check('vault_grants_environment_role_check', sql`${table.environmentId} IS NULL OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+    unique('vault_grants_on_project').on(table.principal, table.projectId),
+    unique('vault_grants_on_environment').on(table.principal, table.environmentId),
+    foreignKey({
+      name: 'vault_grants_principal_fkey',
+      columns: [table.principal],
+      foreignColumns: [vaultMembers.principal],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'vault_grants_project_id_fkey',
+      columns: [table.projectId],
+      foreignColumns: [projects.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'vault_grants_environment_id_fkey',
+      columns: [table.environmentId],
+      foreignColumns: [environments.id],
+    }).onDelete('restrict'),
+  ],
+);
+
+export const auditLog = pgTable(
+  'audit_log',
+  {
+    seq: bigint({ mode: 'bigint' }).primaryKey(),
+    // Which component wrote the entry, under which of its keys; see
+    // @coffre/core/audit for what its MAC and hash cover.
+    author: text().notNull(),
+    keyId: text('key_id').notNull(),
+    // Milliseconds since the epoch, from the database's clock, read after the
+    // append took the head's lock.
+    occurredAt: bigint('occurred_at', { mode: 'number' }).notNull(),
+    // Who acted: `user:<email>`, `token:<id>`, `sync:<id>` or `system:<name>`.
+    actor: text().notNull(),
+    action: text().notNull(),
+    decision: text().notNull(),
+    code: text(),
+    // The member an access change is about.
+    subjectPrincipal: text('subject_principal'),
+    projectId: uuid('project_id'),
+    environmentId: uuid('environment_id'),
+    secretId: uuid('secret_id'),
+    secretVersionId: uuid('secret_version_id'),
+    // One id for everything one action did: a reveal's keys, a write's versions.
+    operationId: uuid('operation_id'),
+    requestId: text('request_id'),
+    sourceIp: text('source_ip'),
+    // An earlier entry this one follows from, such as the wrap behind a write.
+    relatedSeq: bigint('related_seq', { mode: 'bigint' }),
+    metadata: text().notNull().default('{}'),
+    prevHash: bytea('prev_hash').notNull(),
+    mac: bytea().notNull(),
+    hash: bytea().notNull(),
+  },
+  (table) => [
+    check('audit_log_author_check', sql`${table.author} IN ('app', 'vault')`),
+    check('audit_log_actor_check', sql`${table.actor} ~ '^(user|token|sync|system):.+$'`),
+    check('audit_log_decision_check', sql`${table.decision} IN ('allow', 'deny')`),
+    check('audit_log_metadata_check', sql`${table.metadata}::jsonb IS NOT NULL`),
+    check('audit_log_prev_hash_check', sql`octet_length(${table.prevHash}) = 32`),
+    check('audit_log_mac_check', sql`octet_length(${table.mac}) = 32`),
+    check('audit_log_hash_check', sql`octet_length(${table.hash}) = 32`),
+    foreignKey({
+      name: 'audit_log_project_id_fkey',
+      columns: [table.projectId],
+      foreignColumns: [projects.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'audit_log_environment_id_fkey',
+      columns: [table.environmentId],
+      foreignColumns: [environments.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'audit_log_secret_id_fkey',
+      columns: [table.secretId],
+      foreignColumns: [secrets.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'audit_log_secret_version_id_fkey',
+      columns: [table.secretVersionId],
+      foreignColumns: [secretVersions.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'audit_log_related_seq_fkey',
+      columns: [table.relatedSeq],
+      foreignColumns: [table.seq],
+    }).onDelete('restrict'),
+    // Pages read backwards by seq, within a place or an actor.
+    index('audit_log_project_idx').on(table.projectId, table.seq),
+    index('audit_log_environment_idx').on(table.environmentId, table.seq),
+    index('audit_log_secret_idx').on(table.secretId, table.seq),
+    index('audit_log_actor_idx').on(table.actor, table.seq),
+    index('audit_log_operation_idx').on(table.operationId, table.seq),
+    index('audit_log_action_idx').on(table.author, table.action, table.seq),
+    // The bulk limit: one reader's recent releases.
+    index('audit_log_releases_idx').on(table.author, table.actor, table.action, table.decision, table.occurredAt),
+    // What the vault logged about one member, in order.
+    index('audit_log_subject_idx').on(table.author, table.subjectPrincipal, table.seq),
+  ],
+);
+
+export const auditChainHead = pgTable(
+  'audit_chain_head',
+  {
+    onlyRow: boolean('only_row').primaryKey().default(true),
+    nextSeq: bigint('next_seq', { mode: 'bigint' }).notNull().default(sql`0`),
+    headHash: bytea('head_hash').notNull(),
+  },
+  (table) => [
+    check('audit_chain_head_only_row_check', sql`${table.onlyRow}`),
+    check('audit_chain_head_next_seq_check', sql`${table.nextSeq} >= 0`),
+    check('audit_chain_head_head_hash_check', sql`octet_length(${table.headHash}) = 32`),
+  ],
+);
+
+/**
+ * An account at a sign-in provider, bound to one principal.
+ *
+ * Looked up by (provider, subject), never by email. An email address is
+ * recycled when someone leaves; the provider's subject is not, so binding to
+ * it is what stops a new holder of an old address from inheriting its access.
+ * The email is kept for display only.
+ */
+export const identities = pgTable(
+  'identities',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    provider: text().notNull(),
+    authMac: bytea('auth_mac').notNull(),
+    subject: text().notNull(),
+    issuerHash: text('issuer_hash').notNull(),
+    generation: integer().notNull(),
+    // The member it signs in as, `user:<email>`, under the generation it was bound in.
+    principal: text().notNull(),
+    email: text(),
+    createdAt: createdAt(),
+    createdBy: text('created_by').notNull(),
+    lastSignInAt: timestamp('last_sign_in_at', { withTimezone: true }),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    revokedBy: text('revoked_by'),
+    activeSubject: text('active_subject').generatedAlwaysAs(ACTIVE_SUBJECT),
+  },
+  (table) => [
+    check('identities_principal_check', sql`${table.principal} LIKE 'user:%'`),
+    check('identities_provider_check', sql`${table.provider} ~ '^[a-z0-9][a-z0-9-]{0,31}$'`),
+    check('identities_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
+    unique('identities_member_generation_key').on(table.id, table.principal, table.generation),
+    foreignKey({
+      name: 'identities_principal_fkey',
+      columns: [table.principal],
+      foreignColumns: [vaultMembers.principal],
+    }).onDelete('restrict'),
+    // An account is bound to one person at a time: the subject counts only
+    // while the identity is not revoked (see ACTIVE_SUBJECT).
+    uniqueIndex('identities_active_subject').on(table.provider, table.issuerHash, table.activeSubject),
+    index('identities_principal_idx').on(table.principal, table.generation),
+  ],
+);
+
+/**
+ * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
+ * service tokens.
+ *
+ * One table, so that revoking everything a principal holds is one statement.
+ * Only a SHA-256 of each token is stored. Tokens carry 256 bits of entropy, so
+ * a fast hash is enough; a database leak yields nothing that authenticates.
+ */
+export const credentials = pgTable(
+  'credentials',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    kind: text().notNull(),
+    authMac: bytea('auth_mac').notNull(),
+    tokenHash: bytea('token_hash').notNull(),
+    tokenHint: text('token_hint').notNull(),
+    generation: integer().notNull(),
+    // The member it acts as, `user:<email>` or `token:<id>`, under the generation it was issued in.
+    principal: text().notNull(),
+    identityId: uuid('identity_id'),
+    label: text(),
+    createdAt: createdAt(),
+    createdBy: text('created_by').notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
+    lastUsedIp: text('last_used_ip'),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    revokedBy: text('revoked_by'),
+  },
+  (table) => [
+    unique('credentials_token_hash_key').on(table.tokenHash),
+    check('credentials_kind_check', sql`${table.kind} IN ('browser', 'cli', 'service')`),
+    check('credentials_principal_check', sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
+    check('credentials_kind_matches_principal', sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
+    check('credentials_token_hash_check', sql`octet_length(${table.tokenHash}) = 32`),
+    check('credentials_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
+    foreignKey({
+      name: 'credentials_principal_fkey',
+      columns: [table.principal],
+      foreignColumns: [vaultMembers.principal],
+    }).onDelete('restrict'),
+    // A session's account is its own member's, bound in the same generation.
+    foreignKey({
+      name: 'credentials_identity_id_fkey',
+      columns: [table.identityId, table.principal, table.generation],
+      foreignColumns: [identities.id, identities.principal, identities.generation],
+    }).onDelete('restrict'),
+    index('credentials_principal_idx').on(table.principal, table.generation),
+  ],
+);
+
+/**
+ * A CLI asking to be signed in from a browser (RFC 8628, device flow).
+ *
+ * The CLI holds the device code and polls with it; a signed-in person approves
+ * the short user code in their browser. It works the same on a laptop and on
+ * a server reached over SSH, which a localhost redirect does not.
+ */
+export const deviceAuthorizations = pgTable(
+  'device_authorizations',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    deviceCodeHash: bytea('device_code_hash').notNull(),
+    authMac: bytea('auth_mac').notNull(),
+    userCode: text('user_code').notNull(),
+    clientLabel: text('client_label'),
+    clientIp: text('client_ip'),
+    createdAt: createdAt(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    decidedAt: timestamp('decided_at', { withTimezone: true }),
+    decision: text(),
+    generation: integer().notNull().default(0),
+    // Who approved it, `user:<email>`, once approved.
+    principal: text(),
+    consumedAt: timestamp('consumed_at', { withTimezone: true }),
+  },
+  (table) => [
+    unique('device_authorizations_device_code_hash_key').on(table.deviceCodeHash),
+    unique('device_authorizations_user_code_key').on(table.userCode),
+    check('device_authorizations_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
+    check(
+      'device_authorizations_decision_check',
+      sql`${table.decision} IS NULL OR ${table.decision} IN ('approved', 'denied')`,
+    ),
+    check(
+      'device_authorizations_approval_names_principal',
+      sql`(${table.decision} IS NULL AND ${table.decidedAt} IS NULL AND ${table.principal} IS NULL AND ${table.generation} = 0 AND ${table.consumedAt} IS NULL)
+        OR (${table.decision} IS NOT NULL AND ${table.decidedAt} IS NOT NULL AND (
+          (${table.decision} = 'denied' AND ${table.principal} IS NULL AND ${table.generation} = 0 AND ${table.consumedAt} IS NULL)
+          OR (${table.decision} = 'approved' AND ${table.principal} IS NOT NULL AND ${table.principal} LIKE 'user:%')
+        ))`,
+    ),
+    foreignKey({
+      name: 'device_authorizations_principal_fkey',
+      columns: [table.principal],
+      foreignColumns: [vaultMembers.principal],
+    }).onDelete('restrict'),
+  ],
+);
+
+/**
+ * An environment kept in step with a third-party service: GitHub Actions
+ * secrets, Vercel or Railway variables, Worker secrets.
+ *
+ * The destination's API token is itself a coffre secret, referenced by id, so
+ * it is encrypted, versioned and audited like everything else and never sits
+ * in this table.
+ */
+export const syncs = pgTable(
+  'syncs',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    projectId: uuid('project_id').notNull(),
+    environmentId: uuid('environment_id').notNull(),
+    provider: text().notNull(),
+    config: text().notNull(),
+    credentialSecretId: uuid('credential_secret_id').notNull(),
+    createdAt: createdAt(),
+    createdBy: text('created_by').notNull(),
+    pausedAt: timestamp('paused_at', { withTimezone: true }),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    leaseUntil: timestamp('lease_until', { withTimezone: true }),
+    lastRunAt: timestamp('last_run_at', { withTimezone: true }),
+    lastStatus: text('last_status'),
+    lastError: text('last_error'),
+  },
+  (table) => [
+    check('syncs_config_check', sql`${table.config}::jsonb IS NOT NULL`),
+    check(
+      'syncs_last_status_check',
+      sql`${table.lastStatus} IS NULL OR ${table.lastStatus} IN ('ok', 'partial', 'failed')`,
+    ),
+    foreignKey({
+      name: 'syncs_environment_in_project',
+      columns: [table.environmentId, table.projectId],
+      foreignColumns: [environments.id, environments.projectId],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'syncs_credential_secret_id_fkey',
+      columns: [table.credentialSecretId],
+      foreignColumns: [secrets.id],
+    }).onDelete('restrict'),
+    index('syncs_environment_idx').on(table.environmentId),
+  ],
+);
+
+/**
+ * What a sync last pushed, one row per key.
+ *
+ * Most destinations are write-only, so coffre cannot diff against them. It
+ * diffs against this instead: a key is stale when its secret has moved past
+ * the version recorded here. It is also the list of keys coffre may delete at
+ * the destination; a key it never pushed is never removed.
+ */
+export const syncKeys = pgTable(
+  'sync_keys',
+  {
+    syncId: uuid('sync_id').notNull(),
+    key: text().notNull(),
+    secretVersionId: uuid('secret_version_id'),
+    pushedAt: timestamp('pushed_at', { withTimezone: true }).notNull().defaultNow(),
+    removedAt: timestamp('removed_at', { withTimezone: true }),
+  },
+  (table) => [
+    primaryKey({ name: 'sync_keys_pkey', columns: [table.syncId, table.key] }),
+    foreignKey({
+      name: 'sync_keys_sync_id_fkey',
+      columns: [table.syncId],
+      foreignColumns: [syncs.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'sync_keys_secret_version_id_fkey',
+      columns: [table.secretVersionId],
+      foreignColumns: [secretVersions.id],
+    }).onDelete('restrict'),
+  ],
+);
+
+// For Drizzle's relational queries; see relations.ts.
+export const {
+  environmentsRelations,
+  secretsRelations,
+  syncsRelations,
+  syncKeysRelations,
+} = relationsOf({ projects, environments, secrets, secretVersions, syncs, syncKeys });

package/src/verify-runtime.ts

@@ -0,0 +1,122 @@
+import assert from 'node:assert/strict';
+import pg from 'pg';
+
+import { postgresConnection } from './postgres.ts';
+
+function requiredEnvironment(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+const expectedRole = requiredEnvironment('COFFRE_RUNTIME_ROLE');
+const pool = new pg.Pool({
+  application_name: 'coffre-runtime-verification',
+  ...postgresConnection(requiredEnvironment('DATABASE_URL')),
+  max: 1,
+});
+
+try {
+  const identity = await pool.query<{
+    current_user: string;
+    memberships: string[];
+    safe_membership: boolean;
+    unsafe_attributes: boolean;
+  }>(
+    `SELECT current_user,
+            (
+              role.rolsuper OR role.rolcreatedb OR role.rolcreaterole
+              OR role.rolreplication OR role.rolbypassrls
+            ) AS unsafe_attributes,
+            ARRAY(
+              SELECT granted.rolname
+                FROM pg_auth_members membership
+                JOIN pg_roles granted ON granted.oid = membership.roleid
+               WHERE membership.member = role.oid
+               ORDER BY granted.rolname
+            )::text[] AS memberships,
+            (
+              SELECT NOT membership.admin_option
+                     AND membership.inherit_option
+                     AND NOT membership.set_option
+                FROM pg_auth_members membership
+                JOIN pg_roles granted ON granted.oid = membership.roleid
+               WHERE membership.member = role.oid
+                 AND granted.rolname = 'coffre_app'
+            ) AS safe_membership
+       FROM pg_roles role
+      WHERE role.rolname = current_user`,
+  );
+  assert.deepEqual(identity.rows, [{
+    current_user: expectedRole,
+    memberships: ['coffre_app'],
+    safe_membership: true,
+    unsafe_attributes: false,
+  }]);
+
+  const ownership = await pool.query<{ object_count: number }>(
+    `SELECT count(*)::int AS object_count
+       FROM pg_shdepend dependency
+       JOIN pg_roles role ON role.oid = dependency.refobjid
+      WHERE dependency.refclassid = 'pg_authid'::regclass
+        AND dependency.deptype = 'o'
+        AND role.rolname = current_user`,
+  );
+  assert.equal(ownership.rows[0]?.object_count, 0, 'runtime role owns database objects');
+
+  const privileges = await pool.query<{
+    audit_delete: boolean;
+    audit_truncate: boolean;
+    audit_update: boolean;
+    database_create: boolean;
+    database_temporary: boolean;
+    head_next_seq_update: boolean;
+    head_hash_update: boolean;
+    migrations_select: boolean;
+    schema_create: boolean;
+  }>(
+    `SELECT has_database_privilege(current_user, current_database(), 'CREATE') AS database_create,
+            has_database_privilege(current_user, current_database(), 'TEMPORARY') AS database_temporary,
+            has_schema_privilege(current_user, 'public', 'CREATE') AS schema_create,
+            has_table_privilege(current_user, 'public.audit_log', 'UPDATE') AS audit_update,
+            has_table_privilege(current_user, 'public.audit_log', 'DELETE') AS audit_delete,
+            has_table_privilege(current_user, 'public.audit_log', 'TRUNCATE') AS audit_truncate,
+            has_column_privilege(
+              current_user, 'public.audit_chain_head', 'next_seq', 'UPDATE'
+            ) AS head_next_seq_update,
+            has_column_privilege(
+              current_user, 'public.audit_chain_head', 'head_hash', 'UPDATE'
+            ) AS head_hash_update,
+            has_table_privilege(
+              current_user, 'drizzle.__drizzle_migrations', 'SELECT'
+            ) AS migrations_select`,
+  );
+  assert.deepEqual(privileges.rows, [{
+    audit_delete: false,
+    audit_truncate: false,
+    audit_update: false,
+    database_create: false,
+    database_temporary: false,
+    head_next_seq_update: true,
+    head_hash_update: true,
+    migrations_select: true,
+    schema_create: false,
+  }]);
+
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    // What every append does to the log's head, rolled back.
+    const head = await client.query(
+      `UPDATE audit_chain_head SET next_seq = next_seq, head_hash = head_hash WHERE only_row`,
+    );
+    assert.equal(head.rowCount, 1, 'runtime head update did not affect the singleton');
+  } finally {
+    await client.query('ROLLBACK');
+    client.release();
+  }
+
+  console.log(`runtime database role ${expectedRole} passed privilege verification`);
+} finally {
+  await pool.end();
+}