@coffre/db 0.1.0 → 0.1.2

package/README.md

@@ -8,7 +8,13 @@ connections, Hyperdrive's included.
 A deployment does not import it. `@coffre/server` runs its migrations with
 `coffre-server migrate`. The server and vault open the same database with
 separate logins, `coffre_runtime` and `coffre_vault_runtime`. The migrations
-grant each its own rights; only the owner runs migrations.
+grant each its own rights; only the owner runs migrations. The owner needs
+`CREATEROLE` and `CREATEDB`, and `ADMIN OPTION` on existing group roles.
+Superuser is not required.
+
+Node connections accept `sslrootcert=system` with `sslmode=verify-full`
+and use Node's default trusted CAs. They check both the certificate chain
+and the database hostname.
 
 Part of [coffre](https://github.com/erwinkn/coffre), a secrets manager you
 deploy as a small project of your own. Its eight `@coffre/*` packages are

package/dist/connect.d.ts

@@ -1,5 +1,10 @@
 import { t as Database } from "./database-CWpo5aF0.js";
 import { Engine } from "./dialect.js";
+import { ClientConfig } from "pg";
+//#region src/postgres.d.ts
+/** Keep libpq's system-root shortcut from being read as a certificate filename by pg. */
+export declare function postgresConnection(url: string): ClientConfig;
+//#endregion
 //#region src/connect.d.ts
 /**
  * Open a database from its URL, on a Node server:

package/dist/connect.js

@@ -1,5 +1,6 @@
 import { createDatabase } from "./index.js";
 import { asPostgresDatabase } from "./portable.js";
+import { t as postgresConnection } from "./postgres-Bmar8y0q.js";
 import pg from "pg";
 import { resolve } from "node:path";
 //#region src/connect.ts
@@ -16,7 +17,7 @@ import { resolve } from "node:path";
 async function openDatabase(url) {
 	switch (engineOfUrl(url)) {
 		case "postgres": {
-			const pool = new pg.Pool({ connectionString: url });
+			const pool = new pg.Pool(postgresConnection(url));
 			return {
 				engine: "postgres",
 				db: createDatabase(pool),
@@ -152,4 +153,4 @@ function numbers(result) {
 	return result;
 }
 //#endregion
-export { engineOfUrl, openDatabase };
+export { engineOfUrl, openDatabase, postgresConnection };

package/dist/hyperdrive.js

@@ -1,3 +1,4 @@
+import { t as postgresConnection } from "./postgres-Bmar8y0q.js";
 import pg from "pg";
 //#region src/hyperdrive.ts
 /** Postgres through Hyperdrive, the one database a Worker runs on, the app's and the vault's. */
@@ -44,7 +45,7 @@ var HyperdrivePool = class {
 		};
 	}
 	async #connectClient() {
-		const client = new pg.Client({ connectionString: this.#connectionString });
+		const client = new pg.Client(postgresConnection(this.#connectionString));
 		await client.connect();
 		return client;
 	}

package/dist/log.d.ts

@@ -68,5 +68,11 @@ export declare function lockLogHead(tx: Transaction): Promise<{
   nextSeq: bigint;
   headHash: Buffer;
 }>;
-export declare function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[]): Promise<Appended>;
+/**
+ * Append `entries` under `key`. `check`, when given, runs once the head is
+ * locked and before anything is written: a writer's own condition on the
+ * log as it stands, which no other append can change until this one
+ * commits. It throws to refuse.
+ */
+export declare function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[], check?: (tx: Transaction) => Promise<void>): Promise<Appended>;
 //#endregion

package/dist/log.js

@@ -60,10 +60,17 @@ async function lockLogHead(tx) {
 	if (head === void 0) throw new Error("audit_chain_head is missing; refusing to write an unchained entry");
 	return head;
 }
-async function appendEntries(tx, key, entries) {
+/**
+* Append `entries` under `key`. `check`, when given, runs once the head is
+* locked and before anything is written: a writer's own condition on the
+* log as it stands, which no other append can change until this one
+* commits. It throws to refuse.
+*/
+async function appendEntries(tx, key, entries, check) {
 	if (entries.length === 0) throw new Error("appendEntries called with no entries");
 	const { auditChainHead, auditLog } = tablesOf(tx);
 	const head = await lockLogHead(tx);
+	await check?.(tx);
 	const [{ now }] = await tx.select({ now: clockMillis(tx) }).from(auditChainHead);
 	const [last] = await tx.select({
 		seq: auditLog.seq,

package/dist/migrate.js

@@ -1,3 +1,4 @@
+import { t as postgresConnection } from "./postgres-Bmar8y0q.js";
 import { engineOfUrl } from "./connect.js";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
@@ -53,8 +54,8 @@ async function postgresMigrator(url) {
 		import("drizzle-orm/node-postgres/migrator")
 	]);
 	const pool = new pg.Pool({
+		...postgresConnection(url),
 		application_name: "coffre-migrations",
-		connectionString: url,
 		max: 1
 	});
 	const client = await pool.connect();

package/dist/migrations/postgres/0000_baseline.sql

@@ -308,19 +308,22 @@ DECLARE
 BEGIN
     FOREACH name IN ARRAY ARRAY['coffre_app', 'coffre_vault'] LOOP
         IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = name) THEN
-            EXECUTE format('CREATE ROLE %I', name);
+            EXECUTE format('CREATE ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
+        ELSE
+            -- Managed owners cannot ALTER the superuser-only attributes, even to turn them off.
+            IF EXISTS (
+                SELECT 1 FROM pg_roles WHERE rolname = name
+                AND (rolsuper OR rolreplication OR rolbypassrls)
+            ) THEN
+                RAISE EXCEPTION '% has unsafe role attributes: SUPERUSER, REPLICATION and BYPASSRLS must be off', name;
+            END IF;
+            EXECUTE format('ALTER ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
         END IF;
     END LOOP;
 END
 $$;
 --> statement-breakpoint
 
-ALTER ROLE coffre_app
-    NOLOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
---> statement-breakpoint
-ALTER ROLE coffre_vault
-    NOLOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
---> statement-breakpoint
 
 DO $$
 DECLARE

package/dist/migrations/postgres/meta/0000_snapshot.json

@@ -1,5 +1,5 @@
 {
-  "id": "b2cb2e5d-c648-458d-97bb-34bb07156047",
+  "id": "b76d9374-5d86-42d1-9d06-1af17adadd6b",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "version": "7",
   "dialect": "postgresql",

package/dist/migrations/postgres/meta/_journal.json

@@ -5,7 +5,7 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1790874461895,
+      "when": 1790930587507,
       "tag": "0000_baseline",
       "breakpoints": true
     }

package/dist/postgres-Bmar8y0q.js

@@ -0,0 +1,29 @@
+import { checkServerIdentity } from "node:tls";
+import { parseIntoClientConfig } from "pg-connection-string";
+//#region src/postgres.ts
+/** Keep libpq's system-root shortcut from being read as a certificate filename by pg. */
+function postgresConnection(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error("invalid Postgres URL");
+	}
+	const parameters = parsed.searchParams;
+	if (parameters.getAll("sslrootcert").at(-1) !== "system") return { connectionString: url };
+	const mode = parameters.getAll("sslmode").at(-1);
+	if (mode !== void 0 && mode !== "verify-full") throw new Error("sslrootcert=system requires sslmode=verify-full");
+	parameters.delete("sslrootcert");
+	parameters.set("sslmode", "verify-full");
+	const config = parseIntoClientConfig(parsed.toString());
+	const host = config.host;
+	if (!host) throw new Error("sslrootcert=system requires a Postgres hostname");
+	config.ssl = {
+		...config.ssl,
+		rejectUnauthorized: true,
+		checkServerIdentity: (_hostname, certificate) => checkServerIdentity(host, certificate)
+	};
+	return config;
+}
+//#endregion
+export { postgresConnection as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -73,7 +73,8 @@
     "@libsql/client": "0.18.0",
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
-    "@coffre/core": "0.1.0"
+    "pg-connection-string": "2.14.0",
+    "@coffre/core": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/baseline/postgres.sql

@@ -44,19 +44,22 @@ DECLARE
 BEGIN
     FOREACH name IN ARRAY ARRAY['coffre_app', 'coffre_vault'] LOOP
         IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = name) THEN
-            EXECUTE format('CREATE ROLE %I', name);
+            EXECUTE format('CREATE ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
+        ELSE
+            -- Managed owners cannot ALTER the superuser-only attributes, even to turn them off.
+            IF EXISTS (
+                SELECT 1 FROM pg_roles WHERE rolname = name
+                AND (rolsuper OR rolreplication OR rolbypassrls)
+            ) THEN
+                RAISE EXCEPTION '% has unsafe role attributes: SUPERUSER, REPLICATION and BYPASSRLS must be off', name;
+            END IF;
+            EXECUTE format('ALTER ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
         END IF;
     END LOOP;
 END
 $$;
 --> statement-breakpoint
 
-ALTER ROLE coffre_app
-    NOLOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
---> statement-breakpoint
-ALTER ROLE coffre_vault
-    NOLOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
---> statement-breakpoint
 
 DO $$
 DECLARE

package/src/connect.ts

@@ -6,6 +6,9 @@ import pg from 'pg';
 import { createDatabase, type Database } from './database.ts';
 import type { Engine } from './dialect.ts';
 import { asPostgresDatabase } from './portable.ts';
+import { postgresConnection } from './postgres.ts';
+
+export { postgresConnection } from './postgres.ts';
 
 /**
  * Open a database from its URL, on a Node server:
@@ -20,7 +23,7 @@ import { asPostgresDatabase } from './portable.ts';
 export async function openDatabase(url: string): Promise<OpenDatabase> {
   switch (engineOfUrl(url)) {
     case 'postgres': {
-      const pool = new pg.Pool({ connectionString: url });
+      const pool = new pg.Pool(postgresConnection(url));
       return { engine: 'postgres', db: createDatabase(pool), close: () => pool.end() };
     }
     case 'sqlite': {

package/src/hyperdrive.ts

@@ -1,6 +1,7 @@
 import pg from 'pg';
 
 import type { PoolLike } from './database.ts';
+import { postgresConnection } from './postgres.ts';
 
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */
 export type PostgresDatabase = { readonly engine: 'postgres'; readonly hyperdrive: { readonly connectionString: string } };
@@ -55,7 +56,7 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   }
 
   async #connectClient(): Promise<pg.Client> {
-    const client = new pg.Client({ connectionString: this.#connectionString });
+    const client = new pg.Client(postgresConnection(this.#connectionString));
     await client.connect();
     return client;
   }

package/src/log.ts

@@ -111,12 +111,24 @@ export async function lockLogHead(tx: Transaction): Promise<{ nextSeq: bigint; h
   return head;
 }
 
-export async function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[]): Promise<Appended> {
+/**
+ * Append `entries` under `key`. `check`, when given, runs once the head is
+ * locked and before anything is written: a writer's own condition on the
+ * log as it stands, which no other append can change until this one
+ * commits. It throws to refuse.
+ */
+export async function appendEntries(
+  tx: Transaction,
+  key: LogKey,
+  entries: readonly NewEntry[],
+  check?: (tx: Transaction) => Promise<void>,
+): Promise<Appended> {
   if (entries.length === 0) throw new Error('appendEntries called with no entries');
   const { auditChainHead, auditLog } = tablesOf(tx);
 
   // Every append queues here, if its transaction has not already.
   const head = await lockLogHead(tx);
+  await check?.(tx);
   const [{ now }] = await tx.select({ now: clockMillis(tx) }).from(auditChainHead);
   const [last] = await tx
     .select({ seq: auditLog.seq, hash: auditLog.hash })

package/src/migrate.ts

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url';
 
 import { engineOfUrl } from './connect.ts';
 import type { Engine } from './dialect.ts';
+import { postgresConnection } from './postgres.ts';
 
 /**
  * Bring a database up to date with its engine's migration tree:
@@ -118,7 +119,7 @@ async function postgresMigrator(url: string): Promise<Migrator> {
     import('drizzle-orm/node-postgres'),
     import('drizzle-orm/node-postgres/migrator'),
   ]);
-  const pool = new pg.Pool({ application_name: 'coffre-migrations', connectionString: url, max: 1 });
+  const pool = new pg.Pool({ ...postgresConnection(url), application_name: 'coffre-migrations', max: 1 });
   const client = await pool.connect();
   return {
     async applied() {

package/src/migrations/postgres/0000_baseline.sql

@@ -308,19 +308,22 @@ DECLARE
 BEGIN
     FOREACH name IN ARRAY ARRAY['coffre_app', 'coffre_vault'] LOOP
         IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = name) THEN
-            EXECUTE format('CREATE ROLE %I', name);
+            EXECUTE format('CREATE ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
+        ELSE
+            -- Managed owners cannot ALTER the superuser-only attributes, even to turn them off.
+            IF EXISTS (
+                SELECT 1 FROM pg_roles WHERE rolname = name
+                AND (rolsuper OR rolreplication OR rolbypassrls)
+            ) THEN
+                RAISE EXCEPTION '% has unsafe role attributes: SUPERUSER, REPLICATION and BYPASSRLS must be off', name;
+            END IF;
+            EXECUTE format('ALTER ROLE %I NOLOGIN INHERIT NOCREATEDB NOCREATEROLE', name);
         END IF;
     END LOOP;
 END
 $$;
 --> statement-breakpoint
 
-ALTER ROLE coffre_app
-    NOLOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
---> statement-breakpoint
-ALTER ROLE coffre_vault
-    NOLOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
---> statement-breakpoint
 
 DO $$
 DECLARE

package/src/migrations/postgres/meta/0000_snapshot.json

@@ -1,5 +1,5 @@
 {
-  "id": "b2cb2e5d-c648-458d-97bb-34bb07156047",
+  "id": "b76d9374-5d86-42d1-9d06-1af17adadd6b",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "version": "7",
   "dialect": "postgresql",

package/src/migrations/postgres/meta/_journal.json

@@ -5,7 +5,7 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1790874461895,
+      "when": 1790930587507,
       "tag": "0000_baseline",
       "breakpoints": true
     }

package/src/postgres.ts

@@ -0,0 +1,35 @@
+import { checkServerIdentity } from 'node:tls';
+
+import { parseIntoClientConfig } from 'pg-connection-string';
+import type { ClientConfig } from 'pg';
+
+/** Keep libpq's system-root shortcut from being read as a certificate filename by pg. */
+export function postgresConnection(url: string): ClientConfig {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    // A parse error must not print the URL's password.
+    throw new Error('invalid Postgres URL');
+  }
+  const parameters = parsed.searchParams;
+  if (parameters.getAll('sslrootcert').at(-1) !== 'system') return { connectionString: url };
+  const mode = parameters.getAll('sslmode').at(-1);
+  if (mode !== undefined && mode !== 'verify-full') {
+    throw new Error('sslrootcert=system requires sslmode=verify-full');
+  }
+  parameters.delete('sslrootcert');
+  parameters.set('sslmode', 'verify-full');
+  const config = parseIntoClientConfig(parsed.toString());
+  const host = config.host;
+  if (!host) throw new Error('sslrootcert=system requires a Postgres hostname');
+  // Do not pass a connectionString too: pg would replace these SSL options.
+  // With no CA override, Node uses its default trusted roots. pg omits SNI
+  // for IP addresses, so bind verification to the actual host explicitly.
+  config.ssl = {
+    ...config.ssl as object,
+    rejectUnauthorized: true,
+    checkServerIdentity: (_hostname, certificate) => checkServerIdentity(host, certificate),
+  };
+  return config;
+}

package/src/verify-runtime.ts

@@ -1,6 +1,8 @@
 import assert from 'node:assert/strict';
 import pg from 'pg';
 
+import { postgresConnection } from './postgres.ts';
+
 function requiredEnvironment(name: string): string {
   const value = process.env[name]?.trim();
   if (!value) throw new Error(`${name} is required`);
@@ -10,7 +12,7 @@ function requiredEnvironment(name: string): string {
 const expectedRole = requiredEnvironment('COFFRE_RUNTIME_ROLE');
 const pool = new pg.Pool({
   application_name: 'coffre-runtime-verification',
-  connectionString: requiredEnvironment('DATABASE_URL'),
+  ...postgresConnection(requiredEnvironment('DATABASE_URL')),
   max: 1,
 });