@coffre/db 0.1.14 → 0.1.16

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-CNMfHZwF.js";
+import { t as Database } from "./database-Cq_52uUo.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-CNMfHZwF.d.ts → database-Cq_52uUo.d.ts}

@@ -1,4 +1,4 @@
-import { l as schema_d_exports } from "./schema-AmvM6w0D.js";
+import { u as schema_d_exports } from "./schema-Wt-p8AOh.js";
 import { Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-CNMfHZwF.js";
+import { i as Queryable } from "./database-Cq_52uUo.js";
 import { SQL } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-CNMfHZwF.js";
+import { n as PoolLike } from "./database-Cq_52uUo.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { l as schema_d_exports } from "./schema-AmvM6w0D.js";
-import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-CNMfHZwF.js";
+import { u as schema_d_exports } from "./schema-Wt-p8AOh.js";
+import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-Cq_52uUo.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, schema_d_exports as schema, tablesOf };

package/dist/index.js

@@ -22,7 +22,7 @@ const inside = new AsyncLocalStorage();
 /**
 * `pool`, refusing a query or a transaction asked from inside a transaction
 * it is already running. Work from any other flow, a concurrent request's,
-* or what the transaction left running after it ended, goes on as before.
+* or what the transaction left running once its work was done, goes on as before.
 */
 function guarded(pool) {
 	return new Proxy(pool, { get(target, key) {
@@ -49,11 +49,15 @@ function createDatabase(pool) {
 			open: true
 		};
 		try {
-			return await run((tx) => inside.run(open, () => work(tx)), config);
+			return await run((tx) => inside.run(open, async () => {
+				try {
+					return await work(tx);
+				} finally {
+					open.open = false;
+				}
+			}), config);
 		} catch (error) {
 			throw brokenRule(error) ?? error;
-		} finally {
-			open.open = false;
 		}
 	});
 	return trackCommits(db);

package/dist/log.d.ts

@@ -1,4 +1,4 @@
-import { a as Transaction } from "./database-CNMfHZwF.js";
+import { a as Transaction } from "./database-Cq_52uUo.js";
 import { LogKey } from "@coffre/core/audit";
 //#region src/log.d.ts
 /**

package/dist/migrations/postgres/0002_service_bindings.sql

@@ -0,0 +1,28 @@
+CREATE TABLE "service_bindings" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"principal" text NOT NULL,
+	"generation" integer NOT NULL,
+	"profile" text NOT NULL,
+	"issuer" text NOT NULL,
+	"jwks_uri" text NOT NULL,
+	"claims" text NOT NULL,
+	"label" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"last_used_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"revoked_by" text,
+	CONSTRAINT "service_bindings_principal_check" CHECK ("service_bindings"."principal" LIKE 'token:%'),
+	CONSTRAINT "service_bindings_auth_mac_check" CHECK (octet_length("service_bindings"."auth_mac") = 32),
+	CONSTRAINT "service_bindings_claims_check" CHECK ("service_bindings"."claims"::jsonb IS NOT NULL)
+);
+--> statement-breakpoint
+ALTER TABLE "service_bindings" ADD CONSTRAINT "service_bindings_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "service_bindings_principal_idx" ON "service_bindings" USING btree ("principal","issuer");--> statement-breakpoint
+CREATE INDEX "audit_log_unbind_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'bindingId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.unbind' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+-- The app reads and adds bindings, and changes only what the MAC allows to
+-- change in place: its label, its last use, and its revocation (with the
+-- MAC that covers it). A binding's policy is never updated, nor deleted.
+GRANT SELECT, INSERT ON service_bindings TO coffre_app;--> statement-breakpoint
+GRANT UPDATE (label, last_used_at, revoked_at, revoked_by, auth_mac) ON service_bindings TO coffre_app;

package/dist/migrations/postgres/0003_exchanges.sql

@@ -0,0 +1,10 @@
+CREATE TABLE "consumed_tokens" (
+	"hash" "bytea" PRIMARY KEY NOT NULL,
+	"consumed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "consumed_tokens_hash_check" CHECK (octet_length("consumed_tokens"."hash") = 32)
+);
+--> statement-breakpoint
+CREATE INDEX "audit_log_exchange_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'credentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.exchange' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+-- The app records each token it exchanges, and reads whether one was; it
+-- never changes or deletes a record, so a token stays spent.
+GRANT SELECT, INSERT ON consumed_tokens TO coffre_app;

package/dist/migrations/postgres/0004_live_indexes.sql

@@ -0,0 +1,3 @@
+CREATE INDEX "credentials_live_idx" ON "credentials" USING btree ("principal","expires_at") WHERE "credentials"."revoked_at" IS NULL;--> statement-breakpoint
+CREATE INDEX "credentials_issued_by_idx" ON "credentials" USING btree ("principal","created_by","created_at");--> statement-breakpoint
+CREATE INDEX "service_bindings_live_idx" ON "service_bindings" USING btree ("principal","issuer","generation","created_at","id") WHERE "service_bindings"."revoked_at" IS NULL;