@coffre/db 0.1.14 → 0.1.16

package/src/migrations/sqlite/meta/_journal.json

@@ -15,6 +15,27 @@
       "when": 1791062293531,
       "tag": "0001_remove_syncs",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1791069305749,
+      "tag": "0002_service_bindings",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1791072337548,
+      "tag": "0003_exchanges",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1791084355588,
+      "tag": "0004_live_indexes",
+      "breakpoints": true
     }
   ]
 }

package/src/schema.sqlite.ts

@@ -303,6 +303,14 @@ export const auditLog = sqliteTable(
     index('audit_log_action_idx').on(table.author, table.action, table.seq),
     index('audit_log_releases_idx').on(table.author, table.actor, table.action, table.decision, table.occurredAt),
     index('audit_log_subject_idx').on(table.author, table.subjectPrincipal, table.seq),
+    // A binding's tombstone: the app's successful `token.unbind` naming it.
+    index('audit_log_unbind_idx')
+      .on(sql`json_extract(${table.metadata}, '$.bindingId')`)
+      .where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
+    // The run a credential was issued for: its exchange's entry, by the credential's ID.
+    index('audit_log_exchange_idx')
+      .on(sql`json_extract(${table.metadata}, '$.credentialId')`)
+      .where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
   ],
 );
 
@@ -354,6 +362,54 @@ export const identities = sqliteTable(
   ],
 );
 
+export const serviceBindings = sqliteTable(
+  'service_bindings',
+  {
+    id: text().primaryKey(),
+    authMac: bytes('auth_mac').notNull(),
+    // The service it signs in as, `token:<id>`, under the generation it was bound in.
+    principal: text().notNull(),
+    generation: integer().notNull(),
+    profile: text().notNull(),
+    issuer: text().notNull(),
+    // From the issuer's discovery when the binding was made, never refetched.
+    jwksUri: text('jwks_uri').notNull(),
+    // JSON, sorted by claim name.
+    claims: text().notNull(),
+    label: text(),
+    createdAt: createdAt(),
+    createdBy: text('created_by').notNull(),
+    lastUsedAt: time('last_used_at'),
+    revokedAt: time('revoked_at'),
+    revokedBy: text('revoked_by'),
+  },
+  (table) => [
+    check('service_bindings_principal_check', sql`${table.principal} LIKE 'token:%'`),
+    check('service_bindings_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
+    check('service_bindings_claims_check', sql`json_valid(${table.claims})`),
+    foreignKey({
+      name: 'service_bindings_principal_fkey',
+      columns: [table.principal],
+      foreignColumns: [vaultMembers.principal],
+    }).onDelete('restrict'),
+    index('service_bindings_principal_idx').on(table.principal, table.issuer),
+    // What an exchange may match: a service's live bindings on an issuer, in a
+    // generation, in the order it reads them, without the retired history.
+    index('service_bindings_live_idx')
+      .on(table.principal, table.issuer, table.generation, table.createdAt, table.id)
+      .where(sql`${table.revokedAt} IS NULL`),
+  ],
+);
+
+export const consumedTokens = sqliteTable(
+  'consumed_tokens',
+  {
+    hash: bytes('hash').primaryKey(),
+    consumedAt: time('consumed_at').notNull().default(now),
+  },
+  (table) => [check('consumed_tokens_hash_check', sql`octet_length(${table.hash}) = 32`)],
+);
+
 export const credentials = sqliteTable(
   'credentials',
   {
@@ -394,6 +450,11 @@ export const credentials = sqliteTable(
       foreignColumns: [identities.id, identities.principal, identities.generation],
     }).onDelete('restrict'),
     index('credentials_principal_idx').on(table.principal, table.generation),
+    // A member's credentials still live, however many have expired: a CI run
+    // leaves one behind each time it signs in.
+    index('credentials_live_idx').on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
+    // What a trust binding issued lately, for its rate.
+    index('credentials_issued_by_idx').on(table.principal, table.createdBy, table.createdAt),
   ],
 );
 

package/src/schema.ts

@@ -300,6 +300,14 @@ export const auditLog = pgTable(
     index('audit_log_releases_idx').on(table.author, table.actor, table.action, table.decision, table.occurredAt),
     // What the vault logged about one member, in order.
     index('audit_log_subject_idx').on(table.author, table.subjectPrincipal, table.seq),
+    // A binding's tombstone: the app's successful `token.unbind` naming it.
+    index('audit_log_unbind_idx')
+      .on(sql`((${table.metadata})::jsonb ->> 'bindingId')`)
+      .where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
+    // The run a credential was issued for: its exchange's entry, by the credential's ID.
+    index('audit_log_exchange_idx')
+      .on(sql`((${table.metadata})::jsonb ->> 'credentialId')`)
+      .where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
   ],
 );
 
@@ -361,6 +369,67 @@ export const identities = pgTable(
   ],
 );
 
+/**
+ * A trust binding: which CI runs may sign in as a service, by the ID token
+ * their platform signs (`@coffre/core/identity`'s workloads.ts). Immutable
+ * but for its label, last use and revocation: a change is a new binding, and
+ * the old one's `token.unbind` entry is its tombstone, which outlives any
+ * row put back. The MAC covers what decides (auth-rows.ts in the server).
+ */
+export const serviceBindings = pgTable(
+  'service_bindings',
+  {
+    id: uuid().primaryKey(),
+    authMac: bytea('auth_mac').notNull(),
+    // The service it signs in as, `token:<id>`, under the generation it was bound in.
+    principal: text().notNull(),
+    generation: integer().notNull(),
+    profile: text().notNull(),
+    issuer: text().notNull(),
+    // From the issuer's discovery when the binding was made, never refetched.
+    jwksUri: text('jwks_uri').notNull(),
+    // JSON, sorted by claim name.
+    claims: text().notNull(),
+    label: text(),
+    createdAt: createdAt(),
+    createdBy: text('created_by').notNull(),
+    lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    revokedBy: text('revoked_by'),
+  },
+  (table) => [
+    check('service_bindings_principal_check', sql`${table.principal} LIKE 'token:%'`),
+    check('service_bindings_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
+    check('service_bindings_claims_check', sql`${table.claims}::jsonb IS NOT NULL`),
+    foreignKey({
+      name: 'service_bindings_principal_fkey',
+      columns: [table.principal],
+      foreignColumns: [vaultMembers.principal],
+    }).onDelete('restrict'),
+    index('service_bindings_principal_idx').on(table.principal, table.issuer),
+    // What an exchange may match: a service's live bindings on an issuer, in a
+    // generation, in the order it reads them, without the retired history.
+    index('service_bindings_live_idx')
+      .on(table.principal, table.issuer, table.generation, table.createdAt, table.id)
+      .where(sql`${table.revokedAt} IS NULL`),
+  ],
+);
+
+/**
+ * ID tokens exchanged for a credential, each once: the SHA-256 of what its
+ * signature covers, `header.payload` as received, so that no other
+ * spelling of the same token counts as another. Kept whatever becomes of
+ * the credential it bought; the primary key decides a race.
+ */
+export const consumedTokens = pgTable(
+  'consumed_tokens',
+  {
+    hash: bytea('hash').primaryKey(),
+    consumedAt: timestamp('consumed_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [check('consumed_tokens_hash_check', sql`octet_length(${table.hash}) = 32`)],
+);
+
 /**
  * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
  * service tokens.
@@ -409,6 +478,11 @@ export const credentials = pgTable(
       foreignColumns: [identities.id, identities.principal, identities.generation],
     }).onDelete('restrict'),
     index('credentials_principal_idx').on(table.principal, table.generation),
+    // A member's credentials still live, however many have expired: a CI run
+    // leaves one behind each time it signs in.
+    index('credentials_live_idx').on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
+    // What a trust binding issued lately, for its rate.
+    index('credentials_issued_by_idx').on(table.principal, table.createdBy, table.createdAt),
   ],
 );