@coffre/db 0.1.15 → 0.1.16

package/dist/schema-sqlite.js

@@ -224,7 +224,9 @@ const auditLog = sqliteTable("audit_log", {
 	index("audit_log_operation_idx").on(table.operationId, table.seq),
 	index("audit_log_action_idx").on(table.author, table.action, table.seq),
 	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
-	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq)
+	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
+	index("audit_log_unbind_idx").on(sql`json_extract(${table.metadata}, '$.bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
+	index("audit_log_exchange_idx").on(sql`json_extract(${table.metadata}, '$.credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`)
 ]);
 const auditChainHead = sqliteTable("audit_chain_head", {
 	onlyRow: flag("only_row").primaryKey().default(true),
@@ -263,6 +265,37 @@ const identities = sqliteTable("identities", {
 	uniqueIndex("identities_active_subject").on(table.provider, table.issuerHash, table.activeSubject),
 	index("identities_principal_idx").on(table.principal, table.generation)
 ]);
+const serviceBindings = sqliteTable("service_bindings", {
+	id: text().primaryKey(),
+	authMac: bytes("auth_mac").notNull(),
+	principal: text().notNull(),
+	generation: integer().notNull(),
+	profile: text().notNull(),
+	issuer: text().notNull(),
+	jwksUri: text("jwks_uri").notNull(),
+	claims: text().notNull(),
+	label: text(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	lastUsedAt: time("last_used_at"),
+	revokedAt: time("revoked_at"),
+	revokedBy: text("revoked_by")
+}, (table) => [
+	check("service_bindings_principal_check", sql`${table.principal} LIKE 'token:%'`),
+	check("service_bindings_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("service_bindings_claims_check", sql`json_valid(${table.claims})`),
+	foreignKey({
+		name: "service_bindings_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	index("service_bindings_principal_idx").on(table.principal, table.issuer),
+	index("service_bindings_live_idx").on(table.principal, table.issuer, table.generation, table.createdAt, table.id).where(sql`${table.revokedAt} IS NULL`)
+]);
+const consumedTokens = sqliteTable("consumed_tokens", {
+	hash: bytes("hash").primaryKey(),
+	consumedAt: time("consumed_at").notNull().default(now)
+}, (table) => [check("consumed_tokens_hash_check", sql`octet_length(${table.hash}) = 32`)]);
 const credentials = sqliteTable("credentials", {
 	id: text().primaryKey(),
 	kind: text().notNull(),
@@ -305,7 +338,9 @@ const credentials = sqliteTable("credentials", {
 			identities.generation
 		]
 	}).onDelete("restrict"),
-	index("credentials_principal_idx").on(table.principal, table.generation)
+	index("credentials_principal_idx").on(table.principal, table.generation),
+	index("credentials_live_idx").on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
+	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt)
 ]);
 const deviceAuthorizations = sqliteTable("device_authorizations", {
 	id: text().primaryKey(),
@@ -344,4 +379,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-CNMfHZwF.js";
+import { i as Queryable } from "./database-Cq_52uUo.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -1,33 +1,81 @@
 import { engineOf } from "./dialect.js";
 //#region src/migrations/postgres/meta/_journal.json
-var entries$1 = [{
-	"idx": 0,
-	"version": "7",
-	"when": 1790930587507,
-	"tag": "0000_baseline",
-	"breakpoints": true
-}, {
-	"idx": 1,
-	"version": "7",
-	"when": 1791062292678,
-	"tag": "0001_remove_syncs",
-	"breakpoints": true
-}];
+var entries$1 = [
+	{
+		"idx": 0,
+		"version": "7",
+		"when": 1790930587507,
+		"tag": "0000_baseline",
+		"breakpoints": true
+	},
+	{
+		"idx": 1,
+		"version": "7",
+		"when": 1791062292678,
+		"tag": "0001_remove_syncs",
+		"breakpoints": true
+	},
+	{
+		"idx": 2,
+		"version": "7",
+		"when": 1791069304538,
+		"tag": "0002_service_bindings",
+		"breakpoints": true
+	},
+	{
+		"idx": 3,
+		"version": "7",
+		"when": 1791072336889,
+		"tag": "0003_exchanges",
+		"breakpoints": true
+	},
+	{
+		"idx": 4,
+		"version": "7",
+		"when": 1791084354462,
+		"tag": "0004_live_indexes",
+		"breakpoints": true
+	}
+];
 //#endregion
 //#region src/migrations/sqlite/meta/_journal.json
-var entries = [{
-	"idx": 0,
-	"version": "6",
-	"when": 1790874462505,
-	"tag": "0000_baseline",
-	"breakpoints": true
-}, {
-	"idx": 1,
-	"version": "6",
-	"when": 1791062293531,
-	"tag": "0001_remove_syncs",
-	"breakpoints": true
-}];
+var entries = [
+	{
+		"idx": 0,
+		"version": "6",
+		"when": 1790874462505,
+		"tag": "0000_baseline",
+		"breakpoints": true
+	},
+	{
+		"idx": 1,
+		"version": "6",
+		"when": 1791062293531,
+		"tag": "0001_remove_syncs",
+		"breakpoints": true
+	},
+	{
+		"idx": 2,
+		"version": "6",
+		"when": 1791069305749,
+		"tag": "0002_service_bindings",
+		"breakpoints": true
+	},
+	{
+		"idx": 3,
+		"version": "6",
+		"when": 1791072337548,
+		"tag": "0003_exchanges",
+		"breakpoints": true
+	},
+	{
+		"idx": 4,
+		"version": "6",
+		"when": 1791084355588,
+		"tag": "0004_live_indexes",
+		"breakpoints": true
+	}
+];
 //#endregion
 //#region src/schema-version.ts
 /**

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { a as environments, c as projects, d as secrets, f as secretsRelations, i as deviceAuthorizations, m as vaultMembers, n as auditLog, o as environmentsRelations, p as vaultGrants, r as credentials, s as identities, t as auditChainHead, u as secretVersions } from "./schema-AmvM6w0D.js";
-export { auditChainHead, auditLog, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, vaultGrants, vaultMembers };
+import { a as deviceAuthorizations, c as identities, d as secretVersions, f as secrets, g as vaultMembers, h as vaultGrants, i as credentials, l as projects, m as serviceBindings, n as auditLog, o as environments, p as secretsRelations, r as consumedTokens, s as environmentsRelations, t as auditChainHead } from "./schema-Wt-p8AOh.js";
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -7,6 +7,7 @@ import { bigint, boolean, check, customType, foreignKey, index, integer, pgTable
 var schema_exports = /* @__PURE__ */ __exportAll({
 	auditChainHead: () => auditChainHead,
 	auditLog: () => auditLog,
+	consumedTokens: () => consumedTokens,
 	credentials: () => credentials,
 	deviceAuthorizations: () => deviceAuthorizations,
 	environments: () => environments,
@@ -16,6 +17,7 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	secretVersions: () => secretVersions,
 	secrets: () => secrets,
 	secretsRelations: () => secretsRelations,
+	serviceBindings: () => serviceBindings,
 	vaultGrants: () => vaultGrants,
 	vaultMembers: () => vaultMembers
 });
@@ -228,7 +230,9 @@ const auditLog = pgTable("audit_log", {
 	index("audit_log_operation_idx").on(table.operationId, table.seq),
 	index("audit_log_action_idx").on(table.author, table.action, table.seq),
 	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
-	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq)
+	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
+	index("audit_log_unbind_idx").on(sql`((${table.metadata})::jsonb ->> 'bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
+	index("audit_log_exchange_idx").on(sql`((${table.metadata})::jsonb ->> 'credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`)
 ]);
 const auditChainHead = pgTable("audit_chain_head", {
 	onlyRow: boolean("only_row").primaryKey().default(true),
@@ -276,6 +280,50 @@ const identities = pgTable("identities", {
 	index("identities_principal_idx").on(table.principal, table.generation)
 ]);
 /**
+* A trust binding: which CI runs may sign in as a service, by the ID token
+* their platform signs (`@coffre/core/identity`'s workloads.ts). Immutable
+* but for its label, last use and revocation: a change is a new binding, and
+* the old one's `token.unbind` entry is its tombstone, which outlives any
+* row put back. The MAC covers what decides (auth-rows.ts in the server).
+*/
+const serviceBindings = pgTable("service_bindings", {
+	id: uuid().primaryKey(),
+	authMac: bytea("auth_mac").notNull(),
+	principal: text().notNull(),
+	generation: integer().notNull(),
+	profile: text().notNull(),
+	issuer: text().notNull(),
+	jwksUri: text("jwks_uri").notNull(),
+	claims: text().notNull(),
+	label: text(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+	revokedAt: timestamp("revoked_at", { withTimezone: true }),
+	revokedBy: text("revoked_by")
+}, (table) => [
+	check("service_bindings_principal_check", sql`${table.principal} LIKE 'token:%'`),
+	check("service_bindings_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("service_bindings_claims_check", sql`${table.claims}::jsonb IS NOT NULL`),
+	foreignKey({
+		name: "service_bindings_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	index("service_bindings_principal_idx").on(table.principal, table.issuer),
+	index("service_bindings_live_idx").on(table.principal, table.issuer, table.generation, table.createdAt, table.id).where(sql`${table.revokedAt} IS NULL`)
+]);
+/**
+* ID tokens exchanged for a credential, each once: the SHA-256 of what its
+* signature covers, `header.payload` as received, so that no other
+* spelling of the same token counts as another. Kept whatever becomes of
+* the credential it bought; the primary key decides a race.
+*/
+const consumedTokens = pgTable("consumed_tokens", {
+	hash: bytea("hash").primaryKey(),
+	consumedAt: timestamp("consumed_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [check("consumed_tokens_hash_check", sql`octet_length(${table.hash}) = 32`)]);
+/**
 * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
 * service tokens.
 *
@@ -325,7 +373,9 @@ const credentials = pgTable("credentials", {
 			identities.generation
 		]
 	}).onDelete("restrict"),
-	index("credentials_principal_idx").on(table.principal, table.generation)
+	index("credentials_principal_idx").on(table.principal, table.generation),
+	index("credentials_live_idx").on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
+	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt)
 ]);
 /**
 * A CLI asking to be signed in from a browser (RFC 8628, device flow).
@@ -371,4 +421,4 @@ const { environmentsRelations, secretsRelations } = relationsOf({
 	secretVersions
 });
 //#endregion
-export { auditChainHead, auditLog, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, schema_exports as t, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -74,7 +74,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.1.15"
+    "@coffre/core": "0.1.16"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/database.ts

@@ -49,7 +49,7 @@ const inside = new AsyncLocalStorage<{ pool: PoolLike; open: boolean }>();
 /**
  * `pool`, refusing a query or a transaction asked from inside a transaction
  * it is already running. Work from any other flow, a concurrent request's,
- * or what the transaction left running after it ended, goes on as before.
+ * or what the transaction left running once its work was done, goes on as before.
  */
 function guarded(pool: PoolLike): PoolLike {
   return new Proxy(pool, {
@@ -76,17 +76,27 @@ function brokenRule(error: unknown): QueryOutsideTransaction | undefined {
 
 export function createDatabase(pool: PoolLike): Database {
   const db = drizzle(guarded(pool) as pg.Pool, { schema });
-  // Each transaction's work runs knowing which one it is in, until the transaction ends.
+  // Each transaction's work runs knowing which one it is in, until that work is done. Not until
+  // the COMMIT comes back: the transaction waits on nothing then, so what the work left running
+  // may ask for a query, which waits for the transaction to end rather than for itself.
   const run = db.transaction.bind(db);
   db.transaction = (async (work, config) => {
     const open = { pool, open: true };
     try {
-      return await run((tx) => inside.run(open, () => work(tx)), config);
+      return await run(
+        (tx) =>
+          inside.run(open, async () => {
+            try {
+              return await work(tx);
+            } finally {
+              open.open = false;
+            }
+          }),
+        config,
+      );
     } catch (error) {
       // Drizzle wraps what a query throws: the rule broken is what to say.
       throw brokenRule(error) ?? error;
-    } finally {
-      open.open = false;
     }
   }) as Database['transaction'];
   return trackCommits(db);

package/src/migrations/postgres/0002_service_bindings.sql

@@ -0,0 +1,28 @@
+CREATE TABLE "service_bindings" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"principal" text NOT NULL,
+	"generation" integer NOT NULL,
+	"profile" text NOT NULL,
+	"issuer" text NOT NULL,
+	"jwks_uri" text NOT NULL,
+	"claims" text NOT NULL,
+	"label" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"last_used_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"revoked_by" text,
+	CONSTRAINT "service_bindings_principal_check" CHECK ("service_bindings"."principal" LIKE 'token:%'),
+	CONSTRAINT "service_bindings_auth_mac_check" CHECK (octet_length("service_bindings"."auth_mac") = 32),
+	CONSTRAINT "service_bindings_claims_check" CHECK ("service_bindings"."claims"::jsonb IS NOT NULL)
+);
+--> statement-breakpoint
+ALTER TABLE "service_bindings" ADD CONSTRAINT "service_bindings_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "service_bindings_principal_idx" ON "service_bindings" USING btree ("principal","issuer");--> statement-breakpoint
+CREATE INDEX "audit_log_unbind_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'bindingId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.unbind' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+-- The app reads and adds bindings, and changes only what the MAC allows to
+-- change in place: its label, its last use, and its revocation (with the
+-- MAC that covers it). A binding's policy is never updated, nor deleted.
+GRANT SELECT, INSERT ON service_bindings TO coffre_app;--> statement-breakpoint
+GRANT UPDATE (label, last_used_at, revoked_at, revoked_by, auth_mac) ON service_bindings TO coffre_app;

package/src/migrations/postgres/0003_exchanges.sql

@@ -0,0 +1,10 @@
+CREATE TABLE "consumed_tokens" (
+	"hash" "bytea" PRIMARY KEY NOT NULL,
+	"consumed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "consumed_tokens_hash_check" CHECK (octet_length("consumed_tokens"."hash") = 32)
+);
+--> statement-breakpoint
+CREATE INDEX "audit_log_exchange_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'credentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.exchange' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+-- The app records each token it exchanges, and reads whether one was; it
+-- never changes or deletes a record, so a token stays spent.
+GRANT SELECT, INSERT ON consumed_tokens TO coffre_app;

package/src/migrations/postgres/0004_live_indexes.sql

@@ -0,0 +1,3 @@
+CREATE INDEX "credentials_live_idx" ON "credentials" USING btree ("principal","expires_at") WHERE "credentials"."revoked_at" IS NULL;--> statement-breakpoint
+CREATE INDEX "credentials_issued_by_idx" ON "credentials" USING btree ("principal","created_by","created_at");--> statement-breakpoint
+CREATE INDEX "service_bindings_live_idx" ON "service_bindings" USING btree ("principal","issuer","generation","created_at","id") WHERE "service_bindings"."revoked_at" IS NULL;