@coffre/db 0.1.15 → 0.1.17

package/README.md

@@ -5,8 +5,9 @@ coffre uses in tests and local development, their migrations and the
 migrator, the helpers for what the two engines do differently, and the
 connections, Hyperdrive's included.
 
-A deployment does not import it. `@coffre/server` runs its migrations with
-`coffre-server migrate`. The server and vault open the same database with
+A deployment does not import it. Its own CLI applies the migrations,
+`pnpm exec coffre migrate`, before the deploy; `coffre-server migrate` does
+the same for local SQLite and tests. The server and vault open the same database with
 separate logins, `coffre_runtime` and `coffre_vault_runtime`. The migrations
 grant each its own rights; only the owner runs migrations. The owner needs
 `CREATEROLE` and `CREATEDB`, and `ADMIN OPTION` on existing group roles.

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-CNMfHZwF.js";
+import { t as Database } from "./database-Cq_52uUo.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-CNMfHZwF.d.ts → database-Cq_52uUo.d.ts}

@@ -1,4 +1,4 @@
-import { l as schema_d_exports } from "./schema-AmvM6w0D.js";
+import { u as schema_d_exports } from "./schema-Wt-p8AOh.js";
 import { Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-CNMfHZwF.js";
+import { i as Queryable } from "./database-Cq_52uUo.js";
 import { SQL } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-CNMfHZwF.js";
+import { n as PoolLike } from "./database-Cq_52uUo.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { l as schema_d_exports } from "./schema-AmvM6w0D.js";
-import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-CNMfHZwF.js";
+import { u as schema_d_exports } from "./schema-Wt-p8AOh.js";
+import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-Cq_52uUo.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, schema_d_exports as schema, tablesOf };

package/dist/index.js

@@ -22,7 +22,7 @@ const inside = new AsyncLocalStorage();
 /**
 * `pool`, refusing a query or a transaction asked from inside a transaction
 * it is already running. Work from any other flow, a concurrent request's,
-* or what the transaction left running after it ended, goes on as before.
+* or what the transaction left running once its work was done, goes on as before.
 */
 function guarded(pool) {
 	return new Proxy(pool, { get(target, key) {
@@ -49,11 +49,15 @@ function createDatabase(pool) {
 			open: true
 		};
 		try {
-			return await run((tx) => inside.run(open, () => work(tx)), config);
+			return await run((tx) => inside.run(open, async () => {
+				try {
+					return await work(tx);
+				} finally {
+					open.open = false;
+				}
+			}), config);
 		} catch (error) {
 			throw brokenRule(error) ?? error;
-		} finally {
-			open.open = false;
 		}
 	});
 	return trackCommits(db);

package/dist/log.d.ts

@@ -1,4 +1,4 @@
-import { a as Transaction } from "./database-CNMfHZwF.js";
+import { a as Transaction } from "./database-Cq_52uUo.js";
 import { LogKey } from "@coffre/core/audit";
 //#region src/log.d.ts
 /**

package/dist/migrate.d.ts

@@ -8,6 +8,22 @@ export declare function restrictDatabase(client: Pick<PoolClient, 'query'>): Pro
  * in the built package, where the build copies them.
  */
 export declare function migrationsFolder(engine: Engine): string;
+/**
+ * A database a newer coffre migrated: it has applied every migration this
+ * version knows, and more. The ledger keeps no names, so each one it does not
+ * know is named by when it was made and its hash.
+ */
+export declare class DatabaseAhead extends Error {
+  readonly known: string[];
+  readonly unknown: {
+    createdAt: string;
+    hash: string;
+  }[];
+  constructor(known: string[], unknown: {
+    createdAt: string;
+    hash: string;
+  }[]);
+}
 /**
  * A migration run's plan: `applied` of the `total` migrations there before
  * it, and the tags of the rest, which it applies.

package/dist/migrate.js

@@ -47,14 +47,33 @@ async function expectedMigrations(engine) {
 	for (let index = 1; index < expected.length; index += 1) if (BigInt(expected[index - 1].createdAt) >= BigInt(expected[index].createdAt)) throw new Error("Drizzle migration journal timestamps must be strictly increasing");
 	return expected;
 }
+/**
+* A database a newer coffre migrated: it has applied every migration this
+* version knows, and more. The ledger keeps no names, so each one it does not
+* know is named by when it was made and its hash.
+*/
+var DatabaseAhead = class extends Error {
+	known;
+	unknown;
+	constructor(known, unknown) {
+		const made = unknown.map(({ createdAt, hash }) => `one made ${new Date(Number(createdAt)).toISOString().slice(0, 16).replace("T", " ")} UTC (${hash.slice(0, 12)})`);
+		super(`the database has applied ${unknown.length === 1 ? "a migration" : `${unknown.length} migrations`} this version does not know, after ${known.at(-1) ?? "none"}: ${made.join(", ")}. A newer coffre migrated it`);
+		this.name = "DatabaseAhead";
+		this.known = known;
+		this.unknown = unknown;
+	}
+};
 function verifyHistory(expected, applied, requireComplete) {
 	const rows = applied ?? [];
-	if (rows.length > expected.length) throw new Error("database contains migrations that are absent from this image");
-	if (requireComplete && rows.length !== expected.length) throw new Error(`migration history is incomplete: expected ${expected.length}, found ${rows.length}`);
-	rows.forEach((row, index) => {
+	rows.slice(0, expected.length).forEach((row, index) => {
 		const local = expected[index];
 		if (row.created_at !== local.createdAt || row.hash !== local.hash) throw new Error(`migration history diverged at ${local.tag}; applied migrations must never be edited`);
 	});
+	if (rows.length > expected.length) throw new DatabaseAhead(expected.map((entry) => entry.tag), rows.slice(expected.length).map((row) => ({
+		createdAt: row.created_at,
+		hash: row.hash
+	})));
+	if (requireComplete && rows.length !== expected.length) throw new Error(`migration history is incomplete: expected ${expected.length}, found ${rows.length}`);
 }
 async function postgresMigrator(url) {
 	const [{ default: pg }, { drizzle }, { migrate }] = await Promise.all([
@@ -166,4 +185,4 @@ async function migrateDatabase(url, onPlan) {
 	}
 }
 //#endregion
-export { migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase };
+export { DatabaseAhead, migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase };

package/dist/migrations/postgres/0002_service_bindings.sql

@@ -0,0 +1,28 @@
+CREATE TABLE "service_bindings" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"principal" text NOT NULL,
+	"generation" integer NOT NULL,
+	"profile" text NOT NULL,
+	"issuer" text NOT NULL,
+	"jwks_uri" text NOT NULL,
+	"claims" text NOT NULL,
+	"label" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"last_used_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"revoked_by" text,
+	CONSTRAINT "service_bindings_principal_check" CHECK ("service_bindings"."principal" LIKE 'token:%'),
+	CONSTRAINT "service_bindings_auth_mac_check" CHECK (octet_length("service_bindings"."auth_mac") = 32),
+	CONSTRAINT "service_bindings_claims_check" CHECK ("service_bindings"."claims"::jsonb IS NOT NULL)
+);
+--> statement-breakpoint
+ALTER TABLE "service_bindings" ADD CONSTRAINT "service_bindings_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "service_bindings_principal_idx" ON "service_bindings" USING btree ("principal","issuer");--> statement-breakpoint
+CREATE INDEX "audit_log_unbind_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'bindingId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.unbind' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+-- The app reads and adds bindings, and changes only what the MAC allows to
+-- change in place: its label, its last use, and its revocation (with the
+-- MAC that covers it). A binding's policy is never updated, nor deleted.
+GRANT SELECT, INSERT ON service_bindings TO coffre_app;--> statement-breakpoint
+GRANT UPDATE (label, last_used_at, revoked_at, revoked_by, auth_mac) ON service_bindings TO coffre_app;

package/dist/migrations/postgres/0003_exchanges.sql

@@ -0,0 +1,10 @@
+CREATE TABLE "consumed_tokens" (
+	"hash" "bytea" PRIMARY KEY NOT NULL,
+	"consumed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "consumed_tokens_hash_check" CHECK (octet_length("consumed_tokens"."hash") = 32)
+);
+--> statement-breakpoint
+CREATE INDEX "audit_log_exchange_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'credentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.exchange' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+-- The app records each token it exchanges, and reads whether one was; it
+-- never changes or deletes a record, so a token stays spent.
+GRANT SELECT, INSERT ON consumed_tokens TO coffre_app;

package/dist/migrations/postgres/0004_live_indexes.sql

@@ -0,0 +1,3 @@
+CREATE INDEX "credentials_live_idx" ON "credentials" USING btree ("principal","expires_at") WHERE "credentials"."revoked_at" IS NULL;--> statement-breakpoint
+CREATE INDEX "credentials_issued_by_idx" ON "credentials" USING btree ("principal","created_by","created_at");--> statement-breakpoint
+CREATE INDEX "service_bindings_live_idx" ON "service_bindings" USING btree ("principal","issuer","generation","created_at","id") WHERE "service_bindings"."revoked_at" IS NULL;