@coffre/db 0.1.15 → 0.1.17

package/dist/migrations/postgres/meta/_journal.json

@@ -15,6 +15,27 @@
       "when": 1791062292678,
       "tag": "0001_remove_syncs",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1791069304538,
+      "tag": "0002_service_bindings",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1791072336889,
+      "tag": "0003_exchanges",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1791084354462,
+      "tag": "0004_live_indexes",
+      "breakpoints": true
     }
   ]
 }

package/dist/migrations/sqlite/0002_service_bindings.sql

@@ -0,0 +1,23 @@
+CREATE TABLE `service_bindings` (
+	`id` text PRIMARY KEY NOT NULL,
+	`auth_mac` blob NOT NULL,
+	`principal` text NOT NULL,
+	`generation` integer NOT NULL,
+	`profile` text NOT NULL,
+	`issuer` text NOT NULL,
+	`jwks_uri` text NOT NULL,
+	`claims` text NOT NULL,
+	`label` text,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`created_by` text NOT NULL,
+	`last_used_at` integer,
+	`revoked_at` integer,
+	`revoked_by` text,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "service_bindings_principal_check" CHECK("service_bindings"."principal" LIKE 'token:%'),
+	CONSTRAINT "service_bindings_auth_mac_check" CHECK(octet_length("service_bindings"."auth_mac") = 32),
+	CONSTRAINT "service_bindings_claims_check" CHECK(json_valid("service_bindings"."claims"))
+);
+--> statement-breakpoint
+CREATE INDEX `service_bindings_principal_idx` ON `service_bindings` (`principal`,`issuer`);--> statement-breakpoint
+CREATE INDEX `audit_log_unbind_idx` ON `audit_log` (json_extract("metadata", '$.bindingId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.unbind' AND "audit_log"."decision" = 'allow';

package/dist/migrations/sqlite/0003_exchanges.sql

@@ -0,0 +1,7 @@
+CREATE TABLE `consumed_tokens` (
+	`hash` blob PRIMARY KEY NOT NULL,
+	`consumed_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	CONSTRAINT "consumed_tokens_hash_check" CHECK(octet_length("consumed_tokens"."hash") = 32)
+);
+--> statement-breakpoint
+CREATE INDEX `audit_log_exchange_idx` ON `audit_log` (json_extract("metadata", '$.credentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.exchange' AND "audit_log"."decision" = 'allow';

package/dist/migrations/sqlite/0004_live_indexes.sql

@@ -0,0 +1,3 @@
+CREATE INDEX `credentials_live_idx` ON `credentials` (`principal`,`expires_at`) WHERE "credentials"."revoked_at" IS NULL;--> statement-breakpoint
+CREATE INDEX `credentials_issued_by_idx` ON `credentials` (`principal`,`created_by`,`created_at`);--> statement-breakpoint
+CREATE INDEX `service_bindings_live_idx` ON `service_bindings` (`principal`,`issuer`,`generation`,`created_at`,`id`) WHERE "service_bindings"."revoked_at" IS NULL;