@coffre/db 0.10.1 → 0.11.0

package/src/grants.ts

@@ -205,35 +205,44 @@ export async function everyProjectPreview(db: Queryable, at: number): Promise<Ev
   });
 }
 
-/** A service token or trust binding of 0.4, which carries no scope of its own yet. */
-export type Unsealed = { kind: 'token' | 'binding'; id: string; principal: string };
+/**
+ * A service token or trust binding whose scope this release has not sealed
+ * yet: none of its own, as 0.4 made it (`scope` null), or one that does not
+ * say where it reads sensitive values, as a release before 0.11 made it. By
+ * whom it was issued, `createdBy`, a person's email.
+ */
+export type Unsealed = { kind: 'token' | 'binding'; id: string; principal: string; createdBy: string; scope: string | null };
 
 /**
  * The live service tokens and trust bindings of active service accounts
- * that carry no scope yet, as 0.4 made them: what the app seals with each
- * account's grants once a process (`sealScopes`), and what `coffre migrate`
- * says it will. A credential a binding issued carries its binding's.
+ * whose scope is not sealed yet (`Unsealed`): what the app seals once a
+ * process (`sealScopes`), and what `coffre migrate` says it will. A
+ * credential a binding issued carries its binding's.
  */
 export async function unsealedCredentials(db: Queryable, at: Date): Promise<Unsealed[]> {
   const { credentials, serviceBindings, vaultMembers } = tablesOf(db);
+  // Every scope this release writes for a service says, at each place it names, whether it reads the sensitive values
+  // there; one that names none, sealed while its account held nothing, is sealed (`unsealedScope` in @coffre/server).
+  const unsealed = (scope: typeof credentials.scope | typeof serviceBindings.scope) =>
+    or(isNull(scope), and(like(scope, '%"projectId"%'), sql`${scope} NOT LIKE '%"sensitive":%'`));
   const [tokens, bindings] = await Promise.all([
     db
-      .select({ id: credentials.id, principal: credentials.principal })
+      .select({ id: credentials.id, principal: credentials.principal, createdBy: credentials.createdBy, scope: credentials.scope })
       .from(credentials)
       .innerJoin(vaultMembers, and(eq(vaultMembers.principal, credentials.principal), eq(vaultMembers.generation, credentials.generation)))
       .where(and(
         eq(credentials.kind, 'service'),
-        isNull(credentials.scope),
+        unsealed(credentials.scope),
         sql`${credentials.createdBy} NOT LIKE 'binding:%'`,
         isNull(credentials.revokedAt),
         gt(credentials.expiresAt, at),
         eq(vaultMembers.status, 'active'),
       )),
     db
-      .select({ id: serviceBindings.id, principal: serviceBindings.principal })
+      .select({ id: serviceBindings.id, principal: serviceBindings.principal, createdBy: serviceBindings.createdBy, scope: serviceBindings.scope })
       .from(serviceBindings)
       .innerJoin(vaultMembers, and(eq(vaultMembers.principal, serviceBindings.principal), eq(vaultMembers.generation, serviceBindings.generation)))
-      .where(and(isNull(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, 'active'))),
+      .where(and(unsealed(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, 'active'))),
   ]);
   return [
     ...tokens.map((row) => ({ kind: 'token' as const, ...row })),

package/src/hyperdrive.ts

@@ -48,16 +48,26 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   #busy = 0;
   /** What waits for the client to be idle: `end`. */
   readonly #idle: (() => void)[] = [];
+  /** How long the client may sit idle before it closes, or null: closed by `end` alone. */
+  readonly #closeIdleMs: number | null;
+  #idleTimer: ReturnType<typeof setTimeout> | undefined;
 
-  constructor(connectionString: string) {
+  /**
+   * `closeIdleMs`: for what outlives a call, a Durable Object, which queries
+   * now and then: the client closes once it has been idle that long, and
+   * the next query connects again.
+   */
+  constructor(connectionString: string, options: { closeIdleMs?: number } = {}) {
     if (connectionString.trim().length === 0) {
       throw new Error('Hyperdrive returned an empty connection string');
     }
     this.#connectionString = connectionString;
+    this.#closeIdleMs = options.closeIdleMs ?? null;
   }
 
   readonly query: pg.Pool['query'] = (async (...args: unknown[]) => {
     this.#busy += 1;
+    clearTimeout(this.#idleTimer);
     try {
       const client = await this.#connected();
       return await new Promise((resolve, reject) => {
@@ -72,6 +82,7 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   /** The client, for a transaction: held from now until `release`. */
   async connect(): Promise<Pick<pg.PoolClient, 'query'> & { release: () => void }> {
     this.#busy += 1;
+    clearTimeout(this.#idleTimer);
     let client: pg.Client;
     try {
       client = await this.#connected();
@@ -100,6 +111,7 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
 
   /** Close the client once nothing waits on it: what a Worker hands `waitUntil` when the call is done. */
   async end(): Promise<void> {
+    clearTimeout(this.#idleTimer);
     while (this.#busy > 0) {
       await new Promise<void>((resolve) => this.#idle.push(resolve));
     }
@@ -123,7 +135,9 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   /** One query or transaction done: once none is left, what waits for the client to be idle goes on. */
   #done(): void {
     this.#busy -= 1;
-    if (this.#busy === 0) for (const resolve of this.#idle.splice(0)) resolve();
+    if (this.#busy > 0) return;
+    for (const resolve of this.#idle.splice(0)) resolve();
+    if (this.#closeIdleMs !== null && this.#client !== null) this.#idleTimer = setTimeout(() => void this.end(), this.#closeIdleMs);
   }
 
   /** The call's client, connecting it the first time. One that fails is dropped: the next query connects again. */

package/src/log.ts

@@ -1,10 +1,10 @@
 import { GENESIS_HASH, sealEntry, type LogFields, type LogKey, type StoredEntry } from '@coffre/core/audit';
-import { and, asc, count, desc, eq, gt, gte, lt, lte, sql, type SQL } from 'drizzle-orm';
+import { and, asc, count, desc, eq, gt, gte, lt, lte, sql, type Placeholder, type SQL } from 'drizzle-orm';
 
 import { afterCommit } from './commits.ts';
 import { tablesOf, type Queryable, type Transaction } from './database.ts';
 import { prepared } from './prepared.ts';
-import { clockMillis, forUpdate } from './dialect.ts';
+import { clockMillis, engineOf, forUpdate } from './dialect.ts';
 
 /**
  * Appending to the audit log, the one table both the app and the vault
@@ -124,15 +124,21 @@ export async function appendEntries(
   key: LogKey,
   entries: readonly NewEntry[],
   check?: (tx: Transaction) => Promise<void>,
+  /**
+   * The head as a statement of the caller's locked it, with the log's last
+   * entry and the clock as that statement read them once it held the lock:
+   * nothing to read again.
+   */
+  locked?: HeldHead,
 ): Promise<Appended> {
   if (entries.length === 0) throw new Error('appendEntries called with no entries');
   const { auditChainHead, auditLog } = tablesOf(tx);
 
   // Every append queues here, if its transaction has not already.
-  const head = await lockLogHead(tx);
+  const head = locked?.head ?? (await lockLogHead(tx));
   await check?.(tx);
-  const [{ now }] = await clockNow(tx);
-  const [last] = await lastEntry(tx);
+  const now = locked?.at ?? (await clockNow(tx))[0]!.now;
+  const last = locked === undefined ? (await lastEntry(tx))[0] : locked.last ?? undefined;
 
   const expected = last === undefined ? { nextSeq: 0n, headHash: GENESIS_HASH } : { nextSeq: last.seq + 1n, headHash: last.hash };
   if (head.nextSeq !== expected.nextSeq || !head.headHash.equals(expected.headHash)) {
@@ -179,13 +185,25 @@ export async function appendEntries(
     seq += 1n;
   }
 
-  await tx.insert(auditLog).values(rows);
-  await tx.update(auditChainHead).set({ nextSeq: seq, headHash: prevHash }).where(eq(auditChainHead.onlyRow, true));
+  if (engineOf(tx) === 'postgres' && rows.length <= ROWS_AT_ONCE) {
+    // The entries and the head that names the last of them, in one statement.
+    await tx.execute(sql`WITH appended AS (${tx.insert(auditLog).values(rows).getSQL()})
+      UPDATE audit_chain_head SET next_seq = ${seq}, head_hash = ${prevHash} WHERE only_row`);
+  } else {
+    await tx.insert(auditLog).values(rows);
+    await tx.update(auditChainHead).set({ nextSeq: seq, headHash: prevHash }).where(eq(auditChainHead.onlyRow, true));
+  }
   const written = { nextSeq: seq, headHash: prevHash };
   afterCommit(tx, () => remember(key, written));
   return { seqStart: head.nextSeq, ...written, occurredAt: now };
 }
 
+/** A head locked by a statement of the caller's, and what it read under the lock (`appendEntries`). */
+export type HeldHead = { head: { nextSeq: bigint; headHash: Buffer }; last: { seq: bigint; hash: Buffer } | null; at: number };
+
+/** Entries one statement inserts at most, at 21 parameters each: Postgres takes 65,535. */
+const ROWS_AT_ONCE = 3000;
+
 const clockNow = prepared((db) => db.select({ now: clockMillis(db) }).from(tablesOf(db).auditChainHead));
 
 const lastEntry = prepared((db) => {
@@ -325,15 +343,22 @@ export async function newestVaultSeq(db: Queryable, action: string): Promise<big
   return (row?.seq as bigint | undefined) ?? null;
 }
 
-const newestSeq = prepared((db) => {
+const newestSeq = prepared((db) => newestSeqQuery(db, sql.placeholder('action')));
+
+/**
+ * `newestVaultSeq`'s query, to run or to read inside another, as a
+ * credential's read takes the newest `policy.change` with it: one rule for
+ * what the newest is, wherever it is read.
+ */
+export function newestSeqQuery(db: Queryable, action: string | Placeholder) {
   const { auditLog } = tablesOf(db);
   return db
     .select({ seq: auditLog.seq })
     .from(auditLog)
-    .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, sql.placeholder('action')), eq(auditLog.decision, 'allow')))
+    .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, action), eq(auditLog.decision, 'allow')))
     .orderBy(desc(auditLog.seq))
     .limit(1);
-});
+}
 
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export const LOOK_BACK = { page: 32, pages: 32 };

package/src/migrations/postgres/0015_workload_access.sql

@@ -0,0 +1,43 @@
+-- Workload access (docs/design/workload-access.md, section 11): key-bound sessions, their enrollment codes, and bindings' policies. It only adds: the release before neither reads nor writes any of it, and every check is only looser for its rows, so it serves on this schema unchanged.
+CREATE TABLE "enrollments" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"binding_id" uuid NOT NULL,
+	"code_hash" "bytea" NOT NULL,
+	"code_hint" text NOT NULL,
+	"scope" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"created_with" uuid,
+	"expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "enrollments_code_hash_key" UNIQUE("code_hash"),
+	CONSTRAINT "enrollments_auth_mac_check" CHECK (octet_length("enrollments"."auth_mac") = 32),
+	CONSTRAINT "enrollments_code_hash_check" CHECK (octet_length("enrollments"."code_hash") = 32),
+	CONSTRAINT "enrollments_scope_check" CHECK ("enrollments"."scope"::jsonb IS NOT NULL)
+);
+--> statement-breakpoint
+-- The checks widen to a workload's session, a service's credential like a service token; a session carries the key it is bound to.
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_check";--> statement-breakpoint
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_matches_principal";--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "jkt" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "not_after" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "ancestors" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "constraints" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "enrollment_id" uuid;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_by" text;--> statement-breakpoint
+-- A binding's policy, inserted with it under the table-wide INSERT, and named by no UPDATE grant: as immutable as the rest of it.
+ALTER TABLE "service_bindings" ADD COLUMN "policy" text;--> statement-breakpoint
+ALTER TABLE "enrollments" ADD CONSTRAINT "enrollments_binding_id_fkey" FOREIGN KEY ("binding_id") REFERENCES "public"."service_bindings"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "enrollments_binding_idx" ON "enrollments" USING btree ("binding_id","created_at" DESC NULLS LAST);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_enrollment_id_fkey" FOREIGN KEY ("enrollment_id") REFERENCES "public"."enrollments"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+-- Freezes are the log's: a target's newest allowed freeze or lift, and a code's supersession, its tombstone.
+CREATE INDEX "audit_log_freeze_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'target'),"seq" DESC NULLS LAST) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" IN ('workload.freeze', 'workload.unfreeze') AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "audit_log_supersede_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'enrollmentId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'enrollment.supersede' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "credentials_enrollment_roots_idx" ON "credentials" USING btree ("enrollment_id","created_at") WHERE "credentials"."kind" = 'workload' AND "credentials"."ancestors" IS NULL;--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_workload_jkt_check" CHECK ("credentials"."kind" <> 'workload' OR "credentials"."jkt" IS NOT NULL);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_check" CHECK ("credentials"."kind" IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload'));--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_matches_principal" CHECK (("credentials"."kind" IN ('service', 'workload')) = ("credentials"."principal" LIKE 'token:%'));--> statement-breakpoint
+-- The app makes codes and never changes one; a session's key, hard end, ancestors, limits and code are set when it is made, and never after: renewal moves its expiry, and an approval is the one other change.
+GRANT SELECT, INSERT ON enrollments TO coffre_app;--> statement-breakpoint
+GRANT UPDATE (expires_at, approved_at, approved_by) ON credentials TO coffre_app;

package/src/migrations/postgres/0016_spent_tokens.sql

@@ -0,0 +1,12 @@
+-- Spent tokens (W157): a token's record goes once no exchange could take the token again. An exchange refuses one issued over an hour ago (MAX_TOKEN_AGE_SECONDS, 30 s of clock tolerance), so two hours after it was spent its record guards nothing. The runtime login still deletes no row itself: it asks this function, which deletes only such records, at most at_most a call. The release before never calls it.
+CREATE FUNCTION prune_consumed_tokens(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+    WITH pruned AS (
+        DELETE FROM public.consumed_tokens
+         WHERE hash IN (SELECT hash FROM public.consumed_tokens WHERE consumed_at < now() - interval '2 hours' LIMIT at_most)
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_consumed_tokens(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_consumed_tokens(integer) TO coffre_app;