@coffre/db 0.10.2 → 0.11.0

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-DBtn3jqp.js";
+import { t as Database } from "./database-Dh4W2pAj.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-DBtn3jqp.d.ts → database-Dh4W2pAj.d.ts}

@@ -1,4 +1,4 @@
-import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
+import { h as schema_d_exports } from "./schema-DG2t57Kf.js";
 import { Query, Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-DBtn3jqp.js";
+import { i as Queryable } from "./database-Dh4W2pAj.js";
 import { SQL, SQLWrapper } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts

package/dist/grants.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-DBtn3jqp.js";
+import { i as Queryable } from "./database-Dh4W2pAj.js";
 import { Authenticity, Newest } from "./log.js";
 import { StoredEntry } from "@coffre/core/audit";
 import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";
@@ -92,17 +92,24 @@ export type EveryProjectPreview = {
  * converts is listed.
  */
 export declare function everyProjectPreview(db: Queryable, at: number): Promise<EveryProjectPreview[]>;
-/** A service token or trust binding of 0.4, which carries no scope of its own yet. */
+/**
+ * A service token or trust binding whose scope this release has not sealed
+ * yet: none of its own, as 0.4 made it (`scope` null), or one that does not
+ * say where it reads sensitive values, as a release before 0.11 made it. By
+ * whom it was issued, `createdBy`, a person's email.
+ */
 export type Unsealed = {
   kind: 'token' | 'binding';
   id: string;
   principal: string;
+  createdBy: string;
+  scope: string | null;
 };
 /**
  * The live service tokens and trust bindings of active service accounts
- * that carry no scope yet, as 0.4 made them: what the app seals with each
- * account's grants once a process (`sealScopes`), and what `coffre migrate`
- * says it will. A credential a binding issued carries its binding's.
+ * whose scope is not sealed yet (`Unsealed`): what the app seals once a
+ * process (`sealScopes`), and what `coffre migrate` says it will. A
+ * credential a binding issued carries its binding's.
  */
 export declare function unsealedCredentials(db: Queryable, at: Date): Promise<Unsealed[]>;
 /**

package/dist/grants.js

@@ -1,7 +1,7 @@
 import { tombstone, truth } from "./dialect.js";
 import { a as prepared, i as tablesOf } from "./database-BadNeeN-.js";
 import { entryColumns, newestAuthentic } from "./log.js";
-import { and, asc, desc, eq, gt, inArray, isNull, lt, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq, gt, inArray, isNull, like, lt, or, sql } from "drizzle-orm";
 import { EVERYWHERE, administers, convertEveryProjectGrants, isInstanceRole, isScope, normalScope, unscoped } from "@coffre/core/access";
 import { ACCESS_ACTIONS } from "@coffre/core/vault";
 //#region src/grants.ts
@@ -170,19 +170,24 @@ async function everyProjectPreview(db, at) {
 }
 /**
 * The live service tokens and trust bindings of active service accounts
-* that carry no scope yet, as 0.4 made them: what the app seals with each
-* account's grants once a process (`sealScopes`), and what `coffre migrate`
-* says it will. A credential a binding issued carries its binding's.
+* whose scope is not sealed yet (`Unsealed`): what the app seals once a
+* process (`sealScopes`), and what `coffre migrate` says it will. A
+* credential a binding issued carries its binding's.
 */
 async function unsealedCredentials(db, at) {
 	const { credentials, serviceBindings, vaultMembers } = tablesOf(db);
+	const unsealed = (scope) => or(isNull(scope), and(like(scope, "%\"projectId\"%"), sql`${scope} NOT LIKE '%"sensitive":%'`));
 	const [tokens, bindings] = await Promise.all([db.select({
 		id: credentials.id,
-		principal: credentials.principal
-	}).from(credentials).innerJoin(vaultMembers, and(eq(vaultMembers.principal, credentials.principal), eq(vaultMembers.generation, credentials.generation))).where(and(eq(credentials.kind, "service"), isNull(credentials.scope), sql`${credentials.createdBy} NOT LIKE 'binding:%'`, isNull(credentials.revokedAt), gt(credentials.expiresAt, at), eq(vaultMembers.status, "active"))), db.select({
+		principal: credentials.principal,
+		createdBy: credentials.createdBy,
+		scope: credentials.scope
+	}).from(credentials).innerJoin(vaultMembers, and(eq(vaultMembers.principal, credentials.principal), eq(vaultMembers.generation, credentials.generation))).where(and(eq(credentials.kind, "service"), unsealed(credentials.scope), sql`${credentials.createdBy} NOT LIKE 'binding:%'`, isNull(credentials.revokedAt), gt(credentials.expiresAt, at), eq(vaultMembers.status, "active"))), db.select({
 		id: serviceBindings.id,
-		principal: serviceBindings.principal
-	}).from(serviceBindings).innerJoin(vaultMembers, and(eq(vaultMembers.principal, serviceBindings.principal), eq(vaultMembers.generation, serviceBindings.generation))).where(and(isNull(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, "active")))]);
+		principal: serviceBindings.principal,
+		createdBy: serviceBindings.createdBy,
+		scope: serviceBindings.scope
+	}).from(serviceBindings).innerJoin(vaultMembers, and(eq(vaultMembers.principal, serviceBindings.principal), eq(vaultMembers.generation, serviceBindings.generation))).where(and(unsealed(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, "active")))]);
 	return [...tokens.map((row) => ({
 		kind: "token",
 		...row

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-DBtn3jqp.js";
+import { n as PoolLike } from "./database-Dh4W2pAj.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */
@@ -36,7 +36,14 @@ export declare function postgres(hyperdrive: {
  */
 export declare class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   #private;
-  constructor(connectionString: string);
+  /**
+   * `closeIdleMs`: for what outlives a call, a Durable Object, which queries
+   * now and then: the client closes once it has been idle that long, and
+   * the next query connects again.
+   */
+  constructor(connectionString: string, options?: {
+    closeIdleMs?: number;
+  });
   readonly query: pg.Pool['query'];
   /** The client, for a transaction: held from now until `release`. */
   connect(): Promise<Pick<pg.PoolClient, 'query'> & {

package/dist/hyperdrive.js

@@ -43,12 +43,22 @@ var HyperdrivePool = class {
 	#busy = 0;
 	/** What waits for the client to be idle: `end`. */
 	#idle = [];
-	constructor(connectionString) {
+	/** How long the client may sit idle before it closes, or null: closed by `end` alone. */
+	#closeIdleMs;
+	#idleTimer;
+	/**
+	* `closeIdleMs`: for what outlives a call, a Durable Object, which queries
+	* now and then: the client closes once it has been idle that long, and
+	* the next query connects again.
+	*/
+	constructor(connectionString, options = {}) {
 		if (connectionString.trim().length === 0) throw new Error("Hyperdrive returned an empty connection string");
 		this.#connectionString = connectionString;
+		this.#closeIdleMs = options.closeIdleMs ?? null;
 	}
 	query = (async (...args) => {
 		this.#busy += 1;
+		clearTimeout(this.#idleTimer);
 		try {
 			const client = await this.#connected();
 			return await new Promise((resolve, reject) => {
@@ -61,6 +71,7 @@ var HyperdrivePool = class {
 	/** The client, for a transaction: held from now until `release`. */
 	async connect() {
 		this.#busy += 1;
+		clearTimeout(this.#idleTimer);
 		let client;
 		try {
 			client = await this.#connected();
@@ -86,6 +97,7 @@ var HyperdrivePool = class {
 	}
 	/** Close the client once nothing waits on it: what a Worker hands `waitUntil` when the call is done. */
 	async end() {
+		clearTimeout(this.#idleTimer);
 		while (this.#busy > 0) await new Promise((resolve) => this.#idle.push(resolve));
 		const client = this.#client;
 		this.#client = null;
@@ -104,7 +116,9 @@ var HyperdrivePool = class {
 	/** One query or transaction done: once none is left, what waits for the client to be idle goes on. */
 	#done() {
 		this.#busy -= 1;
-		if (this.#busy === 0) for (const resolve of this.#idle.splice(0)) resolve();
+		if (this.#busy > 0) return;
+		for (const resolve of this.#idle.splice(0)) resolve();
+		if (this.#closeIdleMs !== null && this.#client !== null) this.#idleTimer = setTimeout(() => void this.end(), this.#closeIdleMs);
 	}
 	/** The call's client, connecting it the first time. One that fails is dropped: the next query connects again. */
 	#connected() {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
-import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-DBtn3jqp.js";
+import { h as schema_d_exports } from "./schema-DG2t57Kf.js";
+import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-Dh4W2pAj.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, prepared, schema_d_exports as schema, tablesOf };

package/dist/log.d.ts

@@ -1,4 +1,4 @@
-import { a as Transaction, i as Queryable } from "./database-DBtn3jqp.js";
+import { a as Transaction, i as Queryable } from "./database-Dh4W2pAj.js";
 import { Placeholder, SQL } from "drizzle-orm";
 import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts

package/dist/migrations/postgres/0015_workload_access.sql

@@ -0,0 +1,43 @@
+-- Workload access (docs/design/workload-access.md, section 11): key-bound sessions, their enrollment codes, and bindings' policies. It only adds: the release before neither reads nor writes any of it, and every check is only looser for its rows, so it serves on this schema unchanged.
+CREATE TABLE "enrollments" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"binding_id" uuid NOT NULL,
+	"code_hash" "bytea" NOT NULL,
+	"code_hint" text NOT NULL,
+	"scope" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"created_with" uuid,
+	"expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "enrollments_code_hash_key" UNIQUE("code_hash"),
+	CONSTRAINT "enrollments_auth_mac_check" CHECK (octet_length("enrollments"."auth_mac") = 32),
+	CONSTRAINT "enrollments_code_hash_check" CHECK (octet_length("enrollments"."code_hash") = 32),
+	CONSTRAINT "enrollments_scope_check" CHECK ("enrollments"."scope"::jsonb IS NOT NULL)
+);
+--> statement-breakpoint
+-- The checks widen to a workload's session, a service's credential like a service token; a session carries the key it is bound to.
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_check";--> statement-breakpoint
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_matches_principal";--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "jkt" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "not_after" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "ancestors" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "constraints" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "enrollment_id" uuid;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_by" text;--> statement-breakpoint
+-- A binding's policy, inserted with it under the table-wide INSERT, and named by no UPDATE grant: as immutable as the rest of it.
+ALTER TABLE "service_bindings" ADD COLUMN "policy" text;--> statement-breakpoint
+ALTER TABLE "enrollments" ADD CONSTRAINT "enrollments_binding_id_fkey" FOREIGN KEY ("binding_id") REFERENCES "public"."service_bindings"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "enrollments_binding_idx" ON "enrollments" USING btree ("binding_id","created_at" DESC NULLS LAST);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_enrollment_id_fkey" FOREIGN KEY ("enrollment_id") REFERENCES "public"."enrollments"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+-- Freezes are the log's: a target's newest allowed freeze or lift, and a code's supersession, its tombstone.
+CREATE INDEX "audit_log_freeze_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'target'),"seq" DESC NULLS LAST) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" IN ('workload.freeze', 'workload.unfreeze') AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "audit_log_supersede_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'enrollmentId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'enrollment.supersede' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "credentials_enrollment_roots_idx" ON "credentials" USING btree ("enrollment_id","created_at") WHERE "credentials"."kind" = 'workload' AND "credentials"."ancestors" IS NULL;--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_workload_jkt_check" CHECK ("credentials"."kind" <> 'workload' OR "credentials"."jkt" IS NOT NULL);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_check" CHECK ("credentials"."kind" IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload'));--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_matches_principal" CHECK (("credentials"."kind" IN ('service', 'workload')) = ("credentials"."principal" LIKE 'token:%'));--> statement-breakpoint
+-- The app makes codes and never changes one; a session's key, hard end, ancestors, limits and code are set when it is made, and never after: renewal moves its expiry, and an approval is the one other change.
+GRANT SELECT, INSERT ON enrollments TO coffre_app;--> statement-breakpoint
+GRANT UPDATE (expires_at, approved_at, approved_by) ON credentials TO coffre_app;

package/dist/migrations/postgres/0016_spent_tokens.sql

@@ -0,0 +1,12 @@
+-- Spent tokens (W157): a token's record goes once no exchange could take the token again. An exchange refuses one issued over an hour ago (MAX_TOKEN_AGE_SECONDS, 30 s of clock tolerance), so two hours after it was spent its record guards nothing. The runtime login still deletes no row itself: it asks this function, which deletes only such records, at most at_most a call. The release before never calls it.
+CREATE FUNCTION prune_consumed_tokens(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+    WITH pruned AS (
+        DELETE FROM public.consumed_tokens
+         WHERE hash IN (SELECT hash FROM public.consumed_tokens WHERE consumed_at < now() - interval '2 hours' LIMIT at_most)
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_consumed_tokens(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_consumed_tokens(integer) TO coffre_app;