@coffre/db 0.10.2 → 0.11.0

package/src/grants.ts

@@ -205,35 +205,44 @@ export async function everyProjectPreview(db: Queryable, at: number): Promise<Ev
   });
 }
 
-/** A service token or trust binding of 0.4, which carries no scope of its own yet. */
-export type Unsealed = { kind: 'token' | 'binding'; id: string; principal: string };
+/**
+ * A service token or trust binding whose scope this release has not sealed
+ * yet: none of its own, as 0.4 made it (`scope` null), or one that does not
+ * say where it reads sensitive values, as a release before 0.11 made it. By
+ * whom it was issued, `createdBy`, a person's email.
+ */
+export type Unsealed = { kind: 'token' | 'binding'; id: string; principal: string; createdBy: string; scope: string | null };
 
 /**
  * The live service tokens and trust bindings of active service accounts
- * that carry no scope yet, as 0.4 made them: what the app seals with each
- * account's grants once a process (`sealScopes`), and what `coffre migrate`
- * says it will. A credential a binding issued carries its binding's.
+ * whose scope is not sealed yet (`Unsealed`): what the app seals once a
+ * process (`sealScopes`), and what `coffre migrate` says it will. A
+ * credential a binding issued carries its binding's.
  */
 export async function unsealedCredentials(db: Queryable, at: Date): Promise<Unsealed[]> {
   const { credentials, serviceBindings, vaultMembers } = tablesOf(db);
+  // Every scope this release writes for a service says, at each place it names, whether it reads the sensitive values
+  // there; one that names none, sealed while its account held nothing, is sealed (`unsealedScope` in @coffre/server).
+  const unsealed = (scope: typeof credentials.scope | typeof serviceBindings.scope) =>
+    or(isNull(scope), and(like(scope, '%"projectId"%'), sql`${scope} NOT LIKE '%"sensitive":%'`));
   const [tokens, bindings] = await Promise.all([
     db
-      .select({ id: credentials.id, principal: credentials.principal })
+      .select({ id: credentials.id, principal: credentials.principal, createdBy: credentials.createdBy, scope: credentials.scope })
       .from(credentials)
       .innerJoin(vaultMembers, and(eq(vaultMembers.principal, credentials.principal), eq(vaultMembers.generation, credentials.generation)))
       .where(and(
         eq(credentials.kind, 'service'),
-        isNull(credentials.scope),
+        unsealed(credentials.scope),
         sql`${credentials.createdBy} NOT LIKE 'binding:%'`,
         isNull(credentials.revokedAt),
         gt(credentials.expiresAt, at),
         eq(vaultMembers.status, 'active'),
       )),
     db
-      .select({ id: serviceBindings.id, principal: serviceBindings.principal })
+      .select({ id: serviceBindings.id, principal: serviceBindings.principal, createdBy: serviceBindings.createdBy, scope: serviceBindings.scope })
       .from(serviceBindings)
       .innerJoin(vaultMembers, and(eq(vaultMembers.principal, serviceBindings.principal), eq(vaultMembers.generation, serviceBindings.generation)))
-      .where(and(isNull(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, 'active'))),
+      .where(and(unsealed(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, 'active'))),
   ]);
   return [
     ...tokens.map((row) => ({ kind: 'token' as const, ...row })),

package/src/hyperdrive.ts

@@ -48,16 +48,26 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   #busy = 0;
   /** What waits for the client to be idle: `end`. */
   readonly #idle: (() => void)[] = [];
+  /** How long the client may sit idle before it closes, or null: closed by `end` alone. */
+  readonly #closeIdleMs: number | null;
+  #idleTimer: ReturnType<typeof setTimeout> | undefined;
 
-  constructor(connectionString: string) {
+  /**
+   * `closeIdleMs`: for what outlives a call, a Durable Object, which queries
+   * now and then: the client closes once it has been idle that long, and
+   * the next query connects again.
+   */
+  constructor(connectionString: string, options: { closeIdleMs?: number } = {}) {
     if (connectionString.trim().length === 0) {
       throw new Error('Hyperdrive returned an empty connection string');
     }
     this.#connectionString = connectionString;
+    this.#closeIdleMs = options.closeIdleMs ?? null;
   }
 
   readonly query: pg.Pool['query'] = (async (...args: unknown[]) => {
     this.#busy += 1;
+    clearTimeout(this.#idleTimer);
     try {
       const client = await this.#connected();
       return await new Promise((resolve, reject) => {
@@ -72,6 +82,7 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   /** The client, for a transaction: held from now until `release`. */
   async connect(): Promise<Pick<pg.PoolClient, 'query'> & { release: () => void }> {
     this.#busy += 1;
+    clearTimeout(this.#idleTimer);
     let client: pg.Client;
     try {
       client = await this.#connected();
@@ -100,6 +111,7 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
 
   /** Close the client once nothing waits on it: what a Worker hands `waitUntil` when the call is done. */
   async end(): Promise<void> {
+    clearTimeout(this.#idleTimer);
     while (this.#busy > 0) {
       await new Promise<void>((resolve) => this.#idle.push(resolve));
     }
@@ -123,7 +135,9 @@ export class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   /** One query or transaction done: once none is left, what waits for the client to be idle goes on. */
   #done(): void {
     this.#busy -= 1;
-    if (this.#busy === 0) for (const resolve of this.#idle.splice(0)) resolve();
+    if (this.#busy > 0) return;
+    for (const resolve of this.#idle.splice(0)) resolve();
+    if (this.#closeIdleMs !== null && this.#client !== null) this.#idleTimer = setTimeout(() => void this.end(), this.#closeIdleMs);
   }
 
   /** The call's client, connecting it the first time. One that fails is dropped: the next query connects again. */

package/src/migrations/postgres/0015_workload_access.sql

@@ -0,0 +1,43 @@
+-- Workload access (docs/design/workload-access.md, section 11): key-bound sessions, their enrollment codes, and bindings' policies. It only adds: the release before neither reads nor writes any of it, and every check is only looser for its rows, so it serves on this schema unchanged.
+CREATE TABLE "enrollments" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"binding_id" uuid NOT NULL,
+	"code_hash" "bytea" NOT NULL,
+	"code_hint" text NOT NULL,
+	"scope" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"created_with" uuid,
+	"expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "enrollments_code_hash_key" UNIQUE("code_hash"),
+	CONSTRAINT "enrollments_auth_mac_check" CHECK (octet_length("enrollments"."auth_mac") = 32),
+	CONSTRAINT "enrollments_code_hash_check" CHECK (octet_length("enrollments"."code_hash") = 32),
+	CONSTRAINT "enrollments_scope_check" CHECK ("enrollments"."scope"::jsonb IS NOT NULL)
+);
+--> statement-breakpoint
+-- The checks widen to a workload's session, a service's credential like a service token; a session carries the key it is bound to.
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_check";--> statement-breakpoint
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_matches_principal";--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "jkt" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "not_after" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "ancestors" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "constraints" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "enrollment_id" uuid;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_by" text;--> statement-breakpoint
+-- A binding's policy, inserted with it under the table-wide INSERT, and named by no UPDATE grant: as immutable as the rest of it.
+ALTER TABLE "service_bindings" ADD COLUMN "policy" text;--> statement-breakpoint
+ALTER TABLE "enrollments" ADD CONSTRAINT "enrollments_binding_id_fkey" FOREIGN KEY ("binding_id") REFERENCES "public"."service_bindings"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "enrollments_binding_idx" ON "enrollments" USING btree ("binding_id","created_at" DESC NULLS LAST);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_enrollment_id_fkey" FOREIGN KEY ("enrollment_id") REFERENCES "public"."enrollments"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+-- Freezes are the log's: a target's newest allowed freeze or lift, and a code's supersession, its tombstone.
+CREATE INDEX "audit_log_freeze_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'target'),"seq" DESC NULLS LAST) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" IN ('workload.freeze', 'workload.unfreeze') AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "audit_log_supersede_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'enrollmentId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'enrollment.supersede' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "credentials_enrollment_roots_idx" ON "credentials" USING btree ("enrollment_id","created_at") WHERE "credentials"."kind" = 'workload' AND "credentials"."ancestors" IS NULL;--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_workload_jkt_check" CHECK ("credentials"."kind" <> 'workload' OR "credentials"."jkt" IS NOT NULL);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_check" CHECK ("credentials"."kind" IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload'));--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_matches_principal" CHECK (("credentials"."kind" IN ('service', 'workload')) = ("credentials"."principal" LIKE 'token:%'));--> statement-breakpoint
+-- The app makes codes and never changes one; a session's key, hard end, ancestors, limits and code are set when it is made, and never after: renewal moves its expiry, and an approval is the one other change.
+GRANT SELECT, INSERT ON enrollments TO coffre_app;--> statement-breakpoint
+GRANT UPDATE (expires_at, approved_at, approved_by) ON credentials TO coffre_app;

package/src/migrations/postgres/0016_spent_tokens.sql

@@ -0,0 +1,12 @@
+-- Spent tokens (W157): a token's record goes once no exchange could take the token again. An exchange refuses one issued over an hour ago (MAX_TOKEN_AGE_SECONDS, 30 s of clock tolerance), so two hours after it was spent its record guards nothing. The runtime login still deletes no row itself: it asks this function, which deletes only such records, at most at_most a call. The release before never calls it.
+CREATE FUNCTION prune_consumed_tokens(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+    WITH pruned AS (
+        DELETE FROM public.consumed_tokens
+         WHERE hash IN (SELECT hash FROM public.consumed_tokens WHERE consumed_at < now() - interval '2 hours' LIMIT at_most)
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_consumed_tokens(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_consumed_tokens(integer) TO coffre_app;