@coffre/db 0.14.3 → 0.14.5

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-Ds1Y79h6.js";
+import { t as Database } from "./database-wq1AVRAP.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-Ds1Y79h6.d.ts → database-wq1AVRAP.d.ts}

@@ -1,4 +1,4 @@
-import { g as schema_d_exports } from "./schema-DcVkJhCf.js";
+import { g as schema_d_exports } from "./schema-BfQEBqFv.js";
 import { Query, Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-Ds1Y79h6.js";
+import { i as Queryable } from "./database-wq1AVRAP.js";
 import { SQL, SQLWrapper } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts

package/dist/grants.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-Ds1Y79h6.js";
+import { i as Queryable } from "./database-wq1AVRAP.js";
 import { Authenticity, Newest } from "./log.js";
 import { StoredEntry } from "@coffre/core/audit";
 import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-Ds1Y79h6.js";
+import { n as PoolLike } from "./database-wq1AVRAP.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { g as schema_d_exports } from "./schema-DcVkJhCf.js";
-import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-Ds1Y79h6.js";
+import { g as schema_d_exports } from "./schema-BfQEBqFv.js";
+import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-wq1AVRAP.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, prepared, schema_d_exports as schema, tablesOf };

package/dist/log.d.ts

@@ -1,4 +1,4 @@
-import { a as Transaction, i as Queryable } from "./database-Ds1Y79h6.js";
+import { a as Transaction, i as Queryable } from "./database-wq1AVRAP.js";
 import { Placeholder, SQL } from "drizzle-orm";
 import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts
@@ -48,6 +48,16 @@ export type Appended = {
 export declare class LogHeadMismatch extends Error {
   constructor(message: string);
 }
+/**
+ * As many transactions as may already wait for the log's head do
+ * (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+ * Its code is Postgres's for a lock not available, so every caller already
+ * answers it as one that gave up waiting: unavailable, ask again shortly.
+ */
+export declare class HeadBusy extends Error {
+  readonly code = "55P03";
+  constructor();
+}
 /**
  * The log's head is behind one this process wrote: the database was rolled
  * back, or entries were cut off its end. That cannot be told from a restore,
@@ -92,6 +102,22 @@ export declare function lockLogHead(tx: Transaction): Promise<{
  * SQLite's transactions hold the whole file, so the head is always free.
  */
 export declare function lockLogHeadIfFree(tx: Transaction): Promise<boolean>;
+/**
+ * Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+ * `waiters` other transactions hold one of its places in line; otherwise
+ * refuse at once (`HeadBusy`), having waited for nothing. A place is an
+ * advisory lock, tried, never waited for, and held to the end of the
+ * transaction, which holds the head by then: so at most `waiters`
+ * connections wait for the head, or hold it, through here, and a burst
+ * beyond them answers in one round trip rather than seconds later, holding
+ * a connection all the while. One statement: the place, then, only if one
+ * was free, the head; refused, one more says whether the head is there at
+ * all. SQLite's transactions hold the whole file.
+ */
+export declare function lockLogHeadQueued(tx: Transaction, waiters: number): Promise<{
+  nextSeq: bigint;
+  headHash: Buffer;
+}>;
 /**
  * Append `entries` under `key`. `check`, when given, runs once the head is
  * locked and before anything is written: a writer's own condition on the

package/dist/log.js

@@ -12,6 +12,19 @@ var LogHeadMismatch = class extends Error {
 	}
 };
 /**
+* As many transactions as may already wait for the log's head do
+* (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+* Its code is Postgres's for a lock not available, so every caller already
+* answers it as one that gave up waiting: unavailable, ask again shortly.
+*/
+var HeadBusy = class extends Error {
+	code = "55P03";
+	constructor() {
+		super("too many requests wait for the audit log's head: ask again shortly");
+		this.name = "HeadBusy";
+	}
+};
+/**
 * The log's head is behind one this process wrote: the database was rolled
 * back, or entries were cut off its end. That cannot be told from a restore,
 * so the append refuses and someone has to look.
@@ -99,6 +112,42 @@ async function lockLogHeadIfFree(tx) {
 	if (rows.length > 0) holding.add(tx);
 	return rows.length > 0;
 }
+/**
+* Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+* `waiters` other transactions hold one of its places in line; otherwise
+* refuse at once (`HeadBusy`), having waited for nothing. A place is an
+* advisory lock, tried, never waited for, and held to the end of the
+* transaction, which holds the head by then: so at most `waiters`
+* connections wait for the head, or hold it, through here, and a burst
+* beyond them answers in one round trip rather than seconds later, holding
+* a connection all the while. One statement: the place, then, only if one
+* was free, the head; refused, one more says whether the head is there at
+* all. SQLite's transactions hold the whole file.
+*/
+async function lockLogHeadQueued(tx, waiters) {
+	if (engineOf(tx) === "sqlite") return lockLogHead(tx);
+	const { rows } = await tx.execute(sql`
+    SELECT next_seq, head_hash FROM audit_chain_head
+    WHERE only_row AND (SELECT true FROM generate_series(1, ${waiters}::int) AS place WHERE pg_try_advisory_xact_lock(${HEAD_LINE}, place) LIMIT 1)
+    FOR UPDATE`);
+	const [head] = rows;
+	if (head === void 0) {
+		const { rows: [found] } = await tx.execute(sql`SELECT EXISTS (SELECT 1 FROM audit_chain_head WHERE only_row) AS found`);
+		if (found?.found !== true) throw new Error("audit_chain_head is missing; refusing to write an unchained entry");
+		throw new HeadBusy();
+	}
+	holding.add(tx);
+	return {
+		nextSeq: BigInt(head.next_seq),
+		headHash: head.head_hash
+	};
+}
+/**
+* The first key of the head's places in line, Postgres's advisory locks:
+* the second is the place. A space apart from the members' queues and the
+* migrator's key.
+*/
+const HEAD_LINE = 1668245096;
 const lockedHead = prepared((db) => {
 	const { auditChainHead } = tablesOf(db);
 	return forUpdate(db, db.select({
@@ -388,4 +437,4 @@ async function newestAuthentic(page, check) {
 	return "unreached";
 }
 //#endregion
-export { BATCH_BYTES, KeyRetired, LOOK_BACK, LogHeadMismatch, LogRewound, MOVES_FROM, appendEntries, entryColumns, forgetLogHeads, lockLogHead, lockLogHeadIfFree, missingEntry, newestAuthentic, newestSeqQuery, newestVaultEntries, newestVaultSeq, withinBytes };
+export { BATCH_BYTES, HeadBusy, KeyRetired, LOOK_BACK, LogHeadMismatch, LogRewound, MOVES_FROM, appendEntries, entryColumns, forgetLogHeads, lockLogHead, lockLogHeadIfFree, lockLogHeadQueued, missingEntry, newestAuthentic, newestSeqQuery, newestVaultEntries, newestVaultSeq, withinBytes };

package/dist/migrations/postgres/0020_vault_releases.sql

@@ -0,0 +1,36 @@
+-- Releases (W199): each key the vault released to a principal, and when last, so that its bulk limit counts the keys released within a window from a row per key, not from every read the principal ever made. The database keeps it, from each vault `secret.read` allowed, in the append's own transaction; the release before neither reads it nor knows it is kept, and its appends keep it too.
+CREATE TABLE "vault_releases" (
+	"principal" text NOT NULL,
+	"key" text NOT NULL,
+	"released_at" bigint NOT NULL,
+	CONSTRAINT "vault_releases_pkey" PRIMARY KEY("principal","key")
+);
+--> statement-breakpoint
+-- Room in each page for the next version of its rows: a read moves its keys' times on in place (a HOT update), so the
+-- table and its key stay a row a key, however often each is read: the page prunes the versions before as it is read.
+ALTER TABLE vault_releases SET (fillfactor = 50);--> statement-breakpoint
+-- Each key the entry names, as the count read them before: the secret, or each item of a read's list at one place, or, for an entry that names none, which only a forged one is, the entry itself. As the owner, so that no login may write the table: the vault's appends reach it only through the log.
+CREATE FUNCTION vault_releases_keep() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+BEGIN
+    INSERT INTO public.vault_releases AS kept (principal, key, released_at)
+    SELECT DISTINCT NEW.actor, coalesce(NEW.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || NEW.seq), NEW.occurred_at
+      FROM (SELECT) AS entry
+      LEFT JOIN LATERAL jsonb_path_query(CASE WHEN NEW.secret_id IS NULL THEN NEW.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+    ON CONFLICT (principal, key) DO UPDATE SET released_at = greatest(kept.released_at, excluded.released_at);
+    RETURN NULL;
+END
+$$;--> statement-breakpoint
+-- A trigger runs its function whoever may execute it: no login may call it otherwise.
+REVOKE ALL ON FUNCTION vault_releases_keep() FROM PUBLIC;--> statement-breakpoint
+CREATE TRIGGER audit_log_releases AFTER INSERT ON audit_log FOR EACH ROW
+    WHEN (NEW.author = 'vault' AND NEW.action = 'secret.read' AND NEW.decision = 'allow')
+    EXECUTE FUNCTION vault_releases_keep();--> statement-breakpoint
+-- Then the releases already in the log, in the same transaction: an append waits from the trigger to the commit, and none is missed.
+INSERT INTO vault_releases (principal, key, released_at)
+SELECT e.actor, coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq), max(e.occurred_at)
+  FROM audit_log e
+  LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+ WHERE e.author = 'vault' AND e.action = 'secret.read' AND e.decision = 'allow'
+ GROUP BY 1, 2;--> statement-breakpoint
+GRANT SELECT ON vault_releases TO coffre_vault, coffre_backup;

package/dist/migrations/postgres/0021_prune_vault_releases.sql

@@ -0,0 +1,19 @@
+-- Releases pruned (W199, T111): the vault's checkpoint forgets the releases no window can count again, those over a day and an hour old by the database's clock, at most at_most a call. A bulk limit's window is a day at most (the vault's config), and the hour is a margin for the clock stepping back: no caller chooses what is kept, so the vault's login, which still deletes no row itself, cannot forget a release a window counts. The release before never calls it.
+CREATE FUNCTION prune_vault_releases(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '3s' AS $$
+    -- The bound in the DELETE's own WHERE too: a row a read moved on since the subquery's snapshot is checked again,
+    -- as it is now, and kept.
+    WITH bound AS (SELECT (extract(epoch from clock_timestamp()) * 1000)::bigint - 25 * 3600000 AS before),
+    pruned AS (
+        DELETE FROM public.vault_releases
+         WHERE released_at < (SELECT before FROM bound)
+           AND ctid IN (
+            -- Any of them, each past every window; a row an append holds is left to the next run, rather than waited for.
+            SELECT ctid FROM public.vault_releases WHERE released_at < (SELECT before FROM bound) LIMIT at_most FOR UPDATE SKIP LOCKED
+           )
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_vault_releases(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_vault_releases(integer) TO coffre_vault;