@coffre/db 0.14.4 → 0.15.0

package/src/schema.sqlite.ts

@@ -14,8 +14,8 @@ import {
   type AnySQLiteColumn,
 } from 'drizzle-orm/sqlite-core';
 
-import { asPostgres } from './portable.ts';
-import { ACTIVE_SUBJECT, relationsOf } from './relations.ts';
+import { ACTIVE_SUBJECT } from './active-subject.ts';
+import { recorded } from './change-records.ts';
 
 /**
  * The schema in schema.ts, for SQLite (through libsql). Same tables,
@@ -86,8 +86,12 @@ export const environments = sqliteTable(
     archivedAt: time('archived_at'),
     parentId: text('parent_id'),
     owner: text(),
+    protected: flag('protected'),
+    // 0.15's seal (schema.ts).
+    seal: bytes('seal'),
   },
   (table) => [
+    check('environments_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     unique('environments_project_id_slug_key').on(table.projectId, table.slug),
     unique('environments_project_scoped').on(table.id, table.projectId),
     check('environments_slug_check', isPlaceSlug(table.slug)),
@@ -125,8 +129,11 @@ export const secrets = sqliteTable(
     currentVersion: integer('current_version').notNull().default(0),
     archivedAt: time('archived_at'),
     folder: text(),
+    // 0.15's seal (schema.ts).
+    seal: bytes('seal'),
   },
   (table) => [
+    check('secrets_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     unique('secrets_project_id_environment_id_key_key').on(table.projectId, table.environmentId, table.key),
     check(
       'secrets_key_check',
@@ -149,6 +156,8 @@ export const secrets = sqliteTable(
       foreignColumns: [environments.id, environments.projectId],
     }),
     index('secrets_lookup_idx').on(table.projectId, table.environmentId, table.key),
+    // The live keys of an environment, which a read by environment alone (the places tree's counts, `liveKeysIn`) walks without the archived ones beside them; the one above leads with the project (T152, 0032).
+    index('secrets_live_idx').on(table.environmentId).where(sql`${table.archivedAt} IS NULL`),
   ],
 );
 
@@ -240,8 +249,11 @@ export const vaultMembers = sqliteTable(
     statusChangedBy: text('status_changed_by').notNull(),
     accessSeq: int64('access_seq').notNull(),
     mac: bytes('mac').notNull(),
+    // 0.15's seal (schema.ts).
+    seal: bytes('seal'),
   },
   (table) => [
+    check('vault_members_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     check('vault_members_mac_check', sql`octet_length(${table.mac}) = 32`),
     // `^(user|token):[^[:space:]:][^[:space:]]*$`, without regular expressions.
     check(
@@ -312,8 +324,8 @@ export const vaultGrants = sqliteTable(
  * read them from the entries before (an entry that names none, which only
  * a forged one is, counts as a key of its own, `entry:<seq>`). No login
  * writes it: the vault and the backup read it. A row a window old counts
- * for nothing, so nothing prunes them: there are at most as many as
- * principals times keys, and a count reads one principal's.
+ * for nothing: the vault's checkpoint forgets those a day and an hour old,
+ * longer than any window, so a count reads about a day of keys.
  */
 export const vaultReleases = sqliteTable(
   'vault_releases',
@@ -357,6 +369,8 @@ export const auditLog = sqliteTable(
     prevHash: bytes('prev_hash').notNull(),
     mac: bytes('mac').notNull(),
     hash: bytes('hash').notNull(),
+    // Set on every entry a writer under 0.15's log appends (schema.ts says why).
+    log015: flag('log015'),
   },
   (table) => [
     check('audit_log_author_check', sql`${table.author} IN ('app', 'vault')`),
@@ -451,6 +465,10 @@ export const secretReferences = sqliteTable(
     createdSeq: int64('created_seq').notNull(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
+    // 0.15's end of the reference (0028): when its holder stopped reading its source, broken, replaced or cut, written
+    // with 0.14's `reference.end` in the vault's decision. The holder's object reads its newest row's source only while
+    // this is null. Null on rows 0.14 ended: 0.14's log holds those ends, which the cutover (plan PR 9) writes here.
+    endedAt: time('ended_at'),
   },
   (table) => [
     unique('secret_references_created_seq_key').on(table.createdSeq),
@@ -546,14 +564,19 @@ export const serviceBindings = sqliteTable(
     scope: text(),
     // What a workload's binding says beyond its claims (`BindingPolicy`), canonical JSON: null on a binding `/api/auth/oidc` takes, never on another (docs/design/workload-access.md, section 11).
     policy: text(),
+    // The instance it was made on (schema.ts).
+    origin: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
     lastUsedAt: time('last_used_at'),
     revokedAt: time('revoked_at'),
     revokedBy: text('revoked_by'),
+    // 0.15's seal (schema.ts).
+    seal: bytes('seal'),
   },
   (table) => [
+    check('service_bindings_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     check('service_bindings_principal_check', sql`${table.principal} LIKE 'token:%'`),
     check('service_bindings_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
     check('service_bindings_claims_check', sql`json_valid(${table.claims})`),
@@ -651,8 +674,11 @@ export const mcpConnections = sqliteTable(
     lastUsedIp: text('last_used_ip'),
     revokedAt: time('revoked_at'),
     revokedBy: text('revoked_by'),
+    // 0.15's seal (schema.ts).
+    seal: bytes('seal'),
   },
   (table) => [
+    check('mcp_connections_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     check('mcp_connections_principal_check', sql`${table.principal} LIKE 'user:%'`),
     check('mcp_connections_registration_check', sql`${table.registration} IN ('cimd', 'dcr')`),
     check('mcp_connections_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
@@ -778,8 +804,11 @@ export const credentials = sqliteTable(
     enrollmentId: text('enrollment_id'),
     approvedAt: time('approved_at'),
     approvedBy: text('approved_by'),
+    // 0.15's seal (schema.ts).
+    seal: bytes('seal'),
   },
   (table) => [
+    check('credentials_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     unique('credentials_token_hash_key').on(table.tokenHash),
     check('credentials_kind_check', sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload')`),
     check('credentials_principal_check', sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
@@ -858,9 +887,171 @@ export const deviceAuthorizations = sqliteTable(
   ],
 );
 
-export const {
-  environmentsRelations,
-  secretsRelations,
-} = relationsOf(
-  asPostgres({ projects, environments, secrets, secretVersions }),
+/** 0.15's configuration objects (schema.ts). */
+export const logConfig = sqliteTable(
+  'log_config',
+  {
+    name: text().primaryKey(),
+    value: text().notNull(),
+    seal: bytes('seal'),
+  },
+  (table) => [
+    check('log_config_name_check', sql`${table.name} IN ('policy', 'roles')`),
+    check('log_config_value_check', sql`json_valid(${table.value})`),
+    check('log_config_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
+  ],
+);
+
+/**
+ * 0.15's log (schema.ts). SQLite has one writer, so the fence is implicit,
+ * and nothing is partitioned: uses and tiles are one table each.
+ */
+export const logChanges = sqliteTable(
+  'log_changes',
+  {
+    number: int64('number').primaryKey(),
+    at: integer({ mode: 'number' }).notNull(),
+    requestId: text('request_id').notNull(),
+    object: text().notNull(),
+    actor: text().notNull(),
+    payload: text().notNull(),
+    seal: bytes('seal'),
+    mac: bytes('mac').notNull(),
+  },
+  (table) => [
+    unique('log_changes_request_id_key').on(table.requestId),
+    check('log_changes_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
+    check('log_changes_mac_check', sql`octet_length(${table.mac}) = 16`),
+    index('log_changes_object_idx').on(table.object, table.number),
+    // The sign-ins through trust bindings (schema.ts).
+    index('log_changes_sign_in_idx').on(table.at, table.number).where(recorded('sqlite', table.payload, 'signIn')),
+    index('log_changes_sign_in_actor_idx').on(table.actor, table.at, table.number).where(recorded('sqlite', table.payload, 'signIn')),
+    // The vault's token issues, revokes and sign-outs (schema.ts).
+    index('log_changes_issue_revoke_idx').on(table.at, table.number).where(recorded('sqlite', table.payload, 'issue', 'revoke', 'signOut')),
+    index('log_changes_issue_revoke_actor_idx').on(table.actor, table.at, table.number).where(recorded('sqlite', table.payload, 'issue', 'revoke', 'signOut')),
+  ],
+);
+
+export const logUses = sqliteTable(
+  'log_uses',
+  {
+    number: int64('number').notNull(),
+    at: integer({ mode: 'number' }).notNull(),
+    requestId: int64('request_id').notNull(),
+    credential: text().notNull(),
+    secret: text().notNull(),
+    purpose: integer().notNull(),
+    mac: bytes('mac').notNull(),
+    place: text(),
+  },
+  (table) => [
+    check('log_uses_mac_check', sql`octet_length(${table.mac}) = 16`),
+    uniqueIndex('log_uses_request_idx').on(table.at, table.requestId),
+  ],
+);
+
+/** 0.15's reads as the audit pages list them (schema.ts). */
+export const logReads = sqliteTable(
+  'log_reads',
+  {
+    number: int64('number').notNull(),
+    at: integer({ mode: 'number' }).notNull(),
+    credential: text().notNull(),
+    purpose: integer().notNull(),
+    principal: text().notNull(),
+    secret: text().notNull(),
+    environment: text().notNull(),
+    project: text().notNull(),
+    place: text(),
+    source: text(),
+    sourceEnvironment: text('source_environment'),
+    sourceProject: text('source_project'),
+    version: text(),
+    mac: bytes('mac').notNull(),
+  },
+  (table) => [
+    check('log_reads_mac_check', sql`octet_length(${table.mac}) = 16`),
+    uniqueIndex('log_reads_number_idx').on(table.at, table.number),
+    index('log_reads_principal_idx').on(table.principal, table.at, table.number),
+  ],
+);
+
+/** The days each member's reads are in (`log_reads`), so that a page of theirs reads those days alone: the projector writes them with the reads. */
+export const logReadDays = sqliteTable(
+  'log_read_days',
+  { principal: text().notNull(), day: integer({ mode: 'number' }).notNull() },
+  (table) => [primaryKey({ name: 'log_read_days_pkey', columns: [table.principal, table.day] })],
+);
+
+/** How far the projector has gone (schema.ts). */
+export const logReadsCursor = sqliteTable(
+  'log_reads_cursor',
+  {
+    onlyRow: flag('only_row').primaryKey().default(true),
+    through: int64('through').notNull(),
+    pair: int64('pair').notNull(),
+    at: integer({ mode: 'number' }).notNull(),
+    mac: bytes('mac'),
+  },
+  (table) => [
+    check('log_reads_cursor_only_row_check', sql`${table.onlyRow}`),
+    check('log_reads_cursor_mac_check', sql`${table.mac} IS NULL OR octet_length(${table.mac}) = 16`),
+  ],
+);
+
+export const logBulk = sqliteTable(
+  'log_bulk',
+  {
+    principal: text().notNull(),
+    secret: text().notNull(),
+    last: integer({ mode: 'number' }).notNull(),
+  },
+  (table) => [primaryKey({ name: 'log_bulk_pkey', columns: [table.principal, table.secret] })],
+);
+
+export const logFence = sqliteTable(
+  'log_fence',
+  {
+    onlyRow: flag('only_row').primaryKey().default(true),
+    atFloor: integer('at_floor', { mode: 'number' }).notNull(),
+  },
+  (table) => [check('log_fence_only_row_check', sql`${table.onlyRow}`)],
+);
+
+export const logCheckpoints = sqliteTable(
+  'log_checkpoints',
+  {
+    upto: int64('upto').primaryKey(),
+    at: integer({ mode: 'number' }).notNull(),
+    atFloor: integer('at_floor', { mode: 'number' }).notNull(),
+    changesSize: int64('changes_size').notNull(),
+    changesRoot: bytes('changes_root').notNull(),
+    changesNote: text('changes_note').notNull(),
+    usesSize: int64('uses_size').notNull(),
+    usesRoot: bytes('uses_root').notNull(),
+    usesNote: text('uses_note').notNull(),
+  },
+  (table) => [
+    check('log_checkpoints_changes_root_check', sql`octet_length(${table.changesRoot}) = 32`),
+    check('log_checkpoints_uses_root_check', sql`octet_length(${table.usesRoot}) = 32`),
+    index('log_checkpoints_floor_idx').on(table.atFloor, table.upto),
+  ],
+);
+
+export const logTiles = sqliteTable(
+  'log_tiles',
+  {
+    tree: text().notNull(),
+    level: integer().notNull(),
+    leaf: int64('leaf').notNull(),
+    hashes: bytes('hashes').notNull(),
+  },
+  (table) => [
+    primaryKey({ name: 'log_tiles_pkey', columns: [table.tree, table.level, table.leaf] }),
+    check('log_tiles_tree_check', sql`${table.tree} IN ('changes', 'uses')`),
+    check('log_tiles_level_check', sql`${table.level} BETWEEN 0 AND 7`),
+    // 256^8 is past 64 bits: the top level's one tile starts at 0.
+    check('log_tiles_leaf_check', sql`${table.leaf} >= 0 AND ((${table.level} = 7 AND ${table.leaf} = 0) OR (${table.level} < 7 AND ${table.leaf} % (1 << (8 * (${table.level} + 1))) = 0))`),
+    check('log_tiles_hashes_check', sql`octet_length(${table.hashes}) BETWEEN 32 AND 8192 AND octet_length(${table.hashes}) % 32 = 0`),
+  ],
 );