@coffre/db 0.14.5 → 0.15.0

package/src/migrations/postgres/meta/_journal.json

@@ -155,6 +155,188 @@
       "when": 1793035191911,
       "tag": "0021_prune_vault_releases",
       "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "7",
+      "when": 1793068924881,
+      "tag": "0022_log_015",
+      "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "7",
+      "when": 1793090000000,
+      "tag": "0023_change_path",
+      "breakpoints": true
+    },
+    {
+      "idx": 24,
+      "version": "7",
+      "when": 1793094000246,
+      "tag": "0024_use_015",
+      "breakpoints": true
+    },
+    {
+      "idx": 25,
+      "version": "7",
+      "when": 1793100000000,
+      "tag": "0025_app_change",
+      "breakpoints": true
+    },
+    {
+      "idx": 26,
+      "version": "7",
+      "when": 1793110000000,
+      "tag": "0026_issue_lock",
+      "breakpoints": true
+    },
+    {
+      "idx": 27,
+      "version": "7",
+      "when": 1793120000000,
+      "tag": "0027_retention",
+      "breakpoints": true
+    },
+    {
+      "idx": 28,
+      "version": "7",
+      "when": 1793130000000,
+      "tag": "0028_use_stalls",
+      "breakpoints": true
+    },
+    {
+      "idx": 29,
+      "version": "7",
+      "when": 1793140000000,
+      "tag": "0029_use_objects",
+      "breakpoints": true
+    },
+    {
+      "idx": 30,
+      "version": "7",
+      "when": 1793150000000,
+      "tag": "0030_unarchive_restores",
+      "breakpoints": true
+    },
+    {
+      "idx": 31,
+      "version": "7",
+      "when": 1793160000000,
+      "tag": "0031_app_read",
+      "breakpoints": true
+    },
+    {
+      "idx": 32,
+      "version": "7",
+      "when": 1793180483207,
+      "tag": "0032_secrets_live_index",
+      "breakpoints": true
+    },
+    {
+      "idx": 33,
+      "version": "7",
+      "when": 1793190483207,
+      "tag": "0033_use_generations",
+      "breakpoints": true
+    },
+    {
+      "idx": 34,
+      "version": "7",
+      "when": 1793200483207,
+      "tag": "0034_vault_credentials",
+      "breakpoints": true
+    },
+    {
+      "idx": 35,
+      "version": "7",
+      "when": 1793210483207,
+      "tag": "0035_first_days",
+      "breakpoints": true
+    },
+    {
+      "idx": 36,
+      "version": "7",
+      "when": 1793220483207,
+      "tag": "0036_vault_issues",
+      "breakpoints": true
+    },
+    {
+      "idx": 37,
+      "version": "7",
+      "when": 1793230483207,
+      "tag": "0037_vault_bindings",
+      "breakpoints": true
+    },
+    {
+      "idx": 38,
+      "version": "7",
+      "when": 1793247589162,
+      "tag": "0040_binding_origin",
+      "breakpoints": true
+    },
+    {
+      "idx": 39,
+      "version": "7",
+      "when": 1793270313298,
+      "tag": "0041_cutover",
+      "breakpoints": true
+    },
+    {
+      "idx": 40,
+      "version": "7",
+      "when": 1793302884510,
+      "tag": "0042_sign_in_index",
+      "breakpoints": true
+    },
+    {
+      "idx": 41,
+      "version": "7",
+      "when": 1793306932805,
+      "tag": "0043_issue_revoke_index",
+      "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "7",
+      "when": 1793316932805,
+      "tag": "0044_use_by_name",
+      "breakpoints": true
+    },
+    {
+      "idx": 43,
+      "version": "7",
+      "when": 1793326932805,
+      "tag": "0045_decide_first",
+      "breakpoints": true
+    },
+    {
+      "idx": 44,
+      "version": "7",
+      "when": 1793352372315,
+      "tag": "0046_way_in_uses",
+      "breakpoints": true
+    },
+    {
+      "idx": 45,
+      "version": "7",
+      "when": 1793372629862,
+      "tag": "0047_cutover_finish",
+      "breakpoints": true
+    },
+    {
+      "idx": 46,
+      "version": "7",
+      "when": 1793390000000,
+      "tag": "0048_use_batch",
+      "breakpoints": true
+    },
+    {
+      "idx": 47,
+      "version": "7",
+      "when": 1793445614633,
+      "tag": "0049_reads",
+      "breakpoints": true
     }
   ]
 }

package/src/migrations/sqlite/0018_log_015.sql

@@ -0,0 +1,84 @@
+-- 0.15's log (the Postgres migration, 0022_log_015, says what each part is): its tables and the seals, for tests and local development. SQLite has one writer, so the fence is implicit and nothing is partitioned; it has no functions and no logins. It only adds. Each seal's check is on its column: added with the column, it rebuilds no table.
+CREATE TABLE `log_bulk` (
+	`principal` text NOT NULL,
+	`secret` text NOT NULL,
+	`last` integer NOT NULL,
+	PRIMARY KEY(`principal`, `secret`)
+);
+--> statement-breakpoint
+CREATE TABLE `log_changes` (
+	`number` integer PRIMARY KEY NOT NULL,
+	`at` integer NOT NULL,
+	`request_id` text NOT NULL,
+	`object` text NOT NULL,
+	`actor` text NOT NULL,
+	`payload` text NOT NULL,
+	`seal` blob,
+	`mac` blob NOT NULL,
+	CONSTRAINT "log_changes_seal_check" CHECK("log_changes"."seal" IS NULL OR octet_length("log_changes"."seal") = 16),
+	CONSTRAINT "log_changes_mac_check" CHECK(octet_length("log_changes"."mac") = 16)
+);
+--> statement-breakpoint
+CREATE INDEX `log_changes_object_idx` ON `log_changes` (`object`,`number`);--> statement-breakpoint
+CREATE UNIQUE INDEX `log_changes_request_id_key` ON `log_changes` (`request_id`);--> statement-breakpoint
+CREATE TABLE `log_checkpoints` (
+	`upto` integer PRIMARY KEY NOT NULL,
+	`at` integer NOT NULL,
+	`at_floor` integer NOT NULL,
+	`changes_size` integer NOT NULL,
+	`changes_root` blob NOT NULL,
+	`changes_note` text NOT NULL,
+	`uses_size` integer NOT NULL,
+	`uses_root` blob NOT NULL,
+	`uses_note` text NOT NULL,
+	CONSTRAINT "log_checkpoints_changes_root_check" CHECK(octet_length("log_checkpoints"."changes_root") = 32),
+	CONSTRAINT "log_checkpoints_uses_root_check" CHECK(octet_length("log_checkpoints"."uses_root") = 32)
+);
+--> statement-breakpoint
+CREATE TABLE `log_fence` (
+	`only_row` integer PRIMARY KEY DEFAULT true NOT NULL,
+	`at_floor` integer NOT NULL,
+	CONSTRAINT "log_fence_only_row_check" CHECK("log_fence"."only_row")
+);
+--> statement-breakpoint
+CREATE TABLE `log_tiles` (
+	`tree` text NOT NULL,
+	`level` integer NOT NULL,
+	`leaf` integer NOT NULL,
+	`hashes` blob NOT NULL,
+	PRIMARY KEY(`tree`, `level`, `leaf`),
+	CONSTRAINT "log_tiles_tree_check" CHECK("log_tiles"."tree" IN ('changes', 'uses')),
+	CONSTRAINT "log_tiles_level_check" CHECK("log_tiles"."level" BETWEEN 0 AND 7),
+	CONSTRAINT "log_tiles_leaf_check" CHECK("log_tiles"."leaf" >= 0 AND (("log_tiles"."level" = 7 AND "log_tiles"."leaf" = 0) OR ("log_tiles"."level" < 7 AND "log_tiles"."leaf" % (1 << (8 * ("log_tiles"."level" + 1))) = 0))),
+	CONSTRAINT "log_tiles_hashes_check" CHECK(octet_length("log_tiles"."hashes") BETWEEN 32 AND 8192 AND octet_length("log_tiles"."hashes") % 32 = 0)
+);
+--> statement-breakpoint
+CREATE TABLE `log_uses` (
+	`number` integer NOT NULL,
+	`at` integer NOT NULL,
+	`request_id` integer NOT NULL,
+	`credential` text NOT NULL,
+	`secret` text NOT NULL,
+	`purpose` integer NOT NULL,
+	`mac` blob NOT NULL,
+	`place` text,
+	CONSTRAINT "log_uses_mac_check" CHECK(octet_length("log_uses"."mac") = 16)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `log_uses_request_idx` ON `log_uses` (`at`,`request_id`);--> statement-breakpoint
+CREATE TABLE `log_config` (
+	`name` text PRIMARY KEY NOT NULL,
+	`value` text NOT NULL,
+	`seal` blob,
+	CONSTRAINT "log_config_name_check" CHECK("log_config"."name" IN ('policy', 'roles')),
+	CONSTRAINT "log_config_value_check" CHECK(json_valid("log_config"."value")),
+	CONSTRAINT "log_config_seal_check" CHECK("log_config"."seal" IS NULL OR octet_length("log_config"."seal") = 16)
+);
+--> statement-breakpoint
+ALTER TABLE `credentials` ADD COLUMN `seal` blob CONSTRAINT "credentials_seal_check" CHECK("seal" IS NULL OR octet_length("seal") = 16);--> statement-breakpoint
+ALTER TABLE `environments` ADD COLUMN `protected` integer;--> statement-breakpoint
+ALTER TABLE `environments` ADD COLUMN `seal` blob CONSTRAINT "environments_seal_check" CHECK("seal" IS NULL OR octet_length("seal") = 16);--> statement-breakpoint
+ALTER TABLE `secrets` ADD COLUMN `seal` blob CONSTRAINT "secrets_seal_check" CHECK("seal" IS NULL OR octet_length("seal") = 16);--> statement-breakpoint
+ALTER TABLE `service_bindings` ADD COLUMN `seal` blob CONSTRAINT "service_bindings_seal_check" CHECK("seal" IS NULL OR octet_length("seal") = 16);--> statement-breakpoint
+ALTER TABLE `vault_members` ADD COLUMN `seal` blob CONSTRAINT "vault_members_seal_check" CHECK("seal" IS NULL OR octet_length("seal") = 16);--> statement-breakpoint
+INSERT INTO `log_fence` (`only_row`, `at_floor`) VALUES (1, CAST(unixepoch('subsec') * 1000 AS INTEGER) - 3000);

package/src/migrations/sqlite/0019_retention.sql

@@ -0,0 +1,2 @@
+-- 0.15's retention (the Postgres migration, 0027_retention, says what it is): a day's cut, the first checkpoint whose floor of at is past the day's end, by an index. SQLite has no partitions and no functions: retention deletes rows (log-store.ts).
+CREATE INDEX `log_checkpoints_floor_idx` ON `log_checkpoints` (`at_floor`,`upto`);

package/src/migrations/sqlite/0020_ended_references.sql

@@ -0,0 +1 @@
+ALTER TABLE `secret_references` ADD `ended_at` integer;

package/src/migrations/sqlite/0021_secrets_live_index.sql

@@ -0,0 +1 @@
+CREATE INDEX `secrets_live_idx` ON `secrets` (`environment_id`) WHERE `archived_at` IS NULL;

package/src/migrations/sqlite/0022_binding_origin.sql

@@ -0,0 +1 @@
+ALTER TABLE `service_bindings` ADD `origin` text;

package/src/migrations/sqlite/0023_sign_in_index.sql

@@ -0,0 +1,2 @@
+CREATE INDEX `log_changes_sign_in_idx` ON `log_changes` (`at`,`number`) WHERE instr("log_changes"."payload", '"signIn":{') > 0;--> statement-breakpoint
+CREATE INDEX `log_changes_sign_in_actor_idx` ON `log_changes` (`actor`,`at`,`number`) WHERE instr("log_changes"."payload", '"signIn":{') > 0;

package/src/migrations/sqlite/0024_issue_revoke_index.sql

@@ -0,0 +1,2 @@
+CREATE INDEX `log_changes_issue_revoke_idx` ON `log_changes` (`at`,`number`) WHERE ((instr("log_changes"."payload", '{"caller":"') = 1 AND instr("log_changes"."payload", '"issue":{"by":"') > 0) OR (instr("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND instr("log_changes"."payload", '"reason":"revoke"') > 0) OR (instr("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND instr("log_changes"."payload", '"reason":"sign_out"') > 0));--> statement-breakpoint
+CREATE INDEX `log_changes_issue_revoke_actor_idx` ON `log_changes` (`actor`,`at`,`number`) WHERE ((instr("log_changes"."payload", '{"caller":"') = 1 AND instr("log_changes"."payload", '"issue":{"by":"') > 0) OR (instr("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND instr("log_changes"."payload", '"reason":"revoke"') > 0) OR (instr("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND instr("log_changes"."payload", '"reason":"sign_out"') > 0));

package/src/migrations/sqlite/0025_way_in_uses.sql

@@ -0,0 +1,42 @@
+-- MCP connections are sealed objects of 0.15's log (T147; postgres/0046_way_in_uses.sql): their seal. SQLite adds a check by making the table again.
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_mcp_connections` (
+	`id` text PRIMARY KEY NOT NULL,
+	`auth_mac` blob NOT NULL,
+	`principal` text NOT NULL,
+	`generation` integer NOT NULL,
+	`client_id` text NOT NULL,
+	`client_name` text NOT NULL,
+	`client_host` text,
+	`registration` text NOT NULL,
+	`scopes` text NOT NULL,
+	`redirect_uri` text NOT NULL,
+	`code_hash` blob,
+	`code_challenge` text,
+	`code_expires_at` integer,
+	`refresh_hash` blob,
+	`refresh_previous_hash` blob,
+	`expires_at` integer NOT NULL,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`last_used_at` integer,
+	`last_used_ip` text,
+	`revoked_at` integer,
+	`revoked_by` text,
+	`seal` blob,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "mcp_connections_seal_check" CHECK("__new_mcp_connections"."seal" IS NULL OR octet_length("__new_mcp_connections"."seal") = 16),
+	CONSTRAINT "mcp_connections_principal_check" CHECK("__new_mcp_connections"."principal" LIKE 'user:%'),
+	CONSTRAINT "mcp_connections_registration_check" CHECK("__new_mcp_connections"."registration" IN ('cimd', 'dcr')),
+	CONSTRAINT "mcp_connections_auth_mac_check" CHECK(octet_length("__new_mcp_connections"."auth_mac") = 32),
+	CONSTRAINT "mcp_connections_code_hash_check" CHECK("__new_mcp_connections"."code_hash" IS NULL OR octet_length("__new_mcp_connections"."code_hash") = 32),
+	CONSTRAINT "mcp_connections_refresh_hash_check" CHECK("__new_mcp_connections"."refresh_hash" IS NULL OR octet_length("__new_mcp_connections"."refresh_hash") = 32)
+);
+--> statement-breakpoint
+INSERT INTO `__new_mcp_connections`("id", "auth_mac", "principal", "generation", "client_id", "client_name", "client_host", "registration", "scopes", "redirect_uri", "code_hash", "code_challenge", "code_expires_at", "refresh_hash", "refresh_previous_hash", "expires_at", "created_at", "last_used_at", "last_used_ip", "revoked_at", "revoked_by") SELECT "id", "auth_mac", "principal", "generation", "client_id", "client_name", "client_host", "registration", "scopes", "redirect_uri", "code_hash", "code_challenge", "code_expires_at", "refresh_hash", "refresh_previous_hash", "expires_at", "created_at", "last_used_at", "last_used_ip", "revoked_at", "revoked_by" FROM `mcp_connections`;--> statement-breakpoint
+DROP TABLE `mcp_connections`;--> statement-breakpoint
+ALTER TABLE `__new_mcp_connections` RENAME TO `mcp_connections`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE INDEX `mcp_connections_refresh_previous_idx` ON `mcp_connections` (`refresh_previous_hash`);--> statement-breakpoint
+CREATE INDEX `mcp_connections_live_idx` ON `mcp_connections` (`principal`,`expires_at`) WHERE "mcp_connections"."revoked_at" IS NULL;--> statement-breakpoint
+CREATE UNIQUE INDEX `mcp_connections_code_hash_key` ON `mcp_connections` (`code_hash`);--> statement-breakpoint
+CREATE UNIQUE INDEX `mcp_connections_refresh_hash_key` ON `mcp_connections` (`refresh_hash`);

package/src/migrations/sqlite/0026_cutover_finish.sql

@@ -0,0 +1,11 @@
+-- 0.14's writes refused once the cutover is there (the Postgres migration, 0047_cutover_finish, says why): the column every entry a writer under 0.15's log appends carries, and the trigger. SQLite has one writer and no functions: the cutover's change is found by its object's key, `log_object('log', 'cutover')` as the vault computes it (log-entry.ts, CUTOVER_OBJECT).
+ALTER TABLE `audit_log` ADD `log015` integer;
+--> statement-breakpoint
+CREATE TRIGGER `audit_log_refuse_old` BEFORE INSERT ON `audit_log` FOR EACH ROW
+    WHEN NEW.`decision` = 'allow' AND NEW.`log015` IS NULL AND NEW.`action` NOT LIKE 'audit.%' AND NEW.`action` NOT IN (
+        'credential.use', 'token.use', 'secret.read', 'secret.use', 'secret.list', 'secret.history', 'secret.version', 'missing.list', 'personal.list',
+        'roles.list', 'roles.preview', 'mcp.read', 'mcp.view', 'key.check', 'key.intent', 'workload.alert', 'vault.tampered'
+    ) AND EXISTS (SELECT 1 FROM `log_changes` WHERE `object` = '60b3bfb2-d45c-96d7-5c0c-be2d45fc15dc')
+BEGIN
+    SELECT RAISE(ABORT, '0.15''s log is cut over from 0.14: every write of 0.14''s after it is refused (an isolate of the earlier release still serving: ask again)');
+END;

package/src/migrations/sqlite/0027_reads.sql

@@ -0,0 +1,38 @@
+-- The audit pages' reads, a sealed projection of 0.15's uses (T166; postgres 0049_reads). SQLite has one writer and no partitions: the projector writes these directly.
+CREATE TABLE `log_read_days` (
+	`principal` text NOT NULL,
+	`day` integer NOT NULL,
+	PRIMARY KEY(`principal`, `day`)
+);
+--> statement-breakpoint
+CREATE TABLE `log_reads` (
+	`number` integer NOT NULL,
+	`at` integer NOT NULL,
+	`credential` text NOT NULL,
+	`purpose` integer NOT NULL,
+	`principal` text NOT NULL,
+	`secret` text NOT NULL,
+	`environment` text NOT NULL,
+	`project` text NOT NULL,
+	`place` text,
+	`source` text,
+	`source_environment` text,
+	`source_project` text,
+	`version` text,
+	`mac` blob NOT NULL,
+	CONSTRAINT "log_reads_mac_check" CHECK(octet_length("log_reads"."mac") = 16)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `log_reads_number_idx` ON `log_reads` (`at`,`number`);--> statement-breakpoint
+CREATE INDEX `log_reads_principal_idx` ON `log_reads` (`principal`,`at`,`number`);--> statement-breakpoint
+CREATE TABLE `log_reads_cursor` (
+	`only_row` integer PRIMARY KEY DEFAULT true NOT NULL,
+	`through` integer NOT NULL,
+	`pair` integer NOT NULL,
+	`at` integer NOT NULL,
+	`mac` blob,
+	CONSTRAINT "log_reads_cursor_only_row_check" CHECK("log_reads_cursor"."only_row"),
+	CONSTRAINT "log_reads_cursor_mac_check" CHECK("log_reads_cursor"."mac" IS NULL OR octet_length("log_reads_cursor"."mac") = 16)
+);
+--> statement-breakpoint
+INSERT INTO `log_reads_cursor` (`only_row`, `through`, `pair`, `at`) VALUES (1, 0, 0, 0);