@coffre/db 0.14.5 → 0.15.0

package/src/migrations/postgres/0040_binding_origin.sql

@@ -0,0 +1,159 @@
+-- The instance a binding was made on (T149, PR 3b; docs/design/credential-lifecycle.md, section 4b): its public URL when the vault sealed it, the audience its runs' tokens name, which its object's seal covers. Kept in its row, `origin`, so that the app names it as sealed whatever the instance's URL is now: a binding made on another URL is still the vault's to end, with what it issued, and signs nobody in through tokens for this one. Null on a binding made before this column (PR 3a's, unreleased; 0.14's, which the log never held), which the app names on its public URL. It adds a nullable column, which the previous release never reads, and redefines `change_bindings` to write it: only 0.15's vault calls it, and that vault is unreleased, as 0037 redefined 0034's `sign_in`.
+ALTER TABLE "service_bindings" ADD COLUMN "origin" text;
+--> statement-breakpoint
+DROP FUNCTION change_bindings(bigint, text, boolean, text, integer, bigint, integer, bigint, uuid, bytea, bigint, uuid, integer, bigint, uuid[], text[], text, integer, uuid[], uuid[], text[], uuid, bytea, text, text, text, text, text, text, text, text, text, bigint, bytea, uuid[], bytea[], bytea[], bytea[], bytea[], uuid[], uuid[], bytea[], bytea[], bytea[], bytea[], bigint, text, text[], uuid[], text[], bytea[], bytea[]);
+--> statement-breakpoint
+CREATE FUNCTION change_bindings(
+    p_at bigint, p_actor text,
+    p_make boolean, p_principal text, p_generation integer, p_principal_seq bigint, p_actor_generation integer, p_actor_seq bigint,
+    p_via uuid, p_via_seal bytea, p_via_end bigint, p_connection uuid, p_connection_generation integer,
+    p_policy_seq bigint, p_protected uuid[], p_slugs text[], p_app_key text, p_max integer,
+    p_live uuid[], p_read_keys uuid[], p_read_names text[],
+    p_id uuid, p_auth_mac bytea, p_profile text, p_issuer text, p_jwks_uri text, p_jwks text, p_claims text, p_scope text, p_policy text, p_origin text,
+    p_label text, p_created_by text, p_created_at bigint, p_seal bytea,
+    p_ends uuid[], p_end_mac_from bytea[], p_end_seal_from bytea[], p_end_auth_mac bytea[], p_end_seal bytea[],
+    p_creds uuid[], p_cred_binding uuid[], p_cred_mac_from bytea[], p_cred_seal_from bytea[], p_cred_auth_mac bytea[], p_cred_seal bytea[],
+    p_revoked_at bigint, p_revoked_by text,
+    p_change_request text[], p_change_object uuid[], p_change_payload text[], p_change_seal bytea[], p_change_mac bytea[]
+) RETURNS json
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off SET lock_timeout = '1s' AS $$
+DECLARE
+    n bigint;
+    -- A value, not `clock_timestamp()` in a predicate: volatile there, it bounds no index.
+    now_ts timestamptz := clock_timestamp();
+    ended timestamptz := timestamptz 'epoch' + p_revoked_at * interval '1 millisecond';
+BEGIN
+    IF p_make = (p_id IS NULL) OR (NOT p_make AND cardinality(p_ends) = 0) OR cardinality(p_creds) <> cardinality(p_cred_binding)
+       OR p_make = (p_live IS NULL) OR cardinality(p_read_keys) <> cardinality(p_read_names)
+       OR cardinality(p_change_request) <> (CASE WHEN p_make THEN 1 ELSE 0 END) + (SELECT count(*) FROM unnest(p_end_seal) AS s WHERE s IS NOT NULL)
+                                          + (SELECT count(*) FROM unnest(p_cred_seal) AS s WHERE s IS NOT NULL) THEN
+        RAISE EXCEPTION 'a change of bindings makes one, ends some, or both, with a change for each object' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    IF p_make THEN
+        -- IssuerLocked, IssuerCAS, as `issue_token`, by principal: the account's row first (`token:` sorts before `user:`),
+        -- its update lock, so that two binds of it take turns over its count of bindings (a sign-in through one of its
+        -- bindings waits for the statement too); then the maker's, shared. Then both compared.
+        IF p_principal >= p_actor THEN RAISE EXCEPTION 'a binding is a service account''s, made by a person' USING ERRCODE = 'invalid_parameter_value'; END IF;
+        PERFORM 1 FROM public.vault_members m WHERE m.principal = p_principal FOR NO KEY UPDATE;
+        PERFORM 1 FROM public.vault_members m WHERE m.principal = p_actor FOR SHARE;
+        IF NOT EXISTS (SELECT 1 FROM public.vault_members m WHERE m.principal = p_actor AND m.status = 'active' AND m.generation = p_actor_generation AND m.access_seq = p_actor_seq)
+           OR NOT EXISTS (SELECT 1 FROM public.vault_members m WHERE m.principal = p_principal AND m.status = 'active' AND m.generation = p_generation AND m.access_seq = p_principal_seq) THEN
+            RETURN json_build_object('state', 'moved');
+        END IF;
+        IF p_via IS NOT NULL THEN
+            PERFORM 1 FROM public.credentials c WHERE c.id = p_via FOR SHARE;
+            IF NOT EXISTS (SELECT 1 FROM public.credentials c
+                            WHERE c.id = p_via AND c.principal = p_actor AND c.revoked_at IS NULL AND c.seal = p_via_seal
+                              AND floor(extract(epoch FROM least(c.expires_at, coalesce(c.not_after, c.expires_at))) * 1000)::bigint = p_via_end)
+               -- The clock once the locks are had, not when the statement began: one that ended while it waited has ended.
+               OR p_via_end <= (extract(epoch FROM clock_timestamp()) * 1000)::bigint
+               OR p_via_seal IS DISTINCT FROM (SELECT c.seal FROM public.log_changes c WHERE c.object = public.log_object('credential', p_via::text) ORDER BY c.number DESC LIMIT 1) THEN
+                RETURN json_build_object('state', 'ended');
+            END IF;
+        END IF;
+        -- The MCP connection it came through, still connected at the caller's generation (as `credentialStill`): shared,
+        -- so a disconnect waits for this, or is seen (review r3).
+        IF p_connection IS NOT NULL THEN
+            PERFORM 1 FROM public.mcp_connections k WHERE k.id = p_connection AND k.revoked_at IS NULL AND k.generation = p_connection_generation FOR SHARE;
+            IF NOT FOUND THEN RETURN json_build_object('state', 'ended'); END IF;
+        END IF;
+        -- An id the log holds already is no binding to make, even once its row is gone: its object stands (review r3).
+        IF EXISTS (SELECT 1 FROM public.log_changes l WHERE l.object = public.log_object('binding', p_id::text)) THEN
+            RETURN json_build_object('state', 'stale');
+        END IF;
+    END IF;
+    -- The bindings it ends, then the credentials they issued: each row locked, by id, then held to its MAC and seal as
+    -- read. Every live credential they issued must be named, so one that a sign-in made meanwhile is read again (`moved`),
+    -- never left live.
+    PERFORM 1 FROM public.service_bindings b WHERE b.id = ANY(p_ends) ORDER BY b.id FOR UPDATE;
+    IF (SELECT count(*) FROM unnest(p_ends, p_end_mac_from, p_end_seal_from) AS e(id, mac, seal)
+          JOIN public.service_bindings b ON b.id = e.id AND b.principal = p_principal AND b.revoked_at IS NULL AND b.auth_mac = e.mac AND b.seal IS NOT DISTINCT FROM e.seal)
+       <> cardinality(p_ends) THEN
+        RETURN json_build_object('state', 'moved');
+    END IF;
+    -- A credential 0.14 made, or one written around the vault, has no seal: ended with its binding all the same, its row
+    -- revoked with no change, the log holding no object of it.
+    PERFORM 1 FROM public.credentials c WHERE c.id = ANY(p_creds) ORDER BY c.id FOR UPDATE;
+    IF (SELECT count(*) FROM unnest(p_creds, p_cred_binding, p_cred_mac_from, p_cred_seal_from) AS x(id, binding, mac, seal)
+          JOIN public.credentials c ON c.id = x.id AND x.binding = ANY(p_ends) AND c.created_by = 'binding:' || x.binding::text
+                                   AND c.revoked_at IS NULL AND c.auth_mac = x.mac AND c.seal IS NOT DISTINCT FROM x.seal)
+       <> cardinality(p_creds)
+       OR EXISTS (SELECT 1 FROM unnest(p_ends) AS e(id) JOIN public.credentials c
+                    ON c.principal = p_principal AND c.created_by = 'binding:' || e.id::text AND c.revoked_at IS NULL AND c.expires_at > now_ts
+                   WHERE NOT (c.id = ANY(p_creds))) THEN
+        RETURN json_build_object('state', 'moved');
+    END IF;
+    IF p_make THEN
+        -- The account's live bindings as the app read them, which it weighed this one beside (an issuer's keys moved, the
+        -- bindings it replaces): another made or ended since is read again. Under the account's row's lock, which every
+        -- bind takes, so two binds take turns. At most `p_max`, those it ends left out.
+        IF ARRAY(SELECT b.id FROM public.service_bindings b WHERE b.principal = p_principal AND b.generation = p_generation AND b.revoked_at IS NULL ORDER BY b.id)
+           IS DISTINCT FROM ARRAY(SELECT l FROM unnest(p_live) AS l ORDER BY l) THEN
+            RETURN json_build_object('state', 'moved');
+        END IF;
+        IF cardinality(p_live) - (SELECT count(*) FROM unnest(p_live) AS l WHERE l = ANY(p_ends)) >= p_max THEN
+            RETURN json_build_object('state', 'full');
+        END IF;
+    END IF;
+    -- IssuePolicyHeld: the issue lock, shared; then, under it, the policy and the slugs this change was weighed on, and the numbers.
+    PERFORM pg_advisory_xact_lock_shared(1668244070, 1);
+    IF (SELECT a.seq FROM public.audit_log a WHERE a.author = 'vault' AND a.action = 'policy.change' AND a.decision = 'allow' ORDER BY a.seq DESC LIMIT 1)
+            IS DISTINCT FROM p_policy_seq
+        OR EXISTS (
+            SELECT 1 FROM unnest(p_protected, p_slugs) AS p(id, slug)
+             WHERE (SELECT e.slug FROM public.environments e JOIN public.projects q ON q.id = e.project_id
+                     WHERE e.id = p.id AND strpos(e.slug, '~') = 0 AND strpos(q.slug, '~') = 0) IS DISTINCT FROM p.slug
+        ) THEN
+        RETURN json_build_object('state', 'policy');
+    END IF;
+    IF EXISTS (SELECT 1 FROM public.audit_log a WHERE a.author = 'app' AND a.subject_principal = p_app_key AND a.action IN ('key.reseal', 'key.rotate')) THEN
+        RETURN json_build_object('state', 'retired');
+    END IF;
+    -- What it ends is a use's input: the fence exclusive (RevokeTakesFence), after the issue lock (PolicyIssueFirst), for
+    -- the statement's work only. A bind that ends nothing takes none.
+    IF cardinality(p_ends) > 0 THEN PERFORM pg_advisory_xact_lock(1668244070, 0); END IF;
+    -- The keys a binding it makes reads, by the names they were asked by: still those names (a rename meanwhile names
+    -- another). Compared, not locked (a key's writer takes the fence before its row: a share lock here, held into the
+    -- fence, would be a cycle; review r3), and once the fence is had, which a rename takes too: one that committed while
+    -- this waited is seen (review r4). With no fence, one that commits after this is a rename after the bind.
+    IF p_make AND (SELECT count(*) FROM unnest(p_read_keys, p_read_names) AS r(id, name) JOIN public.secrets x ON x.id = r.id AND x.key = r.name) <> cardinality(p_read_keys) THEN
+        RETURN json_build_object('state', 'moved');
+    END IF;
+    -- ChangeChecksSeal: each row it ends is its object's newest change's; one put back is stale. A row with no seal is one
+    -- the log never held, or none at all once a seal it had was cleared around the vault: that one is stale too, so the
+    -- log's binding is never ended with no change of it (review r2).
+    IF EXISTS (SELECT 1 FROM unnest(p_ends, p_end_seal_from) AS e(id, seal)
+                WHERE e.seal IS DISTINCT FROM (SELECT l.seal FROM public.log_changes l WHERE l.object = public.log_object('binding', e.id::text) ORDER BY l.number DESC LIMIT 1))
+       OR EXISTS (SELECT 1 FROM unnest(p_creds, p_cred_seal_from) AS x(id, seal)
+                WHERE x.seal IS DISTINCT FROM (SELECT l.seal FROM public.log_changes l WHERE l.object = public.log_object('credential', x.id::text) ORDER BY l.number DESC LIMIT 1)) THEN
+        RETURN json_build_object('state', 'stale');
+    END IF;
+    IF p_make THEN
+        -- Again, now that no lock is left to wait for: a make of the same id that committed meanwhile, its row deleted since,
+        -- is seen; one not yet committed holds the id's key, which this insert then waits for and fails on (review r4).
+        IF EXISTS (SELECT 1 FROM public.log_changes l WHERE l.object = public.log_object('binding', p_id::text)) THEN
+            RETURN json_build_object('state', 'stale');
+        END IF;
+        INSERT INTO public.service_bindings (id, auth_mac, principal, generation, profile, issuer, jwks_uri, jwks, claims, scope, policy, origin, label, created_by, created_at, seal)
+            VALUES (p_id, p_auth_mac, p_principal, p_generation, p_profile, p_issuer, p_jwks_uri, p_jwks, p_claims, p_scope, p_policy, p_origin, p_label, p_created_by,
+                    timestamptz 'epoch' + p_created_at * interval '1 millisecond', p_seal);
+    END IF;
+    UPDATE public.service_bindings b SET revoked_at = ended, revoked_by = p_revoked_by, auth_mac = e.mac, seal = e.seal
+      FROM unnest(p_ends, p_end_auth_mac, p_end_seal) AS e(id, mac, seal) WHERE b.id = e.id;
+    UPDATE public.credentials c SET revoked_at = ended, revoked_by = p_revoked_by, auth_mac = x.mac, seal = x.seal
+      FROM unnest(p_creds, p_cred_auth_mac, p_cred_seal) AS x(id, mac, seal) WHERE c.id = x.id;
+    -- Each object's change, numbered in the order named: the binding made, those ended, their credentials.
+    FOR i IN 1 .. cardinality(p_change_request) LOOP
+        INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+            VALUES (nextval('public.log_number'), p_at, p_change_request[i], p_change_object[i], p_actor, p_change_payload[i], p_change_seal[i], p_change_mac[i])
+            RETURNING number INTO n;
+    END LOOP;
+    -- Only rows the log never held, ended: no change, nothing to seal.
+    RETURN json_build_object('number', coalesce(n::text, '0'));
+END
+$$;
+
+--> statement-breakpoint
+REVOKE ALL ON FUNCTION change_bindings(bigint, text, boolean, text, integer, bigint, integer, bigint, uuid, bytea, bigint, uuid, integer, bigint, uuid[], text[], text, integer, uuid[], uuid[], text[], uuid, bytea, text, text, text, text, text, text, text, text, text, text, bigint, bytea, uuid[], bytea[], bytea[], bytea[], bytea[], uuid[], uuid[], bytea[], bytea[], bytea[], bytea[], bigint, text, text[], uuid[], text[], bytea[], bytea[]) FROM PUBLIC;
+--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION change_bindings(bigint, text, boolean, text, integer, bigint, integer, bigint, uuid, bytea, bigint, uuid, integer, bigint, uuid[], text[], text, integer, uuid[], uuid[], text[], uuid, bytea, text, text, text, text, text, text, text, text, text, text, bigint, bytea, uuid[], bytea[], bytea[], bytea[], bytea[], uuid[], uuid[], bytea[], bytea[], bytea[], bytea[], bigint, text, text[], uuid[], text[], bytea[], bytea[]) TO coffre_vault;

package/src/migrations/postgres/0041_cutover.sql

@@ -0,0 +1,132 @@
+-- 0.15's cutover from 0.14 (docs/design/0.15-plan.md, PR 9; formal/Migration015.tla): the first 0.15 vault start seals every object 0.14 left as 0.14 accepts it (`genesis`, through `change_input`), and writes the log's first `cutover` change, naming 0.14's last head. These are its writes the vault's login cannot make, and its reads of the rows only the app's login reads, each a definer function that holds itself to what a cutover does: only before the cutover's change, on rows no change of 0.15's holds. Only functions: 0.14's code serves on it as before.
+--> statement-breakpoint
+-- The cutover's change, once: under the fence, exclusive, which the cutover holds from before its marker's check (its locks: every member's row, 0.14's head, the issue lock, the fence; T132). It names 0.14's last head, which must be the chain's head now (`audit_chain_head`): the cutover holds it, and its own 0.14 entry, `log.cutover`, is that head. A retry by its request id finds it; any other cutover is refused.
+CREATE FUNCTION log_cutover(p_request text, p_at bigint, p_actor text, p_payload text, p_mac bytea) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    n bigint;
+BEGIN
+    IF op ->> 'op' IS DISTINCT FROM 'cutover' OR (op #>> '{anchor,seq}') !~ '^[0-9]{1,19}$' OR (op #>> '{anchor,hash}') !~ '^[0-9a-f]{64}$' THEN
+        RAISE EXCEPTION 'not a cutover change: %', p_payload USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    PERFORM pg_advisory_xact_lock(1668244070, 0);
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request AND c.object = public.log_object('log', 'cutover') AND c.payload = p_payload;
+    IF n IS NOT NULL THEN RETURN n; END IF;
+    IF EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = public.log_object('log', 'cutover')) THEN
+        RAISE EXCEPTION 'the log is cut over from 0.14 already' USING ERRCODE = 'unique_violation';
+    END IF;
+    IF NOT EXISTS (
+        SELECT 1 FROM public.audit_chain_head h
+         WHERE h.only_row AND h.next_seq = (op #>> '{anchor,seq}')::bigint + 1 AND h.head_hash = decode(op #>> '{anchor,hash}', 'hex')
+    ) THEN
+        RAISE EXCEPTION 'a cutover names 0.14''s head as it stands' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+        VALUES (nextval('public.log_number'), p_at, p_request, public.log_object('log', 'cutover'), p_actor, p_payload, NULL, p_mac)
+        RETURNING number INTO n;
+    RETURN n;
+END
+$$;
+--> statement-breakpoint
+-- The places 0.14 deleted, made as 0.15 leaves them (the plan's "Places 0.14 deleted", T130), before their objects' genesis: each standing environment of a project whose slug is a tombstone gets `<slug>~deleted` (`deletedWithProject`), and each key under a place deleted that is not archived is archived, its versions erased already. Only before the cutover, and only on rows no change of 0.15's holds; each one named must be such, or nothing is done.
+CREATE FUNCTION cutover_places(p_at bigint, p_environments uuid[], p_secrets uuid[]) RETURNS void
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+DECLARE
+    done integer;
+BEGIN
+    IF p_at IS NULL OR p_at < 0 THEN
+        RAISE EXCEPTION 'the cutover writes at a time, ms since the epoch' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    IF EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = public.log_object('log', 'cutover')) THEN
+        RAISE EXCEPTION 'the log is cut over from 0.14 already' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    UPDATE public.environments e SET slug = e.slug || '~deleted'
+     WHERE e.id = ANY (p_environments) AND strpos(e.slug, '~') = 0 AND e.seal IS NULL
+       AND NOT EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = public.log_object('environment', e.id::text))
+       AND EXISTS (SELECT 1 FROM public.projects p WHERE p.id = e.project_id AND strpos(p.slug, '~') > 0);
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done <> coalesce(cardinality(p_environments), 0) THEN
+        RAISE EXCEPTION 'an environment named is no standing one of a deleted project, 0.14''s alone' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    UPDATE public.secrets x SET archived_at = to_timestamp(p_at / 1000.0)
+     WHERE x.id = ANY (p_secrets) AND x.archived_at IS NULL AND x.seal IS NULL
+       AND NOT EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = public.log_object('secret', x.id::text))
+       AND EXISTS (
+           SELECT 1 FROM public.environments e JOIN public.projects p ON p.id = e.project_id
+            WHERE e.id = x.environment_id AND (strpos(e.slug, '~') > 0 OR strpos(p.slug, '~') > 0)
+       );
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done <> coalesce(cardinality(p_secrets), 0) THEN
+        RAISE EXCEPTION 'a key named is no live one under a deleted place, 0.14''s alone' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+END
+$$;
+--> statement-breakpoint
+-- The credentials and bindings the app vouched for, as the cutover reads them under its locks to hold them to that: their objects' columns, their seals, and whether the log has any change of them. The vault's login reads neither table (0036's `issuing_credential` for one).
+CREATE FUNCTION cutover_credentials(p_ids uuid[]) RETURNS TABLE (
+    id uuid, principal text, kind text, scope text, revoked boolean, expires_at bigint, not_after bigint, generation integer, seal bytea, logged boolean
+)
+    LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+    SELECT c.id, c.principal, c.kind, c.scope, c.revoked_at IS NOT NULL, floor(extract(epoch FROM c.expires_at) * 1000)::bigint,
+           floor(extract(epoch FROM c.not_after) * 1000)::bigint, c.generation, c.seal,
+           EXISTS (SELECT 1 FROM public.log_changes l WHERE l.object = public.log_object('credential', c.id::text))
+      FROM public.credentials c WHERE c.id = ANY (p_ids)
+$$;
+--> statement-breakpoint
+CREATE FUNCTION cutover_bindings(p_ids uuid[]) RETURNS TABLE (
+    id uuid, principal text, generation integer, profile text, issuer text, origin text, jwks_uri text, claims text, scope text, policy text, revoked boolean, seal bytea, logged boolean
+)
+    LANGUAGE sql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+    SELECT b.id, b.principal, b.generation, b.profile, b.issuer, b.origin, b.jwks_uri, b.claims, b.scope, b.policy, b.revoked_at IS NOT NULL, b.seal,
+           EXISTS (SELECT 1 FROM public.log_changes l WHERE l.object = public.log_object('binding', b.id::text))
+      FROM public.service_bindings b WHERE b.id = ANY (p_ids)
+$$;
+--> statement-breakpoint
+-- A binding's genesis (T160): 0.14's row, which the app vouched for and the vault held to that, sealed as it is, from no seal, the object the payload's value, under the fence; and the instance it was made on, `origin` (0040), written with its seal: the deployment's public URL, as the app vouched for it. 0.14 writes no `origin`, and its MAC covers none: a row with one is no row of 0.14's, and is not sealed. Only before the cutover's change; never a binding the log holds (PR 3a's `change_bindings` makes and ends those).
+CREATE FUNCTION seal_binding(p_id uuid, p_request text, p_at bigint, p_actor text, p_payload text, p_seal bytea, p_mac bytea) RETURNS bigint
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET jit = off AS $$
+DECLARE
+    op jsonb := p_payload::jsonb;
+    target uuid := public.log_object('binding', p_id::text);
+    n bigint;
+    done integer;
+BEGIN
+    IF op ->> 'op' IS DISTINCT FROM 'genesis' OR op #>> '{ref,kind}' IS DISTINCT FROM 'binding' OR op #>> '{ref,id}' IS DISTINCT FROM p_id::text
+       OR op #>> '{value,kind}' IS DISTINCT FROM 'binding' OR op #>> '{value,id}' IS DISTINCT FROM p_id::text OR op #>> '{value,origin}' IS NULL OR p_seal IS NULL THEN
+        RAISE EXCEPTION 'not a binding''s genesis: %', p_payload USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    PERFORM 1 FROM public.audit_chain_head WHERE only_row FOR UPDATE;
+    PERFORM pg_advisory_xact_lock(1668244070, 0);
+    SELECT c.number INTO n FROM public.log_changes c WHERE c.request_id = p_request;
+    IF FOUND THEN
+        IF NOT EXISTS (SELECT 1 FROM public.log_changes c WHERE c.request_id = p_request AND c.object = target AND c.payload = p_payload AND c.seal = p_seal) THEN
+            RAISE EXCEPTION 'request % names another change', p_request USING ERRCODE = 'unique_violation';
+        END IF;
+        RETURN n;
+    END IF;
+    IF EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = public.log_object('log', 'cutover')) THEN
+        RAISE EXCEPTION 'the log is cut over from 0.14 already: a binding is the vault''s to make' USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    IF EXISTS (SELECT 1 FROM public.log_changes c WHERE c.object = target) THEN
+        RETURN NULL;
+    END IF;
+    UPDATE public.service_bindings b SET seal = p_seal, origin = op #>> '{value,origin}'
+     WHERE b.id = p_id AND b.seal IS NULL AND b.revoked_at IS NULL AND b.origin IS NULL
+       AND b.principal = op #>> '{value,principal}' AND b.generation = (op #>> '{value,generation}')::integer
+       AND b.profile = op #>> '{value,profile}' AND b.issuer = op #>> '{value,issuer}' AND b.jwks_uri = op #>> '{value,jwksUri}'
+       AND b.claims = op #>> '{value,claims}' AND b.policy IS NOT DISTINCT FROM op #>> '{value,policy}';
+    GET DIAGNOSTICS done = ROW_COUNT;
+    IF done = 0 THEN RETURN NULL; END IF;
+    INSERT INTO public.log_changes (number, at, request_id, object, actor, payload, seal, mac)
+        VALUES (nextval('public.log_number'), p_at, p_request, target, p_actor, p_payload, p_seal, p_mac)
+        RETURNING number INTO n;
+    RETURN n;
+END
+$$;
+--> statement-breakpoint
+REVOKE ALL ON FUNCTION log_cutover(text, bigint, text, text, bytea), cutover_places(bigint, uuid[], uuid[]), cutover_credentials(uuid[]), cutover_bindings(uuid[]),
+    seal_binding(uuid, text, bigint, text, text, bytea, bytea) FROM PUBLIC;
+--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION log_cutover(text, bigint, text, text, bytea), cutover_places(bigint, uuid[], uuid[]), cutover_credentials(uuid[]), cutover_bindings(uuid[]),
+    seal_binding(uuid, text, bigint, text, text, bytea, bytea) TO coffre_vault;

package/src/migrations/postgres/0042_sign_in_index.sql

@@ -0,0 +1,7 @@
+-- The audit pages list the sign-ins through trust bindings (T156): with 0.15's log, a sign-in writes no 0.14 `token.exchange` entry, and its change is the record (D147), so the app reads the changes, as it reads the vault's members and grants. Two indexes over the sign-ins alone, every service's and one's, newest first by when the vault asked (`at`, then the number, which comes after any wait), so that a page reads as many as it shows however many other changes the log holds. Only a sign-in's payload holds a `signIn` object (`SIGNED_IN` in @coffre/server's queries repeats the condition). Additive: the previous release reads nothing here.
+--> statement-breakpoint
+CREATE INDEX "log_changes_sign_in_idx" ON "log_changes" USING btree ("at","number") WHERE strpos("log_changes"."payload", '"signIn":{') > 0;
+--> statement-breakpoint
+CREATE INDEX "log_changes_sign_in_actor_idx" ON "log_changes" USING btree ("actor","at","number") WHERE strpos("log_changes"."payload", '"signIn":{') > 0;
+--> statement-breakpoint
+GRANT SELECT ON log_changes TO coffre_app;

package/src/migrations/postgres/0043_issue_revoke_index.sql

@@ -0,0 +1,4 @@
+-- The audit pages list the vault's token issues, revokes and sign-outs (T164): with 0.15's log, none writes 0.14's `token.create`, `token.revoke` or `sign_out` entry, and its change is the record (D147), which the app reads as it reads the sign-ins (0042). Two indexes over those changes alone, every member's and one's, ordered as the sign-ins' (`at`, then the number), so that a page reads as many as it shows, and a page that hides them counts no more than its stretch holds, however many other changes the log holds. Each is known by how its payload starts, an issue's or a revoke's, and by the record it holds: an `issue` object, or a reason of `revoke` or `sign_out` (`RECORDS` in @coffre/db's change-records.ts, which the reads repeat). Additive: the previous release reads nothing here.
+--> statement-breakpoint
+CREATE INDEX "log_changes_issue_revoke_idx" ON "log_changes" USING btree ("at","number") WHERE ((strpos("log_changes"."payload", '{"caller":"') = 1 AND strpos("log_changes"."payload", '"issue":{"by":"') > 0) OR (strpos("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND strpos("log_changes"."payload", '"reason":"revoke"') > 0) OR (strpos("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND strpos("log_changes"."payload", '"reason":"sign_out"') > 0));--> statement-breakpoint
+CREATE INDEX "log_changes_issue_revoke_actor_idx" ON "log_changes" USING btree ("actor","at","number") WHERE ((strpos("log_changes"."payload", '{"caller":"') = 1 AND strpos("log_changes"."payload", '"issue":{"by":"') > 0) OR (strpos("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND strpos("log_changes"."payload", '"reason":"revoke"') > 0) OR (strpos("log_changes"."payload", '{"op":"credential.revoke",') = 1 AND strpos("log_changes"."payload", '"reason":"sign_out"') > 0));