@coffre/db 0.3.0 → 0.4.0

package/src/migrations/sqlite/meta/_journal.json

@@ -5,36 +5,15 @@
     {
       "idx": 0,
       "version": "6",
-      "when": 1790874462505,
+      "when": 1791237724735,
       "tag": "0000_baseline",
       "breakpoints": true
     },
     {
       "idx": 1,
       "version": "6",
-      "when": 1791062293531,
-      "tag": "0001_remove_syncs",
-      "breakpoints": true
-    },
-    {
-      "idx": 2,
-      "version": "6",
-      "when": 1791069305749,
-      "tag": "0002_service_bindings",
-      "breakpoints": true
-    },
-    {
-      "idx": 3,
-      "version": "6",
-      "when": 1791072337548,
-      "tag": "0003_exchanges",
-      "breakpoints": true
-    },
-    {
-      "idx": 4,
-      "version": "6",
-      "when": 1791084355588,
-      "tag": "0004_live_indexes",
+      "when": 1791242675074,
+      "tag": "0001_mcp_approvals",
       "breakpoints": true
     }
   ]

package/src/schema-version.ts

@@ -1,32 +1,40 @@
+import { count, sql, type SQL } from 'drizzle-orm';
+
 import type { Queryable } from './database.ts';
-import { engineOf, type Engine } from './dialect.ts';
+import { engineOf, migrationLedger, type Engine } from './dialect.ts';
 import postgresJournal from './migrations/postgres/meta/_journal.json' with { type: 'json' };
 import sqliteJournal from './migrations/sqlite/meta/_journal.json' with { type: 'json' };
 
-/**
- * Minimum migration prefix required by this application image, per engine:
- * Advance this only when the runtime needs the new schema. The sync-removal
- * migration only drops unused tables: new code works with either prefix,
- * so Workers Builds can deploy before an owner runs the migration.
- * Applied migrations remain immutable (see baseline.ts).
- */
-export const REQUIRED_MIGRATIONS: Record<Engine, number> = { postgres: 1, sqlite: 1 };
-
-export function requiredMigrations(db: Queryable): number {
-  return REQUIRED_MIGRATIONS[engineOf(db)];
-}
-
 /**
  * Every migration this version ships, oldest first, per engine: read from
  * the journals at build time, so a Worker, which has no files, knows them
- * too. A database that has applied fewer is behind this code, whatever
- * `REQUIRED_MIGRATIONS` lets it run on.
+ * too.
  */
 export const KNOWN_MIGRATIONS: Record<Engine, readonly string[]> = {
   postgres: postgresJournal.entries.map((entry) => entry.tag),
   sqlite: sqliteJournal.entries.map((entry) => entry.tag),
 };
 
-export function knownMigrations(db: Queryable): readonly string[] {
-  return KNOWN_MIGRATIONS[engineOf(db)];
+/**
+ * Whether the database has applied every migration this version ships:
+ * below that, the app serves nothing but its readiness, which says so
+ * (`coffre migrate` runs before each deploy). A database never loses a
+ * migration, so once true it stays true.
+ */
+export async function migrated(db: Queryable): Promise<boolean> {
+  // A database never migrated has no ledger at all, which is no migration, not an error.
+  if (!(await hasLedger(db))) return false;
+  const [ledger] = await db.select({ n: count() }).from(migrationLedger(db));
+  return (ledger?.n ?? 0) >= KNOWN_MIGRATIONS[engineOf(db)].length;
+}
+
+async function hasLedger(db: Queryable): Promise<boolean> {
+  if (engineOf(db) === 'postgres') {
+    const { rows } = await db.execute<{ present: boolean }>(sql`SELECT to_regclass('drizzle.__drizzle_migrations') IS NOT NULL AS present`);
+    return rows[0]?.present === true;
+  }
+  const rows = await (db as unknown as { all<R>(query: SQL): Promise<R[]> }).all<{ present: number }>(
+    sql`SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'`,
+  );
+  return rows.length > 0;
 }

package/src/schema.sqlite.ts

@@ -48,6 +48,17 @@ const flag = (name: string) => integer(name, { mode: 'boolean' });
 const isSlug = (column: AnySQLiteColumn, max: number) =>
   sql`length(${column}) BETWEEN 1 AND ${sql.raw(String(max))} AND ${column} GLOB '[a-z0-9]*' AND ${column} NOT GLOB '*[^a-z0-9-]*'`;
 
+/** A slug, or a tombstone's, `market~deleted-2026-10-05`: schema.ts's `PLACE_SLUG`, in GLOB. */
+const isPlaceSlug = (column: AnySQLiteColumn) => {
+  const base = sql`substr(${column}, 1, instr(${column}, '~') - 1)`;
+  const suffix = sql`substr(${column}, instr(${column}, '~') + 1)`;
+  return sql`(${isSlug(column, 63)}) OR (instr(${column}, '~') BETWEEN 2 AND 64 AND ${base} GLOB '[a-z0-9]*' AND ${base} NOT GLOB '*[^a-z0-9-]*' AND length(${suffix}) BETWEEN 1 AND 40 AND ${suffix} NOT GLOB '*[^a-z0-9-]*')`;
+};
+
+/** A folder's name; the app also refuses control characters, which GLOB has no class for. */
+const folderCheck = (name: string, column: AnySQLiteColumn) =>
+  check(name, sql`${column} IS NULL OR (length(${column}) BETWEEN 1 AND 64 AND ${column} NOT GLOB '*/*' AND ${column} = trim(${column}))`);
+
 export const projects = sqliteTable(
   'projects',
   {
@@ -56,10 +67,12 @@ export const projects = sqliteTable(
     name: text().notNull(),
     createdAt: createdAt(),
     archivedAt: time('archived_at'),
+    folder: text(),
   },
   (table) => [
     unique('projects_slug_key').on(table.slug),
-    check('projects_slug_check', isSlug(table.slug, 63)),
+    check('projects_slug_check', isPlaceSlug(table.slug)),
+    folderCheck('projects_folder_check', table.folder),
   ],
 );
 
@@ -76,7 +89,7 @@ export const environments = sqliteTable(
   (table) => [
     unique('environments_project_id_slug_key').on(table.projectId, table.slug),
     unique('environments_project_scoped').on(table.id, table.projectId),
-    check('environments_slug_check', isSlug(table.slug, 63)),
+    check('environments_slug_check', isPlaceSlug(table.slug)),
     foreignKey({
       name: 'environments_project_id_fkey',
       columns: [table.projectId],
@@ -99,6 +112,7 @@ export const secrets = sqliteTable(
     }),
     currentVersion: integer('current_version').notNull().default(0),
     archivedAt: time('archived_at'),
+    folder: text(),
   },
   (table) => [
     unique('secrets_project_id_environment_id_key_key').on(table.projectId, table.environmentId, table.key),
@@ -106,6 +120,7 @@ export const secrets = sqliteTable(
       'secrets_key_check',
       sql`length(${table.key}) BETWEEN 1 AND 128 AND ${table.key} GLOB '[A-Za-z_]*' AND ${table.key} NOT GLOB '*[^A-Za-z0-9_]*'`,
     ),
+    folderCheck('secrets_folder_check', table.folder),
     foreignKey({
       name: 'secrets_project_id_fkey',
       columns: [table.projectId],
@@ -156,6 +171,30 @@ export const secretVersions = sqliteTable(
   ],
 );
 
+export const dismissedKeys = sqliteTable(
+  'dismissed_keys',
+  {
+    environmentId: text('environment_id').notNull(),
+    key: text().notNull(),
+    dismissedAt: time('dismissed_at').notNull().default(now),
+    dismissedBy: text('dismissed_by').notNull(),
+    restoredAt: time('restored_at'),
+    restoredBy: text('restored_by'),
+  },
+  (table) => [
+    primaryKey({ name: 'dismissed_keys_pkey', columns: [table.environmentId, table.key] }),
+    check(
+      'dismissed_keys_key_check',
+      sql`length(${table.key}) BETWEEN 1 AND 128 AND ${table.key} GLOB '[A-Za-z_]*' AND ${table.key} NOT GLOB '*[^A-Za-z0-9_]*'`,
+    ),
+    foreignKey({
+      name: 'dismissed_keys_environment_id_fkey',
+      columns: [table.environmentId],
+      foreignColumns: [environments.id],
+    }).onDelete('restrict'),
+  ],
+);
+
 const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
 const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
 
@@ -175,10 +214,10 @@ export const vaultMembers = sqliteTable(
   },
   (table) => [
     check('vault_members_mac_check', sql`octet_length(${table.mac}) = 32`),
-    // `^(user|token|sync):[^[:space:]:][^[:space:]]*$`, without regular expressions.
+    // `^(user|token):[^[:space:]:][^[:space:]]*$`, without regular expressions.
     check(
       'vault_members_principal_check',
-      sql`(${table.principal} GLOB 'user:?*' OR ${table.principal} GLOB 'token:?*' OR ${table.principal} GLOB 'sync:?*')
+      sql`(${table.principal} GLOB 'user:?*' OR ${table.principal} GLOB 'token:?*')
         AND substr(${table.principal}, instr(${table.principal}, ':') + 1, 1) <> ':'
         AND instr(${table.principal}, ' ') = 0 AND instr(${table.principal}, char(9)) = 0
         AND instr(${table.principal}, char(10)) = 0 AND instr(${table.principal}, char(13)) = 0`,
@@ -196,17 +235,29 @@ export const vaultGrants = sqliteTable(
     principal: text().notNull(),
     projectId: text('project_id'),
     environmentId: text('environment_id'),
+    environmentSlug: text('environment_slug'),
     role: text().notNull(),
     expiresAt: integer('expires_at', { mode: 'number' }),
     grantedAt: integer('granted_at', { mode: 'number' }).notNull(),
     grantedBy: text('granted_by').notNull(),
   },
   (table) => [
-    check('vault_grants_one_place', sql`(${table.projectId} IS NULL) <> (${table.environmentId} IS NULL)`),
+    check(
+      'vault_grants_one_place',
+      sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`,
+    ),
+    check('vault_grants_environment_slug_check', sql`${table.environmentSlug} IS NULL OR (${isSlug(table.environmentSlug, 63)})`),
     check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
-    check('vault_grants_environment_role_check', sql`${table.environmentId} IS NULL OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+    check(
+      'vault_grants_environment_role_check',
+      sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`,
+    ),
     unique('vault_grants_on_project').on(table.principal, table.projectId),
     unique('vault_grants_on_environment').on(table.principal, table.environmentId),
+    unique('vault_grants_on_environment_slug').on(table.principal, table.environmentSlug),
+    uniqueIndex('vault_grants_on_every_project')
+      .on(table.principal)
+      .where(sql`${table.projectId} IS NULL AND ${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL`),
     foreignKey({
       name: 'vault_grants_principal_fkey',
       columns: [table.principal],
@@ -236,7 +287,7 @@ export const auditLog = sqliteTable(
     // Milliseconds since the epoch, from the database's clock, read after the
     // append took the head's lock.
     occurredAt: integer('occurred_at', { mode: 'number' }).notNull(),
-    // Who acted: `user:<email>`, `token:<id>`, `sync:<id>` or `system:<name>`.
+    // Who acted: `user:<email>`, `token:<id>` or `system:<name>`.
     actor: text().notNull(),
     action: text().notNull(),
     decision: text().notNull(),
@@ -262,7 +313,7 @@ export const auditLog = sqliteTable(
     check('audit_log_author_check', sql`${table.author} IN ('app', 'vault')`),
     check(
       'audit_log_actor_check',
-      sql`${table.actor} GLOB 'user:?*' OR ${table.actor} GLOB 'token:?*' OR ${table.actor} GLOB 'sync:?*' OR ${table.actor} GLOB 'system:?*'`,
+      sql`${table.actor} GLOB 'user:?*' OR ${table.actor} GLOB 'token:?*' OR ${table.actor} GLOB 'system:?*'`,
     ),
     check('audit_log_decision_check', sql`${table.decision} IN ('allow', 'deny')`),
     check('audit_log_metadata_check', sql`json_valid(${table.metadata})`),
@@ -311,6 +362,57 @@ export const auditLog = sqliteTable(
     index('audit_log_exchange_idx')
       .on(sql`json_extract(${table.metadata}, '$.credentialId')`)
       .where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
+    index('audit_log_reference_end_idx')
+      .on(table.relatedSeq)
+      .where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
+    index('audit_log_also_project_idx')
+      .on(sql`json_extract(${table.metadata}, '$.also.projectId')`, table.seq)
+      .where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`),
+    index('audit_log_also_environment_idx')
+      .on(sql`json_extract(${table.metadata}, '$.also.environmentId')`, table.seq)
+      .where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`),
+    index('audit_log_also_secret_idx')
+      .on(sql`json_extract(${table.metadata}, '$.also.secretId')`, table.seq)
+      .where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`),
+  ],
+);
+
+export const secretReferences = sqliteTable(
+  'secret_references',
+  {
+    id: text().primaryKey(),
+    projectId: text('project_id').notNull(),
+    environmentId: text('environment_id').notNull(),
+    secretId: text('secret_id').notNull(),
+    sourceProjectId: text('source_project_id').notNull(),
+    sourceEnvironmentId: text('source_environment_id').notNull(),
+    sourceSecretId: text('source_secret_id').notNull(),
+    createdSeq: int64('created_seq').notNull(),
+    createdAt: createdAt(),
+    createdBy: text('created_by').notNull(),
+  },
+  (table) => [
+    unique('secret_references_created_seq_key').on(table.createdSeq),
+    foreignKey({
+      name: 'secret_references_secret_id_fkey',
+      columns: [table.secretId],
+      foreignColumns: [secrets.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'secret_references_source_secret_id_fkey',
+      columns: [table.sourceSecretId],
+      foreignColumns: [secrets.id],
+    }).onDelete('restrict'),
+    foreignKey({
+      name: 'secret_references_created_seq_fkey',
+      columns: [table.createdSeq],
+      foreignColumns: [auditLog.seq],
+    }).onDelete('restrict'),
+    index('secret_references_holder_idx').on(table.secretId, table.createdSeq),
+    index('secret_references_source_idx').on(table.sourceSecretId),
+    index('secret_references_project_idx').on(table.projectId),
+    index('secret_references_source_project_idx').on(table.sourceProjectId),
+    index('secret_references_created_by_idx').on(table.createdBy),
   ],
 );
 
@@ -410,6 +512,119 @@ export const consumedTokens = sqliteTable(
   (table) => [check('consumed_tokens_hash_check', sql`octet_length(${table.hash}) = 32`)],
 );
 
+/**
+ * MCP clients that registered themselves (RFC 7591), the fallback to Client
+ * ID Metadata Documents, which need no row. The ID is the client's
+ * `client_id`. Its redirects are under its MAC: a database writer cannot add
+ * one of their own to a client people have approved.
+ */
+export const oauthClients = sqliteTable(
+  'oauth_clients',
+  {
+    id: text().primaryKey(),
+    authMac: bytes('auth_mac').notNull(),
+    // Its own claim, shown as unverified.
+    name: text().notNull(),
+    // JSON: a list of HTTPS or loopback URLs.
+    redirectUris: text('redirect_uris').notNull(),
+    createdAt: createdAt(),
+    createdIp: text('created_ip'),
+    revokedAt: time('revoked_at'),
+  },
+  (table) => [
+    check('oauth_clients_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
+    check('oauth_clients_redirect_uris_check', sql`json_valid(${table.redirectUris})`),
+  ],
+);
+
+/**
+ * One MCP client a person connected: one approved authorization, its
+ * scopes, its code until the client redeems it, and the refresh token it
+ * holds since. Access tokens have no row: each names its connection under a
+ * MAC, and every request checks this row. Revoking it ends them all.
+ */
+export const mcpConnections = sqliteTable(
+  'mcp_connections',
+  {
+    id: text().primaryKey(),
+    authMac: bytes('auth_mac').notNull(),
+    // The person it acts as, `user:<email>`, under the generation they approved it in.
+    principal: text().notNull(),
+    generation: integer().notNull(),
+    // A metadata document's URL, or a registration's ID.
+    clientId: text('client_id').notNull(),
+    // As the consent page showed them: display only.
+    clientName: text('client_name').notNull(),
+    clientHost: text('client_host'),
+    registration: text().notNull(),
+    // Space-separated, in catalogue order: `browse write`.
+    scopes: text().notNull(),
+    redirectUri: text('redirect_uri').notNull(),
+    // Until the client redeems it: its SHA-256, its PKCE challenge, and 60 seconds.
+    codeHash: bytes('code_hash'),
+    codeChallenge: text('code_challenge'),
+    codeExpiresAt: time('code_expires_at'),
+    // From then on: the refresh token's SHA-256, and the one it replaced, whose reuse ends the connection.
+    refreshHash: bytes('refresh_hash'),
+    refreshPreviousHash: bytes('refresh_previous_hash'),
+    expiresAt: time('expires_at').notNull(),
+    createdAt: createdAt(),
+    lastUsedAt: time('last_used_at'),
+    lastUsedIp: text('last_used_ip'),
+    revokedAt: time('revoked_at'),
+    revokedBy: text('revoked_by'),
+  },
+  (table) => [
+    check('mcp_connections_principal_check', sql`${table.principal} LIKE 'user:%'`),
+    check('mcp_connections_registration_check', sql`${table.registration} IN ('cimd', 'dcr')`),
+    check('mcp_connections_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
+    check('mcp_connections_code_hash_check', sql`${table.codeHash} IS NULL OR octet_length(${table.codeHash}) = 32`),
+    check('mcp_connections_refresh_hash_check', sql`${table.refreshHash} IS NULL OR octet_length(${table.refreshHash}) = 32`),
+    foreignKey({
+      name: 'mcp_connections_principal_fkey',
+      columns: [table.principal],
+      foreignColumns: [vaultMembers.principal],
+    }).onDelete('restrict'),
+    unique('mcp_connections_code_hash_key').on(table.codeHash),
+    unique('mcp_connections_refresh_hash_key').on(table.refreshHash),
+    index('mcp_connections_refresh_previous_idx').on(table.refreshPreviousHash),
+    // A person's live connections: Connected apps, and the limit on how many.
+    index('mcp_connections_live_idx').on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
+  ],
+);
+
+/**
+ * A change an MCP client asked for, waiting for its person on coffre's own
+ * page: see schema.ts.
+ */
+export const mcpApprovals = sqliteTable(
+  'mcp_approvals',
+  {
+    id: text().primaryKey(),
+    connectionId: text('connection_id').notNull(),
+    tool: text().notNull(),
+    arguments: text().notNull(),
+    digest: bytes('digest').notNull(),
+    status: text().notNull().default('pending'),
+    outcome: text(),
+    createdAt: createdAt(),
+    expiresAt: time('expires_at').notNull(),
+    decidedAt: time('decided_at'),
+    reportedAt: time('reported_at'),
+  },
+  (table) => [
+    check('mcp_approvals_status_check', sql`${table.status} IN ('pending', 'approved', 'denied', 'cancelled', 'failed')`),
+    check('mcp_approvals_digest_check', sql`octet_length(${table.digest}) = 32`),
+    check('mcp_approvals_arguments_check', sql`json_valid(${table.arguments})`),
+    foreignKey({
+      name: 'mcp_approvals_connection_fkey',
+      columns: [table.connectionId],
+      foreignColumns: [mcpConnections.id],
+    }).onDelete('restrict'),
+    index('mcp_approvals_open_idx').on(table.connectionId, table.digest).where(sql`${table.reportedAt} IS NULL`),
+  ],
+);
+
 export const credentials = sqliteTable(
   'credentials',
   {