@coffre/db 0.3.0 → 0.4.0

package/src/migrations/postgres/0001_remove_syncs.sql

@@ -1,13 +0,0 @@
--- Stop old app instances before upgrading. Never silently discard a configured
--- destination, including archived ones. Keep the audit and sealed legacy rows.
-LOCK TABLE syncs, sync_keys IN ACCESS EXCLUSIVE MODE;
---> statement-breakpoint
-DO $$ BEGIN
-  IF EXISTS (SELECT 1 FROM syncs) OR EXISTS (SELECT 1 FROM sync_keys) THEN
-    RAISE EXCEPTION 'syncs are removed: migrate destinations to service tokens, back up and clear syncs and sync_keys before upgrading';
-  END IF;
-END $$;
---> statement-breakpoint
-DROP TABLE sync_keys;
---> statement-breakpoint
-DROP TABLE syncs;

package/src/migrations/postgres/0002_service_bindings.sql

@@ -1,28 +0,0 @@
-CREATE TABLE "service_bindings" (
-	"id" uuid PRIMARY KEY NOT NULL,
-	"auth_mac" "bytea" NOT NULL,
-	"principal" text NOT NULL,
-	"generation" integer NOT NULL,
-	"profile" text NOT NULL,
-	"issuer" text NOT NULL,
-	"jwks_uri" text NOT NULL,
-	"claims" text NOT NULL,
-	"label" text,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"created_by" text NOT NULL,
-	"last_used_at" timestamp with time zone,
-	"revoked_at" timestamp with time zone,
-	"revoked_by" text,
-	CONSTRAINT "service_bindings_principal_check" CHECK ("service_bindings"."principal" LIKE 'token:%'),
-	CONSTRAINT "service_bindings_auth_mac_check" CHECK (octet_length("service_bindings"."auth_mac") = 32),
-	CONSTRAINT "service_bindings_claims_check" CHECK ("service_bindings"."claims"::jsonb IS NOT NULL)
-);
---> statement-breakpoint
-ALTER TABLE "service_bindings" ADD CONSTRAINT "service_bindings_principal_fkey" FOREIGN KEY ("principal") REFERENCES "public"."vault_members"("principal") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
-CREATE INDEX "service_bindings_principal_idx" ON "service_bindings" USING btree ("principal","issuer");--> statement-breakpoint
-CREATE INDEX "audit_log_unbind_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'bindingId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.unbind' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
--- The app reads and adds bindings, and changes only what the MAC allows to
--- change in place: its label, its last use, and its revocation (with the
--- MAC that covers it). A binding's policy is never updated, nor deleted.
-GRANT SELECT, INSERT ON service_bindings TO coffre_app;--> statement-breakpoint
-GRANT UPDATE (label, last_used_at, revoked_at, revoked_by, auth_mac) ON service_bindings TO coffre_app;

package/src/migrations/postgres/0003_exchanges.sql

@@ -1,10 +0,0 @@
-CREATE TABLE "consumed_tokens" (
-	"hash" "bytea" PRIMARY KEY NOT NULL,
-	"consumed_at" timestamp with time zone DEFAULT now() NOT NULL,
-	CONSTRAINT "consumed_tokens_hash_check" CHECK (octet_length("consumed_tokens"."hash") = 32)
-);
---> statement-breakpoint
-CREATE INDEX "audit_log_exchange_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'credentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.exchange' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
--- The app records each token it exchanges, and reads whether one was; it
--- never changes or deletes a record, so a token stays spent.
-GRANT SELECT, INSERT ON consumed_tokens TO coffre_app;

package/src/migrations/postgres/0004_live_indexes.sql

@@ -1,3 +0,0 @@
-CREATE INDEX "credentials_live_idx" ON "credentials" USING btree ("principal","expires_at") WHERE "credentials"."revoked_at" IS NULL;--> statement-breakpoint
-CREATE INDEX "credentials_issued_by_idx" ON "credentials" USING btree ("principal","created_by","created_at");--> statement-breakpoint
-CREATE INDEX "service_bindings_live_idx" ON "service_bindings" USING btree ("principal","issuer","generation","created_at","id") WHERE "service_bindings"."revoked_at" IS NULL;