@coffre/db 0.4.5 → 0.5.0

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-edkMkG02.js";
+import { t as Database } from "./database-C63WjCrC.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-edkMkG02.d.ts → database-C63WjCrC.d.ts}

@@ -1,4 +1,4 @@
-import { m as schema_d_exports } from "./schema-BqCB3XFm.js";
+import { m as schema_d_exports } from "./schema-a7PkFgea.js";
 import { Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-edkMkG02.js";
+import { i as Queryable } from "./database-C63WjCrC.js";
 import { SQL, SQLWrapper } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts
@@ -74,6 +74,12 @@ export declare function clock(db: Queryable): SQL<string>;
  * before one written while it waited. Read it in a statement after the lock.
  */
 export declare function clockMillis(db: Queryable): SQL<number>;
+/**
+ * Whether a timestamp column is still ahead of the database clock as the
+ * statement runs: a condition, for a write that must not land once the
+ * time it names has passed.
+ */
+export declare function ahead(db: Queryable, column: SQLWrapper): SQL;
 /**
  * The migrator's own ledger, read by readiness to tell a database that is
  * up but not yet migrated from one that is ready. Drizzle keeps it in a

package/dist/dialect.js

@@ -124,6 +124,17 @@ function clockMillis(db) {
 	}
 }
 /**
+* Whether a timestamp column is still ahead of the database clock as the
+* statement runs: a condition, for a write that must not land once the
+* time it names has passed.
+*/
+function ahead(db, column) {
+	switch (engineOf(db)) {
+		case "postgres": return sql`${column} > clock_timestamp()`;
+		case "sqlite": return sql`${column} > CAST(unixepoch('subsec') * 1000 AS INTEGER)`;
+	}
+}
+/**
 * The migrator's own ledger, read by readiness to tell a database that is
 * up but not yet migrated from one that is ready. Drizzle keeps it in a
 * `drizzle` schema on Postgres, and in a plain table elsewhere.
@@ -158,4 +169,4 @@ function canonicalTimestamp(raw) {
 	return `${(/* @__PURE__ */ new Date(Date.UTC(+year, +month - 1, +day, +hour, +minute, +second) - offsetMinutes * 6e4)).toISOString().slice(0, 19)}.${fraction.padEnd(6, "0")}Z`;
 }
 //#endregion
-export { SNAPSHOT, canonicalTimestamp, changedRows, clock, clockMillis, engineOf, forUpdate, insertIfAbsent, isUniqueViolation, isUnreachable, migrationLedger, tombstone, truth, upsert };
+export { SNAPSHOT, ahead, canonicalTimestamp, changedRows, clock, clockMillis, engineOf, forUpdate, insertIfAbsent, isUniqueViolation, isUnreachable, migrationLedger, tombstone, truth, upsert };

package/dist/grants.d.ts

@@ -1,11 +1,15 @@
-import { i as Queryable } from "./database-edkMkG02.js";
+import { i as Queryable } from "./database-C63WjCrC.js";
+import { Authenticity, Newest } from "./log.js";
+import { Conversion, InstanceRole, Scope } from "@coffre/core/access";
+import { StoredEntry } from "@coffre/core/audit";
 //#region src/grants.d.ts
 /**
  * One grant, as `vault_grants` holds it: on a project (`environmentId`
- * null), one of its environments (`projectId` is the environment's
- * project), every project (both ids null), or one environment slug in every
- * project (`environmentSlug`). Only the vault writes grants; the app reads
- * them for its lists.
+ * null), or one of its environments (`projectId` is the environment's
+ * project). A grant on every project of 0.4 names neither, and
+ * `environmentSlug` the one environment slug it covers in each, until the
+ * vault replaces it. Only the vault writes grants; the app reads them for
+ * its lists.
  */
 export type GrantRow = {
   principal: string;
@@ -18,15 +22,106 @@ export type GrantRow = {
   grantedAt: number;
   grantedBy: string;
 };
-/**
- * Grants, lapsed ones too unless `liveAt` says when to judge them: one
- * member's, or everyone's; `everyProject`, only those on every project.
- */
+/** Grants, lapsed ones too unless `liveAt` says when to judge them: one member's, or everyone's. */
 export declare function readGrants(db: Queryable, filter?: {
   principal?: string;
   liveAt?: number;
-  everyProject?: boolean;
 }): Promise<GrantRow[]>;
 /** Add a grant; an environment's row names only the environment. */
 export declare function insertGrant(db: Queryable, grant: GrantRow): Promise<void>;
+/** A member's instance role and its scope, as `vault_members` stores them. */
+export type StoredRole = {
+  owner: boolean;
+  role: string | null;
+  scope: string | null;
+};
+/**
+ * A member's instance role and its scope, as their row says: a row no vault
+ * of 0.5 wrote has no role, and its `owner` says whether they are an Admin.
+ * A role or a scope the vault would never have written reads as holding
+ * nothing (the vault then refuses the row by its MAC); a member's scope is
+ * everywhere, since a member's role reaches nothing.
+ */
+export declare function storedRole({ owner, role, scope }: StoredRole): {
+  role: InstanceRole;
+  scope: Scope;
+};
+/** The columns that store a member's instance role and scope: `owner` too, for a vault of 0.4 to read. */
+export declare function roleColumns(role: InstanceRole, scope: Scope): StoredRole;
+/** What the vault does, when this version first runs, to one member's grants on every project of 0.4. */
+export type EveryProjectPreview = {
+  principal: string;
+  /** Each, as a path (`*`, or `*` and the slug it covers), its role and its end. */
+  before: {
+    place: string;
+    role: string;
+    expiresAt: number | null;
+  }[];
+  conversion: Conversion;
+  /** The places the conversion names, by id: `market`, `market/dev`. */
+  paths: Record<string, string>;
+  /**
+   * Whether the vault has reported their row changed around it since the
+   * last change to what they hold (`tamperedMembers`), by the entries in its
+   * name: then it leaves them as they are, unless the report is forged.
+   */
+  reported: boolean;
+};
+/**
+ * What the vault will make of the grants on every project of 0.4 that live
+ * members hold, by the rule it converts them with
+ * (`convertEveryProjectGrants`), from the rows as they are: what
+ * `coffre migrate` says before the vault does it. A display: the vault
+ * reads again, under its locks, when it converts, and checks what this
+ * cannot, holding no key: each row's MAC, and each entry's in its name. So
+ * a member it has reported changed around it is listed, and marked
+ * `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
+ * they read: whether that report is the vault's own, or forged so as to
+ * hide what it will do, only the vault can tell. Any member the vault
+ * converts is listed. A root admin's it leaves while they are one, until
+ * they are not; which they are, the vault's configuration says and the
+ * database does not, so they are listed too.
+ */
+export declare function everyProjectPreview(db: Queryable, at: number): Promise<EveryProjectPreview[]>;
+/** A service token or trust binding of 0.4, which carries no scope of its own yet. */
+export type Unsealed = {
+  kind: 'token' | 'binding';
+  id: string;
+  principal: string;
+};
+/**
+ * The live service tokens and trust bindings of active service accounts
+ * that carry no scope yet, as 0.4 made them: what the app seals with each
+ * account's grants once a process (`sealScopes`), and what `coffre migrate`
+ * says it will. A credential a binding issued carries its binding's.
+ */
+export declare function unsealedCredentials(db: Queryable, at: Date): Promise<Unsealed[]>;
+/**
+ * The members the vault has found changed around it, and not started over
+ * since, as a reader without its key can tell: `reportStands`' rule, taking
+ * every entry in the vault's name as its own, for everyone at once, where
+ * the app lists members and `coffre migrate` marks them. Their newest
+ * `vault.tampered`, for their row (`mac`) or an older one put back
+ * (`stale`), is newer than the newest entry changing what they hold. Both
+ * reads go by the log's (author, action, seq) and (author, subject, seq)
+ * indexes, and findings are few.
+ */
+export declare function tamperedMembers(db: Queryable, principal?: string): Promise<Set<string>>;
+/**
+ * Whether the vault's report that `principal`'s row was changed around it
+ * stands: one of its own is newer than its newest entry changing what they
+ * hold, and only starting them over, or another change, settles it. While
+ * one stands the vault leaves their grants on every project of 0.4 as they
+ * are. Both entries as `check`, the vault's MACs, tells them apart,
+ * passing over those forged in its name; a reader without its key takes
+ * them all as the vault's (`tamperedMembers`). Only reports after that
+ * entry are read, so older ones, forged or not, never hide one. From
+ * LOOK_BACK forged entries on, of either kind, one may stand, so it is
+ * taken to.
+ */
+export declare function reportStands(db: Queryable, principal: string, check: Authenticity): Promise<boolean>;
+/** The newest access entry about `principal` that `check` finds the vault's own. */
+export declare function newestAccess(db: Queryable, principal: string, check: Authenticity): Promise<Newest>;
+/** Up to `limit` of the vault's allowed access entries about `principal` before `before` (the newest when undefined), newest first. */
+export declare function accessEntriesAbout(db: Queryable, principal: string, limit: number, before?: bigint): Promise<StoredEntry[]>;
 //#endregion

package/dist/grants.js

@@ -1,16 +1,17 @@
 import { tablesOf } from "./index.js";
-import { and, eq, gt, isNull, or } from "drizzle-orm";
+import { LOOK_BACK, entryColumns, newestAuthentic } from "./log.js";
+import { and, desc, eq, gt, inArray, isNull, lt, or, sql } from "drizzle-orm";
+import { EVERYWHERE, administers, convertEveryProjectGrants, isInstanceRole, isScope, normalScope, unscoped } from "@coffre/core/access";
+import { isTombstone } from "@coffre/core/schemas";
+import { ACCESS_ACTIONS } from "@coffre/core/vault";
 //#region src/grants.ts
-/**
-* Grants, lapsed ones too unless `liveAt` says when to judge them: one
-* member's, or everyone's; `everyProject`, only those on every project.
-*/
+/** Grants, lapsed ones too unless `liveAt` says when to judge them: one member's, or everyone's. */
 async function readGrants(db, filter = {}) {
 	const { vaultGrants, environments } = tablesOf(db);
 	return (await db.select({
 		grant: vaultGrants,
 		environmentProjectId: environments.projectId
-	}).from(vaultGrants).leftJoin(environments, eq(environments.id, vaultGrants.environmentId)).where(and(filter.principal === void 0 ? void 0 : eq(vaultGrants.principal, filter.principal), filter.liveAt === void 0 ? void 0 : or(isNull(vaultGrants.expiresAt), gt(vaultGrants.expiresAt, filter.liveAt)), filter.everyProject === true ? and(isNull(vaultGrants.projectId), isNull(vaultGrants.environmentId)) : void 0))).map(({ grant, environmentProjectId }) => ({
+	}).from(vaultGrants).leftJoin(environments, eq(environments.id, vaultGrants.environmentId)).where(and(filter.principal === void 0 ? void 0 : eq(vaultGrants.principal, filter.principal), filter.liveAt === void 0 ? void 0 : or(isNull(vaultGrants.expiresAt), gt(vaultGrants.expiresAt, filter.liveAt))))).map(({ grant, environmentProjectId }) => ({
 		...grant,
 		projectId: grant.projectId ?? environmentProjectId
 	}));
@@ -23,5 +24,204 @@ async function insertGrant(db, grant) {
 		projectId: grant.environmentId === null ? grant.projectId : null
 	});
 }
+/**
+* A member's instance role and its scope, as their row says: a row no vault
+* of 0.5 wrote has no role, and its `owner` says whether they are an Admin.
+* A role or a scope the vault would never have written reads as holding
+* nothing (the vault then refuses the row by its MAC); a member's scope is
+* everywhere, since a member's role reaches nothing.
+*/
+function storedRole({ owner, role, scope }) {
+	const named = role === null ? owner ? "admin" : "member" : isInstanceRole(role) ? role : "member";
+	if (named === "member" || scope === null) return {
+		role: named,
+		scope: EVERYWHERE
+	};
+	let parsed = null;
+	try {
+		parsed = JSON.parse(scope);
+	} catch {}
+	return {
+		role: named,
+		scope: isScope(parsed) ? normalScope(parsed) : NOWHERE
+	};
+}
+/** A scope that takes in nothing: what a stored scope nobody can read means. */
+const NOWHERE = {
+	projects: { only: [] },
+	environments: { only: [] }
+};
+/** The columns that store a member's instance role and scope: `owner` too, for a vault of 0.4 to read. */
+function roleColumns(role, scope) {
+	const normal = normalScope(scope);
+	return {
+		owner: administers(role),
+		role,
+		scope: role === "member" || unscoped(normal) ? null : JSON.stringify(normal)
+	};
+}
+/**
+* What the vault will make of the grants on every project of 0.4 that live
+* members hold, by the rule it converts them with
+* (`convertEveryProjectGrants`), from the rows as they are: what
+* `coffre migrate` says before the vault does it. A display: the vault
+* reads again, under its locks, when it converts, and checks what this
+* cannot, holding no key: each row's MAC, and each entry's in its name. So
+* a member it has reported changed around it is listed, and marked
+* `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
+* they read: whether that report is the vault's own, or forged so as to
+* hide what it will do, only the vault can tell. Any member the vault
+* converts is listed. A root admin's it leaves while they are one, until
+* they are not; which they are, the vault's configuration says and the
+* database does not, so they are listed too.
+*/
+async function everyProjectPreview(db, at) {
+	const { vaultMembers, projects, environments } = tablesOf(db);
+	const held = (await readGrants(db, { liveAt: at })).filter((grant) => grant.projectId === null && grant.environmentId === null);
+	if (held.length === 0) return [];
+	const holders = [...new Set(held.map((grant) => grant.principal))].sort();
+	const [members, grants, places, inside, tampered] = await Promise.all([
+		db.select({
+			principal: vaultMembers.principal,
+			status: vaultMembers.status,
+			owner: vaultMembers.owner,
+			role: vaultMembers.role,
+			scope: vaultMembers.scope
+		}).from(vaultMembers),
+		readGrants(db, { liveAt: at }),
+		db.select({
+			id: projects.id,
+			slug: projects.slug
+		}).from(projects),
+		db.select({
+			id: environments.id,
+			projectId: environments.projectId,
+			slug: environments.slug
+		}).from(environments),
+		tamperedMembers(db)
+	]);
+	const live = places.filter((project) => !isTombstone(project.slug)).map((project) => ({
+		id: project.id,
+		environments: inside.filter((environment) => environment.projectId === project.id && !isTombstone(environment.slug)).map(({ id, slug }) => ({
+			id,
+			slug
+		}))
+	}));
+	const paths = Object.fromEntries(places.flatMap((project) => [[project.id, project.slug], ...inside.filter((environment) => environment.projectId === project.id).map((environment) => [environment.id, `${project.slug}/${environment.slug}`])]));
+	return holders.flatMap((principal) => {
+		const member = members.find((row) => row.principal === principal);
+		if (member?.status !== "active") return [];
+		const theirs = held.filter((grant) => grant.principal === principal);
+		return [{
+			principal,
+			before: theirs.map((grant) => ({
+				place: grant.environmentSlug === null ? "*" : `*/${grant.environmentSlug}`,
+				role: grant.role,
+				expiresAt: grant.expiresAt
+			})),
+			conversion: convertEveryProjectGrants({
+				person: principal.startsWith("user:"),
+				role: principal.startsWith("user:") ? storedRole(member).role : "member",
+				everyProject: theirs.map((grant) => ({
+					environmentSlug: grant.environmentSlug,
+					role: grant.role,
+					expiresAt: grant.expiresAt
+				})),
+				grants: grants.filter((grant) => grant.principal === principal && grant.projectId !== null).map((grant) => ({
+					projectId: grant.projectId,
+					environmentId: grant.environmentId,
+					role: grant.role,
+					expiresAt: grant.expiresAt
+				})),
+				projects: live
+			}),
+			paths,
+			reported: tampered.has(principal)
+		}];
+	});
+}
+/**
+* The live service tokens and trust bindings of active service accounts
+* that carry no scope yet, as 0.4 made them: what the app seals with each
+* account's grants once a process (`sealScopes`), and what `coffre migrate`
+* says it will. A credential a binding issued carries its binding's.
+*/
+async function unsealedCredentials(db, at) {
+	const { credentials, serviceBindings, vaultMembers } = tablesOf(db);
+	const [tokens, bindings] = await Promise.all([db.select({
+		id: credentials.id,
+		principal: credentials.principal
+	}).from(credentials).innerJoin(vaultMembers, and(eq(vaultMembers.principal, credentials.principal), eq(vaultMembers.generation, credentials.generation))).where(and(eq(credentials.kind, "service"), isNull(credentials.scope), sql`${credentials.createdBy} NOT LIKE 'binding:%'`, isNull(credentials.revokedAt), gt(credentials.expiresAt, at), eq(vaultMembers.status, "active"))), db.select({
+		id: serviceBindings.id,
+		principal: serviceBindings.principal
+	}).from(serviceBindings).innerJoin(vaultMembers, and(eq(vaultMembers.principal, serviceBindings.principal), eq(vaultMembers.generation, serviceBindings.generation))).where(and(isNull(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, "active")))]);
+	return [...tokens.map((row) => ({
+		kind: "token",
+		...row
+	})), ...bindings.map((row) => ({
+		kind: "binding",
+		...row
+	}))].sort((a, b) => a.principal.localeCompare(b.principal) || a.kind.localeCompare(b.kind) || a.id.localeCompare(b.id));
+}
+/**
+* The members the vault has found changed around it, and not started over
+* since, as a reader without its key can tell: `reportStands`' rule, taking
+* every entry in the vault's name as its own, for everyone at once, where
+* the app lists members and `coffre migrate` marks them. Their newest
+* `vault.tampered`, for their row (`mac`) or an older one put back
+* (`stale`), is newer than the newest entry changing what they hold. Both
+* reads go by the log's (author, action, seq) and (author, subject, seq)
+* indexes, and findings are few.
+*/
+async function tamperedMembers(db, principal) {
+	const { auditLog } = tablesOf(db);
+	const newest = (actions, extra) => db.select({
+		principal: auditLog.subjectPrincipal,
+		seq: sql`max(${auditLog.seq})`.mapWith(BigInt)
+	}).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...actions]), principal === void 0 ? void 0 : eq(auditLog.subjectPrincipal, principal), extra)).groupBy(auditLog.subjectPrincipal);
+	const found = await newest(["vault.tampered"], inArray(auditLog.code, [...TAMPER_CODES]));
+	if (found.length === 0) return /* @__PURE__ */ new Set();
+	const changed = new Map((await newest(ACCESS_ACTIONS, and(eq(auditLog.decision, "allow"), inArray(auditLog.subjectPrincipal, found.map((row) => row.principal))))).map((row) => [row.principal, row.seq]));
+	return new Set(found.filter((row) => row.seq > (changed.get(row.principal) ?? -1n)).map((row) => row.principal));
+}
+/** The codes of the vault's reports that a member's row was changed around it: their row's MAC fails (`mac`), or an older one was put back (`stale`). */
+const TAMPER_CODES = ["mac", "stale"];
+/**
+* Whether the vault's report that `principal`'s row was changed around it
+* stands: one of its own is newer than its newest entry changing what they
+* hold, and only starting them over, or another change, settles it. While
+* one stands the vault leaves their grants on every project of 0.4 as they
+* are. Both entries as `check`, the vault's MACs, tells them apart,
+* passing over those forged in its name; a reader without its key takes
+* them all as the vault's (`tamperedMembers`). Only reports after that
+* entry are read, so older ones, forged or not, never hide one. From
+* LOOK_BACK forged entries on, of either kind, one may stand, so it is
+* taken to.
+*/
+async function reportStands(db, principal, check) {
+	const access = await newestAccess(db, principal, check);
+	if (access === "unreached") return true;
+	const after = typeof access === "string" ? -1n : access.seq;
+	const report = await newestAuthentic((before) => tamperReportsAbout(db, principal, LOOK_BACK.page, after, before), check);
+	return report === "unreached" || typeof report !== "string";
+}
+/** The newest access entry about `principal` that `check` finds the vault's own. */
+function newestAccess(db, principal, check) {
+	return newestAuthentic((before) => accessEntriesAbout(db, principal, LOOK_BACK.page, before), check);
+}
+/** Up to `limit` of the vault's allowed access entries about `principal` before `before` (the newest when undefined), newest first. */
+async function accessEntriesAbout(db, principal, limit, before) {
+	const { auditLog } = tablesOf(db);
+	return await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.subjectPrincipal, principal), inArray(auditLog.action, [...ACCESS_ACTIONS]), eq(auditLog.decision, "allow"), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit);
+}
+/**
+* Up to `limit` of the vault's reports that `principal`'s row was changed
+* around it (`TAMPER_CODES`), after `after` and before `before` (the newest
+* when undefined), newest first.
+*/
+async function tamperReportsAbout(db, principal, limit, after, before) {
+	const { auditLog } = tablesOf(db);
+	return await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.subjectPrincipal, principal), eq(auditLog.action, "vault.tampered"), inArray(auditLog.code, [...TAMPER_CODES]), gt(auditLog.seq, after), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit);
+}
 //#endregion
-export { insertGrant, readGrants };
+export { accessEntriesAbout, everyProjectPreview, insertGrant, newestAccess, readGrants, reportStands, roleColumns, storedRole, tamperedMembers, unsealedCredentials };

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-edkMkG02.js";
+import { n as PoolLike } from "./database-C63WjCrC.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { m as schema_d_exports } from "./schema-BqCB3XFm.js";
-import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-edkMkG02.js";
+import { m as schema_d_exports } from "./schema-a7PkFgea.js";
+import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-C63WjCrC.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, schema_d_exports as schema, tablesOf };