@coffre/db 0.4.5 → 0.5.0

package/dist/log.d.ts

@@ -1,5 +1,5 @@
-import { a as Transaction } from "./database-edkMkG02.js";
-import { LogKey } from "@coffre/core/audit";
+import { a as Transaction, i as Queryable } from "./database-C63WjCrC.js";
+import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts
 /**
  * Appending to the audit log, the one table both the app and the vault
@@ -75,4 +75,394 @@ export declare function lockLogHead(tx: Transaction): Promise<{
  * commits. It throws to refuse.
  */
 export declare function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[], check?: (tx: Transaction) => Promise<void>): Promise<Appended>;
+/** An entry's columns, as the chain's codec reads them (`StoredEntry`). */
+export declare function entryColumns(db: Queryable): {
+  seq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: true;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  author: import("drizzle-orm/pg-core").PgColumn<{
+    name: "author";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  keyId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "key_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  occurredAt: import("drizzle-orm/pg-core").PgColumn<{
+    name: "occurred_at";
+    tableName: "audit_log";
+    dataType: "number";
+    columnType: "PgBigInt53";
+    data: number;
+    driverParam: string | number;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  actor: import("drizzle-orm/pg-core").PgColumn<{
+    name: "actor";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  action: import("drizzle-orm/pg-core").PgColumn<{
+    name: "action";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  decision: import("drizzle-orm/pg-core").PgColumn<{
+    name: "decision";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  code: import("drizzle-orm/pg-core").PgColumn<{
+    name: "code";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  subjectPrincipal: import("drizzle-orm/pg-core").PgColumn<{
+    name: "subject_principal";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  projectId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "project_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  environmentId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "environment_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  secretId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "secret_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  secretVersionId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "secret_version_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  operationId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "operation_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  requestId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "request_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  sourceIp: import("drizzle-orm/pg-core").PgColumn<{
+    name: "source_ip";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  relatedSeq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "related_seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  metadata: import("drizzle-orm/pg-core").PgColumn<{
+    name: "metadata";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: true;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  prevHash: import("drizzle-orm/pg-core").PgColumn<{
+    name: "prev_hash";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+  mac: import("drizzle-orm/pg-core").PgColumn<{
+    name: "mac";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+  hash: import("drizzle-orm/pg-core").PgColumn<{
+    name: "hash";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+};
+/**
+ * How a reader tells the vault's own entries from those forged in its name:
+ * by their MAC, which only the vault holds the key to check. Each it finds
+ * forged goes to `forged`.
+ */
+export type Authenticity = {
+  authentic: (entry: StoredEntry) => boolean;
+  forged: (entry: StoredEntry) => void;
+};
+/** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
+export declare const LOOK_BACK: {
+  page: number;
+  pages: number;
+};
+/** What `newestAuthentic` finds: the entry, or why there is none. */
+export type Newest = StoredEntry | 'none' | 'forged' | 'unreached';
+/**
+ * The newest of the entries `page` reads, newest first and before a seq,
+ * that `check` finds authentic, read back a page at a time: 'none' when
+ * there are none at all, 'forged' when every one is in the vault's name but
+ * not its own, and 'unreached' once it has read LOOK_BACK such entries
+ * (1024), whether or not more are left.
+ */
+export declare function newestAuthentic(page: (before: bigint | undefined) => Promise<StoredEntry[]>, check: Authenticity): Promise<Newest>;
 //#endregion

package/dist/log.js

@@ -136,5 +136,57 @@ async function appendEntries(tx, key, entries, check) {
 		occurredAt: now
 	};
 }
+/** An entry's columns, as the chain's codec reads them (`StoredEntry`). */
+function entryColumns(db) {
+	const { auditLog } = tablesOf(db);
+	return {
+		seq: auditLog.seq,
+		author: auditLog.author,
+		keyId: auditLog.keyId,
+		occurredAt: auditLog.occurredAt,
+		actor: auditLog.actor,
+		action: auditLog.action,
+		decision: auditLog.decision,
+		code: auditLog.code,
+		subjectPrincipal: auditLog.subjectPrincipal,
+		projectId: auditLog.projectId,
+		environmentId: auditLog.environmentId,
+		secretId: auditLog.secretId,
+		secretVersionId: auditLog.secretVersionId,
+		operationId: auditLog.operationId,
+		requestId: auditLog.requestId,
+		sourceIp: auditLog.sourceIp,
+		relatedSeq: auditLog.relatedSeq,
+		metadata: auditLog.metadata,
+		prevHash: auditLog.prevHash,
+		mac: auditLog.mac,
+		hash: auditLog.hash
+	};
+}
+/** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
+const LOOK_BACK = {
+	page: 32,
+	pages: 32
+};
+/**
+* The newest of the entries `page` reads, newest first and before a seq,
+* that `check` finds authentic, read back a page at a time: 'none' when
+* there are none at all, 'forged' when every one is in the vault's name but
+* not its own, and 'unreached' once it has read LOOK_BACK such entries
+* (1024), whether or not more are left.
+*/
+async function newestAuthentic(page, check) {
+	let before;
+	for (let read = 0; read < LOOK_BACK.pages; read += 1) {
+		const entries = await page(before);
+		for (const entry of entries) {
+			if (check.authentic(entry)) return entry;
+			check.forged(entry);
+		}
+		if (entries.length < LOOK_BACK.page) return before === void 0 && entries.length === 0 ? "none" : "forged";
+		before = entries.at(-1).seq;
+	}
+	return "unreached";
+}
 //#endregion
-export { LogHeadMismatch, LogRewound, appendEntries, forgetLogHeads, lockLogHead };
+export { LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic };

package/dist/migrations/postgres/0002_instance_roles.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "vault_members" ADD COLUMN "role" text;--> statement-breakpoint
+ALTER TABLE "vault_members" ADD COLUMN "scope" text;--> statement-breakpoint
+-- The vault sets a person's instance role and its scope, as it sets the rest of their row.
+GRANT UPDATE (role, scope) ON vault_members TO coffre_vault;

package/dist/migrations/postgres/0003_credential_scopes.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "credentials" ADD COLUMN "scope" text;--> statement-breakpoint
+ALTER TABLE "service_bindings" ADD COLUMN "scope" text;--> statement-breakpoint
+-- The app seals each token and binding of 0.4 with its account's grants, once, as it seals the rest of their rows.
+GRANT UPDATE (scope) ON credentials, service_bindings TO coffre_app;