@coffre/db 0.5.1 → 0.6.0

package/dist/grants.d.ts

@@ -1,6 +1,6 @@
 import { i as Queryable } from "./database-C63WjCrC.js";
 import { Authenticity, Newest } from "./log.js";
-import { Conversion, InstanceRole, Scope } from "@coffre/core/access";
+import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";
 import { StoredEntry } from "@coffre/core/audit";
 //#region src/grants.d.ts
 /**
@@ -48,6 +48,17 @@ export declare function storedRole({ owner, role, scope }: StoredRole): {
 };
 /** The columns that store a member's instance role and scope: `owner` too, for a vault of 0.4 to read. */
 export declare function roleColumns(role: InstanceRole, scope: Scope): StoredRole;
+/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
+export declare function liveProjects(db: Queryable): Promise<ConversionInput['projects']>;
+/**
+ * What the vault makes of a member's grants on every project of 0.4
+ * (`convertEveryProjectGrants`), from their instance role and their grants
+ * as stored, those live at `at`: the vault as it converts them, under their
+ * row's lock, and `coffre migrate` before, from the rows as they are. The
+ * role is the one their row holds: the vault converts these before it makes
+ * the Owners its deployment names.
+ */
+export declare function everyProjectConversion(principal: string, role: InstanceRole, grants: readonly GrantRow[], at: number, projects: ConversionInput['projects']): Conversion;
 /** What the vault does, when this version first runs, to one member's grants on every project of 0.4. */
 export type EveryProjectPreview = {
   principal: string;
@@ -78,9 +89,7 @@ export type EveryProjectPreview = {
  * `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
  * they read: whether that report is the vault's own, or forged so as to
  * hide what it will do, only the vault can tell. Any member the vault
- * converts is listed. A root admin's it leaves while they are one, until
- * they are not; which they are, the vault's configuration says and the
- * database does not, so they are listed too.
+ * converts is listed.
  */
 export declare function everyProjectPreview(db: Queryable, at: number): Promise<EveryProjectPreview[]>;
 /** A service token or trust binding of 0.4, which carries no scope of its own yet. */

package/dist/grants.js

@@ -1,8 +1,8 @@
 import { tablesOf } from "./index.js";
+import { tombstone, truth } from "./dialect.js";
 import { LOOK_BACK, entryColumns, newestAuthentic } from "./log.js";
-import { and, desc, eq, gt, inArray, isNull, lt, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq, gt, inArray, isNull, lt, or, sql } from "drizzle-orm";
 import { EVERYWHERE, administers, convertEveryProjectGrants, isInstanceRole, isScope, normalScope, unscoped } from "@coffre/core/access";
-import { isTombstone } from "@coffre/core/schemas";
 import { ACCESS_ACTIONS } from "@coffre/core/vault";
 //#region src/grants.ts
 /** Grants, lapsed ones too unless `liveAt` says when to judge them: one member's, or everyone's. */
@@ -60,6 +60,54 @@ function roleColumns(role, scope) {
 		scope: role === "member" || unscoped(normal) ? null : JSON.stringify(normal)
 	};
 }
+/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
+async function liveProjects(db) {
+	const { projects, environments } = tablesOf(db);
+	const [found, inside] = await Promise.all([db.select({
+		id: projects.id,
+		deleted: truth(tombstone(projects.slug))
+	}).from(projects).orderBy(asc(projects.id)), db.select({
+		id: environments.id,
+		projectId: environments.projectId,
+		slug: environments.slug,
+		deleted: truth(tombstone(environments.slug))
+	}).from(environments).orderBy(asc(environments.id))]);
+	return found.filter((project) => !project.deleted).map((project) => ({
+		id: project.id,
+		environments: inside.filter((environment) => environment.projectId === project.id && !environment.deleted).map(({ id, slug }) => ({
+			id,
+			slug
+		}))
+	}));
+}
+/**
+* What the vault makes of a member's grants on every project of 0.4
+* (`convertEveryProjectGrants`), from their instance role and their grants
+* as stored, those live at `at`: the vault as it converts them, under their
+* row's lock, and `coffre migrate` before, from the rows as they are. The
+* role is the one their row holds: the vault converts these before it makes
+* the Owners its deployment names.
+*/
+function everyProjectConversion(principal, role, grants, at, projects) {
+	const person = principal.startsWith("user:");
+	const live = grants.filter((grant) => grant.expiresAt === null || grant.expiresAt > at);
+	return convertEveryProjectGrants({
+		person,
+		role: person ? role : "member",
+		everyProject: live.filter((grant) => grant.projectId === null && grant.environmentId === null).map((grant) => ({
+			environmentSlug: grant.environmentSlug,
+			role: grant.role,
+			expiresAt: grant.expiresAt
+		})),
+		grants: live.filter((grant) => grant.projectId !== null).map((grant) => ({
+			projectId: grant.projectId,
+			environmentId: grant.environmentId,
+			role: grant.role,
+			expiresAt: grant.expiresAt
+		})),
+		projects
+	});
+}
 /**
 * What the vault will make of the grants on every project of 0.4 that live
 * members hold, by the rule it converts them with
@@ -71,16 +119,15 @@ function roleColumns(role, scope) {
 * `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
 * they read: whether that report is the vault's own, or forged so as to
 * hide what it will do, only the vault can tell. Any member the vault
-* converts is listed. A root admin's it leaves while they are one, until
-* they are not; which they are, the vault's configuration says and the
-* database does not, so they are listed too.
+* converts is listed.
 */
 async function everyProjectPreview(db, at) {
 	const { vaultMembers, projects, environments } = tablesOf(db);
-	const held = (await readGrants(db, { liveAt: at })).filter((grant) => grant.projectId === null && grant.environmentId === null);
+	const grants = await readGrants(db, { liveAt: at });
+	const held = grants.filter((grant) => grant.projectId === null && grant.environmentId === null);
 	if (held.length === 0) return [];
 	const holders = [...new Set(held.map((grant) => grant.principal))].sort();
-	const [members, grants, places, inside, tampered] = await Promise.all([
+	const [members, places, inside, live, tampered] = await Promise.all([
 		db.select({
 			principal: vaultMembers.principal,
 			status: vaultMembers.status,
@@ -88,7 +135,6 @@ async function everyProjectPreview(db, at) {
 			role: vaultMembers.role,
 			scope: vaultMembers.scope
 		}).from(vaultMembers),
-		readGrants(db, { liveAt: at }),
 		db.select({
 			id: projects.id,
 			slug: projects.slug
@@ -98,43 +144,21 @@ async function everyProjectPreview(db, at) {
 			projectId: environments.projectId,
 			slug: environments.slug
 		}).from(environments),
+		liveProjects(db),
 		tamperedMembers(db)
 	]);
-	const live = places.filter((project) => !isTombstone(project.slug)).map((project) => ({
-		id: project.id,
-		environments: inside.filter((environment) => environment.projectId === project.id && !isTombstone(environment.slug)).map(({ id, slug }) => ({
-			id,
-			slug
-		}))
-	}));
 	const paths = Object.fromEntries(places.flatMap((project) => [[project.id, project.slug], ...inside.filter((environment) => environment.projectId === project.id).map((environment) => [environment.id, `${project.slug}/${environment.slug}`])]));
 	return holders.flatMap((principal) => {
 		const member = members.find((row) => row.principal === principal);
 		if (member?.status !== "active") return [];
-		const theirs = held.filter((grant) => grant.principal === principal);
 		return [{
 			principal,
-			before: theirs.map((grant) => ({
+			before: held.filter((grant) => grant.principal === principal).map((grant) => ({
 				place: grant.environmentSlug === null ? "*" : `*/${grant.environmentSlug}`,
 				role: grant.role,
 				expiresAt: grant.expiresAt
 			})),
-			conversion: convertEveryProjectGrants({
-				person: principal.startsWith("user:"),
-				role: principal.startsWith("user:") ? storedRole(member).role : "member",
-				everyProject: theirs.map((grant) => ({
-					environmentSlug: grant.environmentSlug,
-					role: grant.role,
-					expiresAt: grant.expiresAt
-				})),
-				grants: grants.filter((grant) => grant.principal === principal && grant.projectId !== null).map((grant) => ({
-					projectId: grant.projectId,
-					environmentId: grant.environmentId,
-					role: grant.role,
-					expiresAt: grant.expiresAt
-				})),
-				projects: live
-			}),
+			conversion: everyProjectConversion(principal, storedRole(member).role, grants.filter((grant) => grant.principal === principal), at, live),
 			paths,
 			reported: tampered.has(principal)
 		}];
@@ -224,4 +248,4 @@ async function tamperReportsAbout(db, principal, limit, after, before) {
 	return await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.subjectPrincipal, principal), eq(auditLog.action, "vault.tampered"), inArray(auditLog.code, [...TAMPER_CODES]), gt(auditLog.seq, after), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit);
 }
 //#endregion
-export { accessEntriesAbout, everyProjectPreview, insertGrant, newestAccess, readGrants, reportStands, roleColumns, storedRole, tamperedMembers, unsealedCredentials };
+export { accessEntriesAbout, everyProjectConversion, everyProjectPreview, insertGrant, liveProjects, newestAccess, readGrants, reportStands, roleColumns, storedRole, tamperedMembers, unsealedCredentials };

package/dist/log.d.ts

@@ -450,6 +450,8 @@ export type Authenticity = {
   authentic: (entry: StoredEntry) => boolean;
   forged: (entry: StoredEntry) => void;
 };
+/** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
+export declare function newestVaultEntries(db: Queryable, action: string, limit: number, before?: bigint): Promise<StoredEntry[]>;
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export declare const LOOK_BACK: {
   page: number;

package/dist/log.js

@@ -1,7 +1,7 @@
 import { t as afterCommit } from "./commits-BuW-NL3n.js";
 import { tablesOf } from "./index.js";
 import { clockMillis, forUpdate } from "./dialect.js";
-import { desc, eq } from "drizzle-orm";
+import { and, desc, eq, lt } from "drizzle-orm";
 import { GENESIS_HASH, sealEntry } from "@coffre/core/audit";
 //#region src/log.ts
 /** The log's head does not name its last entry: something moved it, or cut the log behind it. */
@@ -163,6 +163,11 @@ function entryColumns(db) {
 		hash: auditLog.hash
 	};
 }
+/** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
+async function newestVaultEntries(db, action, limit, before) {
+	const { auditLog } = tablesOf(db);
+	return await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), eq(auditLog.decision, "allow"), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit);
+}
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 const LOOK_BACK = {
 	page: 32,
@@ -189,4 +194,4 @@ async function newestAuthentic(page, check) {
 	return "unreached";
 }
 //#endregion
-export { LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic };
+export { LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic, newestVaultEntries };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.5.1"
+    "@coffre/core": "0.6.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/grants.ts

@@ -7,17 +7,18 @@ import {
   normalScope,
   unscoped,
   type Conversion,
+  type ConversionInput,
   type InstanceRole,
   type Role,
   type Scope,
 } from '@coffre/core/access';
 import type { StoredEntry } from '@coffre/core/audit';
-import { isTombstone } from '@coffre/core/schemas';
 import { ACCESS_ACTIONS } from '@coffre/core/vault';
-import { and, desc, eq, gt, inArray, isNull, lt, or, sql, type SQL } from 'drizzle-orm';
+import { and, asc, desc, eq, gt, inArray, isNull, like, lt, or, sql, type SQL } from 'drizzle-orm';
 
 import { tablesOf, type Queryable } from './database.ts';
-import { entryColumns, LOOK_BACK, newestAuthentic, type Authenticity, type Newest } from './log.ts';
+import { tombstone, truth } from './dialect.ts';
+import { entryColumns, LOOK_BACK, newestAuthentic, newestVaultEntries, type Authenticity, type Newest } from './log.ts';
 
 /**
  * One grant, as `vault_grants` holds it: on a project (`environmentId`
@@ -93,6 +94,49 @@ export function roleColumns(role: InstanceRole, scope: Scope): StoredRole {
   return { owner: administers(role), role, scope: role === 'member' || unscoped(normal) ? null : JSON.stringify(normal) };
 }
 
+/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
+export async function liveProjects(db: Queryable): Promise<ConversionInput['projects']> {
+  const { projects, environments } = tablesOf(db);
+  const [found, inside] = await Promise.all([
+    db.select({ id: projects.id, deleted: truth(tombstone(projects.slug)) }).from(projects).orderBy(asc(projects.id)),
+    db.select({ id: environments.id, projectId: environments.projectId, slug: environments.slug, deleted: truth(tombstone(environments.slug)) }).from(environments).orderBy(asc(environments.id)),
+  ]);
+  return found.filter((project) => !project.deleted).map((project) => ({
+    id: project.id,
+    environments: inside.filter((environment) => environment.projectId === project.id && !environment.deleted).map(({ id, slug }) => ({ id, slug })),
+  }));
+}
+
+/**
+ * What the vault makes of a member's grants on every project of 0.4
+ * (`convertEveryProjectGrants`), from their instance role and their grants
+ * as stored, those live at `at`: the vault as it converts them, under their
+ * row's lock, and `coffre migrate` before, from the rows as they are. The
+ * role is the one their row holds: the vault converts these before it makes
+ * the Owners its deployment names.
+ */
+export function everyProjectConversion(
+  principal: string,
+  role: InstanceRole,
+  grants: readonly GrantRow[],
+  at: number,
+  projects: ConversionInput['projects'],
+): Conversion {
+  const person = principal.startsWith('user:');
+  const live = grants.filter((grant) => grant.expiresAt === null || grant.expiresAt > at);
+  return convertEveryProjectGrants({
+    person,
+    role: person ? role : 'member',
+    everyProject: live
+      .filter((grant) => grant.projectId === null && grant.environmentId === null)
+      .map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as Role, expiresAt: grant.expiresAt })),
+    grants: live
+      .filter((grant) => grant.projectId !== null)
+      .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as Role, expiresAt: grant.expiresAt })),
+    projects,
+  });
+}
+
 /** What the vault does, when this version first runs, to one member's grants on every project of 0.4. */
 export type EveryProjectPreview = {
   principal: string;
@@ -120,28 +164,23 @@ export type EveryProjectPreview = {
  * `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
  * they read: whether that report is the vault's own, or forged so as to
  * hide what it will do, only the vault can tell. Any member the vault
- * converts is listed. A root admin's it leaves while they are one, until
- * they are not; which they are, the vault's configuration says and the
- * database does not, so they are listed too.
+ * converts is listed.
  */
 export async function everyProjectPreview(db: Queryable, at: number): Promise<EveryProjectPreview[]> {
   const { vaultMembers, projects, environments } = tablesOf(db);
-  const held = (await readGrants(db, { liveAt: at })).filter((grant) => grant.projectId === null && grant.environmentId === null);
+  const grants = await readGrants(db, { liveAt: at });
+  const held = grants.filter((grant) => grant.projectId === null && grant.environmentId === null);
   if (held.length === 0) return [];
   const holders = [...new Set(held.map((grant) => grant.principal))].sort();
-  const [members, grants, places, inside, tampered] = await Promise.all([
+  const [members, places, inside, live, tampered] = await Promise.all([
     db.select({ principal: vaultMembers.principal, status: vaultMembers.status, owner: vaultMembers.owner, role: vaultMembers.role, scope: vaultMembers.scope }).from(vaultMembers),
-    readGrants(db, { liveAt: at }),
     db.select({ id: projects.id, slug: projects.slug }).from(projects),
     db.select({ id: environments.id, projectId: environments.projectId, slug: environments.slug }).from(environments),
+    liveProjects(db),
     // The vault's own rule (`reportStands`), over every entry in its name, for everyone in two queries.
     tamperedMembers(db),
   ]);
-  // A deleted place keeps its row under a tombstone's slug, its own or its project's: no grant reaches it.
-  const live = places.filter((project) => !isTombstone(project.slug)).map((project) => ({
-    id: project.id,
-    environments: inside.filter((environment) => environment.projectId === project.id && !isTombstone(environment.slug)).map(({ id, slug }) => ({ id, slug })),
-  }));
+  // A deleted place keeps its row under a tombstone's slug, its own or its project's, named as it was.
   const paths = Object.fromEntries(places.flatMap((project) => [
     [project.id, project.slug],
     ...inside.filter((environment) => environment.projectId === project.id).map((environment) => [environment.id, `${project.slug}/${environment.slug}`]),
@@ -153,15 +192,7 @@ export async function everyProjectPreview(db: Queryable, at: number): Promise<Ev
     return [{
       principal,
       before: theirs.map((grant) => ({ place: grant.environmentSlug === null ? '*' : `*/${grant.environmentSlug}`, role: grant.role, expiresAt: grant.expiresAt })),
-      conversion: convertEveryProjectGrants({
-        person: principal.startsWith('user:'),
-        role: principal.startsWith('user:') ? storedRole(member).role : 'member',
-        everyProject: theirs.map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as Role, expiresAt: grant.expiresAt })),
-        grants: grants
-          .filter((grant) => grant.principal === principal && grant.projectId !== null)
-          .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as Role, expiresAt: grant.expiresAt })),
-        projects: live,
-      }),
+      conversion: everyProjectConversion(principal, storedRole(member).role, grants.filter((grant) => grant.principal === principal), at, live),
       paths,
       reported: tampered.has(principal),
     }];

package/src/log.ts

@@ -1,5 +1,5 @@
 import { GENESIS_HASH, sealEntry, type LogFields, type LogKey, type StoredEntry } from '@coffre/core/audit';
-import { desc, eq } from 'drizzle-orm';
+import { and, desc, eq, lt } from 'drizzle-orm';
 
 import { afterCommit } from './commits.ts';
 import { tablesOf, type Queryable, type Transaction } from './database.ts';
@@ -225,6 +225,25 @@ export function entryColumns(db: Queryable) {
  */
 export type Authenticity = { authentic: (entry: StoredEntry) => boolean; forged: (entry: StoredEntry) => void };
 
+/** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
+export async function newestVaultEntries(db: Queryable, action: string, limit: number, before?: bigint): Promise<StoredEntry[]> {
+  const { auditLog } = tablesOf(db);
+  const rows = await db
+    .select(entryColumns(db))
+    .from(auditLog)
+    .where(
+      and(
+        eq(auditLog.author, 'vault'),
+        eq(auditLog.action, action),
+        eq(auditLog.decision, 'allow'),
+        before === undefined ? undefined : lt(auditLog.seq, before),
+      ),
+    )
+    .orderBy(desc(auditLog.seq))
+    .limit(limit);
+  return rows as StoredEntry[];
+}
+
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export const LOOK_BACK = { page: 32, pages: 32 };
 

package/src/schema.ts

@@ -205,8 +205,7 @@ export const vaultMembers = pgTable(
     principal: text().primaryKey(),
     status: text().notNull(),
     // An owner of 0.4: an Admin, unless `role` says otherwise. Written as
-    // whether `role` administers, for a vault of 0.4 to read. Root admins
-    // come from the vault's configuration, never from a row.
+    // whether `role` administers, for a vault of 0.4 to read.
     owner: boolean().notNull().default(false),
     // A person's instance role (`INSTANCE_ROLES` in @coffre/core/access),
     // and where it applies, as JSON (`Scope`, projects by id); null on a row