@coffre/db 0.6.2 → 0.7.0

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-C63WjCrC.js";
+import { t as Database } from "./database-BEnexh-3.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-C63WjCrC.d.ts → database-BEnexh-3.d.ts}

@@ -1,4 +1,4 @@
-import { m as schema_d_exports } from "./schema-a7PkFgea.js";
+import { m as schema_d_exports } from "./schema-BZRkBJQZ.js";
 import { Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-C63WjCrC.js";
+import { i as Queryable } from "./database-BEnexh-3.js";
 import { SQL, SQLWrapper } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts

package/dist/grants.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-C63WjCrC.js";
+import { i as Queryable } from "./database-BEnexh-3.js";
 import { Authenticity, Newest } from "./log.js";
 import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";
 import { StoredEntry } from "@coffre/core/audit";

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-C63WjCrC.js";
+import { n as PoolLike } from "./database-BEnexh-3.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { m as schema_d_exports } from "./schema-a7PkFgea.js";
-import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-C63WjCrC.js";
+import { m as schema_d_exports } from "./schema-BZRkBJQZ.js";
+import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-BEnexh-3.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, schema_d_exports as schema, tablesOf };

package/dist/log.d.ts

@@ -1,4 +1,5 @@
-import { a as Transaction, i as Queryable } from "./database-C63WjCrC.js";
+import { a as Transaction, i as Queryable } from "./database-BEnexh-3.js";
+import { SQL } from "drizzle-orm";
 import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts
 /**
@@ -441,6 +442,26 @@ export declare function entryColumns(db: Queryable): {
     pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
   }>;
 };
+/**
+ * Metadata a reader of many entries holds at once, at most: an entry about
+ * a read of several secrets lists them, a thousand some 150 kilobytes, so a
+ * count of entries alone does not bound a batch's or a page's memory within
+ * a Worker's 128 megabytes.
+ */
+export declare const BATCH_BYTES: number;
+/**
+ * Of the entries `where` matches, in `order` of seq, the first `limit` or
+ * fewer that hold no more than `BATCH_BYTES` of metadata between them, but
+ * always the first: the seqs they run from and to, and whether the bytes
+ * cut the run short of `limit`. Null when none matches. A reader asks this
+ * first, then reads `where` between the two.
+ */
+export declare function withinBytes(db: Queryable, where: SQL | undefined, limit: number, order?: 'asc' | 'desc'): Promise<{
+  from: bigint;
+  to: bigint;
+  cut: boolean;
+  count: number;
+} | null>;
 /**
  * How a reader tells the vault's own entries from those forged in its name:
  * by their MAC, which only the vault holds the key to check. Each it finds

package/dist/log.js

@@ -1,7 +1,7 @@
 import { t as afterCommit } from "./commits-BuW-NL3n.js";
 import { tablesOf } from "./index.js";
 import { clockMillis, forUpdate } from "./dialect.js";
-import { and, desc, eq, lt } from "drizzle-orm";
+import { and, asc, desc, eq, lt, sql } from "drizzle-orm";
 import { GENESIS_HASH, sealEntry } from "@coffre/core/audit";
 //#region src/log.ts
 /** The log's head does not name its last entry: something moved it, or cut the log behind it. */
@@ -163,6 +163,41 @@ function entryColumns(db) {
 		hash: auditLog.hash
 	};
 }
+/**
+* Metadata a reader of many entries holds at once, at most: an entry about
+* a read of several secrets lists them, a thousand some 150 kilobytes, so a
+* count of entries alone does not bound a batch's or a page's memory within
+* a Worker's 128 megabytes.
+*/
+const BATCH_BYTES = 8388608;
+/**
+* Of the entries `where` matches, in `order` of seq, the first `limit` or
+* fewer that hold no more than `BATCH_BYTES` of metadata between them, but
+* always the first: the seqs they run from and to, and whether the bytes
+* cut the run short of `limit`. Null when none matches. A reader asks this
+* first, then reads `where` between the two.
+*/
+async function withinBytes(db, where, limit, order = "asc") {
+	const { auditLog } = tablesOf(db);
+	const sizes = await db.select({
+		seq: auditLog.seq,
+		bytes: sql`length(${auditLog.metadata})`
+	}).from(auditLog).where(where).orderBy(order === "asc" ? asc(auditLog.seq) : desc(auditLog.seq)).limit(limit);
+	let held = 0;
+	let count = 0;
+	for (const { bytes } of sizes) {
+		held += Number(bytes);
+		if (count > 0 && held > 8388608) break;
+		count += 1;
+	}
+	if (count === 0) return null;
+	return {
+		from: sizes[0].seq,
+		to: sizes[count - 1].seq,
+		cut: count < sizes.length,
+		count
+	};
+}
 /** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
 async function newestVaultEntries(db, action, limit, before) {
 	const { auditLog } = tablesOf(db);
@@ -194,4 +229,4 @@ async function newestAuthentic(page, check) {
 	return "unreached";
 }
 //#endregion
-export { LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic, newestVaultEntries };
+export { BATCH_BYTES, LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic, newestVaultEntries, withinBytes };

package/dist/migrations/postgres/0004_environment_parents.sql

@@ -0,0 +1,5 @@
+-- The app sets parent_id when it makes an environment, and never after: it gets no UPDATE grant, so a parent cannot change.
+ALTER TABLE "environments" ADD COLUMN "parent_id" uuid;--> statement-breakpoint
+ALTER TABLE "environments" ADD CONSTRAINT "environments_parent_in_project" FOREIGN KEY ("parent_id","project_id") REFERENCES "public"."environments"("id","project_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "environments_parent_idx" ON "environments" USING btree ("parent_id");--> statement-breakpoint
+ALTER TABLE "environments" ADD CONSTRAINT "environments_parent_check" CHECK ("environments"."parent_id" IS NULL OR "environments"."parent_id" <> "environments"."id");

package/dist/migrations/postgres/0005_personal_tokens.sql

@@ -0,0 +1,5 @@
+-- Personal tokens (0.7). The check widens to their kind: the release before makes none, and refuses one, whose prefix, coffre_pat_, it does not take for a token.
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_check";--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_check" CHECK ("credentials"."kind" IN ('browser', 'cli', 'service', 'personal'));--> statement-breakpoint
+-- A token's creation, by the credential's ID: the label a personal token's entries are shown with.
+CREATE INDEX "audit_log_token_create_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'targetCredentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.create' AND "audit_log"."decision" = 'allow';

package/dist/migrations/postgres/0006_uploaded_keys.sql

@@ -0,0 +1,2 @@
+-- An issuer's keys, uploaded with a binding where coffre fetches none. The app inserts them with the binding, under its table-wide INSERT, and no UPDATE grant names them: they never change in place.
+ALTER TABLE "service_bindings" ADD COLUMN "jwks" text;

package/dist/migrations/postgres/0007_personal_configs.sql

@@ -0,0 +1,4 @@
+-- The app sets owner when it makes a personal config, and never after: it gets no UPDATE grant, so an owner cannot change. The vault binds each value to it, so a forged owner opens nothing.
+ALTER TABLE "environments" ADD COLUMN "owner" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "environments_parent_id_owner_key" ON "environments" USING btree ("parent_id","owner") WHERE strpos("environments"."slug", '~') = 0;--> statement-breakpoint
+ALTER TABLE "environments" ADD CONSTRAINT "environments_owner_check" CHECK ("environments"."owner" IS NULL OR ("environments"."parent_id" IS NOT NULL AND "environments"."owner" LIKE 'user:_%'));

package/dist/migrations/postgres/0008_recipes.sql

@@ -0,0 +1,19 @@
+ALTER TABLE "secret_versions" ADD COLUMN "recipe" text;--> statement-breakpoint
+ALTER TABLE "secret_versions" ADD COLUMN "pair_id" uuid;--> statement-breakpoint
+ALTER TABLE "secret_versions" ADD COLUMN "pair_half" text;--> statement-breakpoint
+-- A version is still only ever erased: its recipe and its pair with it.
+CREATE OR REPLACE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by,
+           NEW.recipe, NEW.pair_id, NEW.pair_half)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by,
+           OLD.recipe, OLD.pair_id, OLD.pair_half) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;