@coffre/db 0.6.2 → 0.7.0

package/src/migrations/postgres/meta/_journal.json

@@ -29,6 +29,41 @@
       "when": 1791676486914,
       "tag": "0003_credential_scopes",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1792244020330,
+      "tag": "0004_environment_parents",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1792250909587,
+      "tag": "0005_personal_tokens",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1792252693050,
+      "tag": "0006_uploaded_keys",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1792253794481,
+      "tag": "0007_personal_configs",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1792255559691,
+      "tag": "0008_recipes",
+      "breakpoints": true
     }
   ]
 }

package/src/migrations/sqlite/0004_environment_parents.sql

@@ -0,0 +1,3 @@
+-- Added in place, not by rebuilding the table as drizzle-kit would: a migration runs in one transaction, where SQLite ignores `foreign_keys=OFF`, so dropping a table other rows reference fails. SQLite adds no table constraint to an existing table, so the parent's same-project rule (`environments_parent_in_project` on Postgres) is the app's here.
+ALTER TABLE `environments` ADD `parent_id` text REFERENCES `environments`(`id`) ON DELETE no action CONSTRAINT "environments_parent_check" CHECK(`parent_id` IS NULL OR `parent_id` <> `id`);--> statement-breakpoint
+CREATE INDEX `environments_parent_idx` ON `environments` (`parent_id`);

package/src/migrations/sqlite/0005_personal_tokens.sql

@@ -0,0 +1,37 @@
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_credentials` (
+	`id` text PRIMARY KEY NOT NULL,
+	`kind` text NOT NULL,
+	`auth_mac` blob NOT NULL,
+	`token_hash` blob NOT NULL,
+	`token_hint` text NOT NULL,
+	`generation` integer NOT NULL,
+	`principal` text NOT NULL,
+	`identity_id` text,
+	`scope` text,
+	`label` text,
+	`created_at` integer DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)) NOT NULL,
+	`created_by` text NOT NULL,
+	`expires_at` integer NOT NULL,
+	`last_used_at` integer,
+	`last_used_ip` text,
+	`revoked_at` integer,
+	`revoked_by` text,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`identity_id`,`principal`,`generation`) REFERENCES `identities`(`id`,`principal`,`generation`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "credentials_kind_check" CHECK("__new_credentials"."kind" IN ('browser', 'cli', 'service', 'personal')),
+	CONSTRAINT "credentials_principal_check" CHECK("__new_credentials"."principal" LIKE 'user:%' OR "__new_credentials"."principal" LIKE 'token:%'),
+	CONSTRAINT "credentials_kind_matches_principal" CHECK(("__new_credentials"."kind" = 'service') = ("__new_credentials"."principal" LIKE 'token:%')),
+	CONSTRAINT "credentials_token_hash_check" CHECK(octet_length("__new_credentials"."token_hash") = 32),
+	CONSTRAINT "credentials_auth_mac_check" CHECK(octet_length("__new_credentials"."auth_mac") = 32)
+);
+--> statement-breakpoint
+INSERT INTO `__new_credentials`("id", "kind", "auth_mac", "token_hash", "token_hint", "generation", "principal", "identity_id", "scope", "label", "created_at", "created_by", "expires_at", "last_used_at", "last_used_ip", "revoked_at", "revoked_by") SELECT "id", "kind", "auth_mac", "token_hash", "token_hint", "generation", "principal", "identity_id", "scope", "label", "created_at", "created_by", "expires_at", "last_used_at", "last_used_ip", "revoked_at", "revoked_by" FROM `credentials`;--> statement-breakpoint
+DROP TABLE `credentials`;--> statement-breakpoint
+ALTER TABLE `__new_credentials` RENAME TO `credentials`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE INDEX `credentials_principal_idx` ON `credentials` (`principal`,`generation`);--> statement-breakpoint
+CREATE INDEX `credentials_live_idx` ON `credentials` (`principal`,`expires_at`) WHERE "credentials"."revoked_at" IS NULL;--> statement-breakpoint
+CREATE INDEX `credentials_issued_by_idx` ON `credentials` (`principal`,`created_by`,`created_at`);--> statement-breakpoint
+CREATE UNIQUE INDEX `credentials_token_hash_key` ON `credentials` (`token_hash`);--> statement-breakpoint
+CREATE INDEX `audit_log_token_create_idx` ON `audit_log` (json_extract("metadata", '$.targetCredentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.create' AND "audit_log"."decision" = 'allow';

package/src/migrations/sqlite/0006_uploaded_keys.sql

@@ -0,0 +1 @@
+ALTER TABLE `service_bindings` ADD `jwks` text;

package/src/migrations/sqlite/0007_personal_configs.sql

@@ -0,0 +1,3 @@
+-- Added in place, not by rebuilding the table as drizzle-kit would: a migration runs in one transaction, where SQLite ignores `foreign_keys=OFF`, so dropping a table other rows reference fails (as 0004).
+ALTER TABLE `environments` ADD `owner` text CONSTRAINT "environments_owner_check" CHECK(`owner` IS NULL OR (`parent_id` IS NOT NULL AND `owner` LIKE 'user:_%'));--> statement-breakpoint
+CREATE UNIQUE INDEX `environments_parent_id_owner_key` ON `environments` (`parent_id`,`owner`) WHERE instr("environments"."slug", '~') = 0;

package/src/migrations/sqlite/0008_recipes.sql

@@ -0,0 +1,15 @@
+ALTER TABLE `secret_versions` ADD `recipe` text;--> statement-breakpoint
+ALTER TABLE `secret_versions` ADD `pair_id` text;--> statement-breakpoint
+ALTER TABLE `secret_versions` ADD `pair_half` text;--> statement-breakpoint
+-- A version is still only ever erased: its recipe and its pair with it.
+DROP TRIGGER `secret_versions_erase_only`;--> statement-breakpoint
+CREATE TRIGGER `secret_versions_erase_only` BEFORE UPDATE ON `secret_versions`
+WHEN length(NEW.`ciphertext`) <> 0 OR length(NEW.`wrapped_dek`) <> 0
+    OR NEW.`id` IS NOT OLD.`id` OR NEW.`secret_id` IS NOT OLD.`secret_id` OR NEW.`version` IS NOT OLD.`version`
+    OR NEW.`envelope_version` IS NOT OLD.`envelope_version` OR NEW.`iv` IS NOT OLD.`iv` OR NEW.`auth_tag` IS NOT OLD.`auth_tag`
+    OR NEW.`kek_provider` IS NOT OLD.`kek_provider` OR NEW.`kek_id` IS NOT OLD.`kek_id` OR NEW.`kek_version` IS NOT OLD.`kek_version`
+    OR NEW.`created_at` IS NOT OLD.`created_at` OR NEW.`created_by` IS NOT OLD.`created_by`
+    OR NEW.`recipe` IS NOT OLD.`recipe` OR NEW.`pair_id` IS NOT OLD.`pair_id` OR NEW.`pair_half` IS NOT OLD.`pair_half`
+BEGIN
+    SELECT RAISE(ABORT, 'a secret version is only ever erased');
+END;