@coffre/db 0.6.2 → 0.7.0

package/src/migrations/sqlite/meta/_journal.json

@@ -29,6 +29,41 @@
       "when": 1791676487593,
       "tag": "0003_credential_scopes",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1792244020959,
+      "tag": "0004_environment_parents",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "6",
+      "when": 1792250910230,
+      "tag": "0005_personal_tokens",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "6",
+      "when": 1792252693912,
+      "tag": "0006_uploaded_keys",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "6",
+      "when": 1792253795070,
+      "tag": "0007_personal_configs",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "6",
+      "when": 1792255560312,
+      "tag": "0008_recipes",
+      "breakpoints": true
     }
   ]
 }

package/src/schema.sqlite.ts

@@ -85,16 +85,29 @@ export const environments = sqliteTable(
     name: text().notNull(),
     createdAt: createdAt(),
     archivedAt: time('archived_at'),
+    parentId: text('parent_id'),
+    owner: text(),
   },
   (table) => [
     unique('environments_project_id_slug_key').on(table.projectId, table.slug),
     unique('environments_project_scoped').on(table.id, table.projectId),
     check('environments_slug_check', isPlaceSlug(table.slug)),
+    // An environment is never its own parent. Longer loops, written around the app, are refused at read (`parentsOf`).
+    check('environments_parent_check', sql`${table.parentId} IS NULL OR ${table.parentId} <> ${table.id}`),
+    check('environments_owner_check', sql`${table.owner} IS NULL OR (${table.parentId} IS NOT NULL AND ${table.owner} LIKE 'user:_%')`),
+    uniqueIndex('environments_parent_id_owner_key').on(table.parentId, table.owner).where(sql`instr(${table.slug}, '~') = 0`),
     foreignKey({
       name: 'environments_project_id_fkey',
       columns: [table.projectId],
       foreignColumns: [projects.id],
     }).onDelete('restrict'),
+    // Checked at the end of a statement, not at each row: one that deletes a fork and its parent together is no orphan.
+    foreignKey({
+      name: 'environments_parent_in_project',
+      columns: [table.parentId, table.projectId],
+      foreignColumns: [table.id, table.projectId],
+    }).onDelete('no action'),
+    index('environments_parent_idx').on(table.parentId),
   ],
 );
 
@@ -156,6 +169,14 @@ export const secretVersions = sqliteTable(
     kekVersion: text('kek_version').notNull(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
+    // How a client made this value, `bytes:32:hex` (`@coffre/core/recipe`),
+    // when it was generated rather than typed: Regenerate makes the next one
+    // the same way. Null for a typed value, so writing one by hand clears it.
+    recipe: text(),
+    // A generated key pair's two versions, written together, share an id,
+    // and each says which half it holds: 'private' or 'public'.
+    pairId: text('pair_id'),
+    pairHalf: text('pair_half'),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -364,6 +385,10 @@ export const auditLog = sqliteTable(
     index('audit_log_exchange_idx')
       .on(sql`json_extract(${table.metadata}, '$.credentialId')`)
       .where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
+    // The token a credential is, when one was issued: its creation's entry, by the credential's ID, whose label names a personal token's entries.
+    index('audit_log_token_create_idx')
+      .on(sql`json_extract(${table.metadata}, '$.targetCredentialId')`)
+      .where(sql`${table.author} = 'app' AND ${table.action} = 'token.create' AND ${table.decision} = 'allow'`),
     index('audit_log_reference_end_idx')
       .on(table.relatedSeq)
       .where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
@@ -476,8 +501,11 @@ export const serviceBindings = sqliteTable(
     generation: integer().notNull(),
     profile: text().notNull(),
     issuer: text().notNull(),
-    // From the issuer's discovery when the binding was made, never refetched.
+    // From the issuer's discovery when the binding was made, never refetched;
+    // or, for keys uploaded with the binding, `sha256:<hex>` of `jwks`.
     jwksUri: text('jwks_uri').notNull(),
+    // The issuer's public keys, uploaded with the binding (`uploadedKeys`), JSON; null when they are fetched.
+    jwks: text(),
     // JSON, sorted by claim name.
     claims: text().notNull(),
     // What the credentials it issues reach (`CredentialScope`), JSON; null on a binding of 0.4 the app has not sealed yet.
@@ -641,7 +669,7 @@ export const credentials = sqliteTable(
     // The member it acts as, `user:<email>` or `token:<id>`, under the generation it was issued in.
     principal: text().notNull(),
     identityId: text('identity_id'),
-    // What a service token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
+    // What a service or personal token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
     scope: text(),
     label: text(),
     createdAt: createdAt(),
@@ -654,7 +682,7 @@ export const credentials = sqliteTable(
   },
   (table) => [
     unique('credentials_token_hash_key').on(table.tokenHash),
-    check('credentials_kind_check', sql`${table.kind} IN ('browser', 'cli', 'service')`),
+    check('credentials_kind_check', sql`${table.kind} IN ('browser', 'cli', 'service', 'personal')`),
     check('credentials_principal_check', sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
     check('credentials_kind_matches_principal', sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
     check('credentials_token_hash_check', sql`octet_length(${table.tokenHash}) = 32`),

package/src/schema.ts

@@ -68,16 +68,35 @@ export const environments = pgTable(
     name: text().notNull(),
     createdAt: createdAt(),
     archivedAt: timestamp('archived_at', { withTimezone: true }),
+    // The environment it inherits from, in the same project: its keys are
+    // this one's, but for those it sets or removes (docs/design/forking.md).
+    // Set when it is made and never after, so no chain can loop.
+    parentId: uuid('parent_id'),
+    // A personal config's owner, `user:<email>`: a fork whose values only they
+    // read, the vault binding each to them. Set when it is made and never after.
+    owner: text(),
   },
   (table) => [
     unique('environments_project_id_slug_key').on(table.projectId, table.slug),
     unique('environments_project_scoped').on(table.id, table.projectId),
     check('environments_slug_check', sql`${table.slug} ~ ${PLACE_SLUG}`),
+    // An environment is never its own parent. Longer loops, written around the app, are refused at read (`parentsOf`).
+    check('environments_parent_check', sql`${table.parentId} IS NULL OR ${table.parentId} <> ${table.id}`),
+    check('environments_owner_check', sql`${table.owner} IS NULL OR (${table.parentId} IS NOT NULL AND ${table.owner} LIKE 'user:_%')`),
+    // One personal config per person per environment; a deleted one, a tombstone, holds no place.
+    uniqueIndex('environments_parent_id_owner_key').on(table.parentId, table.owner).where(sql`strpos(${table.slug}, '~') = 0`),
     foreignKey({
       name: 'environments_project_id_fkey',
       columns: [table.projectId],
       foreignColumns: [projects.id],
     }).onDelete('restrict'),
+    // Checked at the end of a statement, not at each row: one that deletes a fork and its parent together is no orphan.
+    foreignKey({
+      name: 'environments_parent_in_project',
+      columns: [table.parentId, table.projectId],
+      foreignColumns: [table.id, table.projectId],
+    }).onDelete('no action'),
+    index('environments_parent_idx').on(table.parentId),
   ],
 );
 
@@ -144,6 +163,14 @@ export const secretVersions = pgTable(
     kekVersion: text('kek_version').notNull(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
+    // How a client made this value, `bytes:32:hex` (`@coffre/core/recipe`),
+    // when it was generated rather than typed: Regenerate makes the next one
+    // the same way. Null for a typed value, so writing one by hand clears it.
+    recipe: text(),
+    // A generated key pair's two versions, written together, share an id,
+    // and each says which half it holds: 'private' or 'public'.
+    pairId: uuid('pair_id'),
+    pairHalf: text('pair_half'),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -376,6 +403,10 @@ export const auditLog = pgTable(
     index('audit_log_exchange_idx')
       .on(sql`((${table.metadata})::jsonb ->> 'credentialId')`)
       .where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
+    // The token a credential is, when one was issued: its creation's entry, by the credential's ID, whose label names a personal token's entries.
+    index('audit_log_token_create_idx')
+      .on(sql`((${table.metadata})::jsonb ->> 'targetCredentialId')`)
+      .where(sql`${table.author} = 'app' AND ${table.action} = 'token.create' AND ${table.decision} = 'allow'`),
     // Whether a reference has ended: the vault's `reference.end` naming its creation.
     index('audit_log_reference_end_idx')
       .on(table.relatedSeq)
@@ -520,8 +551,11 @@ export const serviceBindings = pgTable(
     generation: integer().notNull(),
     profile: text().notNull(),
     issuer: text().notNull(),
-    // From the issuer's discovery when the binding was made, never refetched.
+    // From the issuer's discovery when the binding was made, never refetched;
+    // or, for keys uploaded with the binding, `sha256:<hex>` of `jwks`.
     jwksUri: text('jwks_uri').notNull(),
+    // The issuer's public keys, uploaded with the binding (`uploadedKeys`), JSON; null when they are fetched.
+    jwks: text(),
     // JSON, sorted by claim name.
     claims: text().notNull(),
     // What the credentials it issues reach (`CredentialScope`), JSON; null on a binding of 0.4 the app has not sealed yet.
@@ -709,7 +743,7 @@ export const credentials = pgTable(
     // The member it acts as, `user:<email>` or `token:<id>`, under the generation it was issued in.
     principal: text().notNull(),
     identityId: uuid('identity_id'),
-    // What a service token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
+    // What a service or personal token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
     scope: text(),
     label: text(),
     createdAt: createdAt(),
@@ -722,7 +756,7 @@ export const credentials = pgTable(
   },
   (table) => [
     unique('credentials_token_hash_key').on(table.tokenHash),
-    check('credentials_kind_check', sql`${table.kind} IN ('browser', 'cli', 'service')`),
+    check('credentials_kind_check', sql`${table.kind} IN ('browser', 'cli', 'service', 'personal')`),
     check('credentials_principal_check', sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
     check('credentials_kind_matches_principal', sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
     check('credentials_token_hash_check', sql`octet_length(${table.tokenHash}) = 32`),