@coffre/db 0.8.1 → 0.9.0

package/dist/migrations/postgres/meta/_journal.json

@@ -71,6 +71,20 @@
       "when": 1792281879553,
       "tag": "0009_handles",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "7",
+      "when": 1792314999425,
+      "tag": "0010_handle_places",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1792317460399,
+      "tag": "0011_plain_values",
+      "breakpoints": true
     }
   ]
 }

package/dist/migrations/sqlite/0010_handle_places.sql

@@ -0,0 +1,2 @@
+-- A handle's places (0.9): the environments it was made for, by id and whether as @me, which the proxy's stable URL resolves to. A nullable column the release before neither reads nor writes; the app sets it when it makes a handle, and never after (no UPDATE grant).
+ALTER TABLE `credentials` ADD `places` text;

package/dist/migrations/sqlite/0011_plain_values.sql

@@ -0,0 +1,14 @@
+-- Plain values (0.9): a version of a key marked not secret holds its value in the clear too. Nullable, so the release before writes on as it did.
+ALTER TABLE `secret_versions` ADD `plaintext` text;--> statement-breakpoint
+-- A version is still only ever erased, and an erased one holds no value, in the clear or not.
+DROP TRIGGER `secret_versions_erase_only`;--> statement-breakpoint
+CREATE TRIGGER `secret_versions_erase_only` BEFORE UPDATE ON `secret_versions`
+WHEN length(NEW.`ciphertext`) <> 0 OR length(NEW.`wrapped_dek`) <> 0 OR NEW.`plaintext` IS NOT NULL
+    OR NEW.`id` IS NOT OLD.`id` OR NEW.`secret_id` IS NOT OLD.`secret_id` OR NEW.`version` IS NOT OLD.`version`
+    OR NEW.`envelope_version` IS NOT OLD.`envelope_version` OR NEW.`iv` IS NOT OLD.`iv` OR NEW.`auth_tag` IS NOT OLD.`auth_tag`
+    OR NEW.`kek_provider` IS NOT OLD.`kek_provider` OR NEW.`kek_id` IS NOT OLD.`kek_id` OR NEW.`kek_version` IS NOT OLD.`kek_version`
+    OR NEW.`created_at` IS NOT OLD.`created_at` OR NEW.`created_by` IS NOT OLD.`created_by`
+    OR NEW.`recipe` IS NOT OLD.`recipe` OR NEW.`pair_id` IS NOT OLD.`pair_id` OR NEW.`pair_half` IS NOT OLD.`pair_half`
+BEGIN
+    SELECT RAISE(ABORT, 'a secret version is only ever erased');
+END;