@coffre/db 0.8.2 → 0.10.0

package/src/migrations/postgres/meta/_journal.json

@@ -71,6 +71,41 @@
       "when": 1792281879553,
       "tag": "0009_handles",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "7",
+      "when": 1792314999425,
+      "tag": "0010_handle_places",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1792317460399,
+      "tag": "0011_plain_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "7",
+      "when": 1792340919452,
+      "tag": "0012_sensitive_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "7",
+      "when": 1792343374226,
+      "tag": "0013_contributor_role",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "7",
+      "when": 1792345776262,
+      "tag": "0014_custom_roles",
+      "breakpoints": true
     }
   ]
 }

package/src/migrations/sqlite/0010_handle_places.sql

@@ -0,0 +1,2 @@
+-- A handle's places (0.9): the environments it was made for, by id and whether as @me, which the proxy's stable URL resolves to. A nullable column the release before neither reads nor writes; the app sets it when it makes a handle, and never after (no UPDATE grant).
+ALTER TABLE `credentials` ADD `places` text;

package/src/migrations/sqlite/0011_plain_values.sql

@@ -0,0 +1,14 @@
+-- Plain values (0.9): a version of a key marked not secret holds its value in the clear too. Nullable, so the release before writes on as it did.
+ALTER TABLE `secret_versions` ADD `plaintext` text;--> statement-breakpoint
+-- A version is still only ever erased, and an erased one holds no value, in the clear or not.
+DROP TRIGGER `secret_versions_erase_only`;--> statement-breakpoint
+CREATE TRIGGER `secret_versions_erase_only` BEFORE UPDATE ON `secret_versions`
+WHEN length(NEW.`ciphertext`) <> 0 OR length(NEW.`wrapped_dek`) <> 0 OR NEW.`plaintext` IS NOT NULL
+    OR NEW.`id` IS NOT OLD.`id` OR NEW.`secret_id` IS NOT OLD.`secret_id` OR NEW.`version` IS NOT OLD.`version`
+    OR NEW.`envelope_version` IS NOT OLD.`envelope_version` OR NEW.`iv` IS NOT OLD.`iv` OR NEW.`auth_tag` IS NOT OLD.`auth_tag`
+    OR NEW.`kek_provider` IS NOT OLD.`kek_provider` OR NEW.`kek_id` IS NOT OLD.`kek_id` OR NEW.`kek_version` IS NOT OLD.`kek_version`
+    OR NEW.`created_at` IS NOT OLD.`created_at` OR NEW.`created_by` IS NOT OLD.`created_by`
+    OR NEW.`recipe` IS NOT OLD.`recipe` OR NEW.`pair_id` IS NOT OLD.`pair_id` OR NEW.`pair_half` IS NOT OLD.`pair_half`
+BEGIN
+    SELECT RAISE(ABORT, 'a secret version is only ever erased');
+END;

package/src/migrations/sqlite/0012_sensitive_values.sql

@@ -0,0 +1,15 @@
+-- Sensitive values (0.10): a version never handed back to a person, which the vault's wrap of its data key binds. Defaults to false, so the release before writes on as it did.
+ALTER TABLE `secret_versions` ADD `sensitive` integer DEFAULT false NOT NULL;--> statement-breakpoint
+-- A version is still only ever erased: its sensitivity with the rest of it.
+DROP TRIGGER `secret_versions_erase_only`;--> statement-breakpoint
+CREATE TRIGGER `secret_versions_erase_only` BEFORE UPDATE ON `secret_versions`
+WHEN length(NEW.`ciphertext`) <> 0 OR length(NEW.`wrapped_dek`) <> 0 OR NEW.`plaintext` IS NOT NULL
+    OR NEW.`id` IS NOT OLD.`id` OR NEW.`secret_id` IS NOT OLD.`secret_id` OR NEW.`version` IS NOT OLD.`version`
+    OR NEW.`envelope_version` IS NOT OLD.`envelope_version` OR NEW.`iv` IS NOT OLD.`iv` OR NEW.`auth_tag` IS NOT OLD.`auth_tag`
+    OR NEW.`kek_provider` IS NOT OLD.`kek_provider` OR NEW.`kek_id` IS NOT OLD.`kek_id` OR NEW.`kek_version` IS NOT OLD.`kek_version`
+    OR NEW.`created_at` IS NOT OLD.`created_at` OR NEW.`created_by` IS NOT OLD.`created_by`
+    OR NEW.`recipe` IS NOT OLD.`recipe` OR NEW.`pair_id` IS NOT OLD.`pair_id` OR NEW.`pair_half` IS NOT OLD.`pair_half`
+    OR NEW.`sensitive` IS NOT OLD.`sensitive`
+BEGIN
+    SELECT RAISE(ABORT, 'a secret version is only ever erased');
+END;

package/src/migrations/sqlite/0013_contributor_role.sql

@@ -0,0 +1,28 @@
+-- The Contributor role (0.10): use and write, never read. The role checks widen to it, which the release before never grants.
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_vault_grants` (
+	`principal` text NOT NULL,
+	`project_id` text,
+	`environment_id` text,
+	`environment_slug` text,
+	`role` text NOT NULL,
+	`expires_at` integer,
+	`granted_at` integer NOT NULL,
+	`granted_by` text NOT NULL,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`environment_id`) REFERENCES `environments`(`id`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "vault_grants_one_place" CHECK((("__new_vault_grants"."project_id" IS NULL) <> ("__new_vault_grants"."environment_id" IS NULL) AND "__new_vault_grants"."environment_slug" IS NULL) OR ("__new_vault_grants"."project_id" IS NULL AND "__new_vault_grants"."environment_id" IS NULL)),
+	CONSTRAINT "vault_grants_environment_slug_check" CHECK("__new_vault_grants"."environment_slug" IS NULL OR (length("__new_vault_grants"."environment_slug") BETWEEN 1 AND 63 AND "__new_vault_grants"."environment_slug" GLOB '[a-z0-9]*' AND "__new_vault_grants"."environment_slug" NOT GLOB '*[^a-z0-9-]*')),
+	CONSTRAINT "vault_grants_role_check" CHECK("__new_vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'maintainer', 'access-manager', 'auditor', 'owner')),
+	CONSTRAINT "vault_grants_environment_role_check" CHECK(("__new_vault_grants"."environment_id" IS NULL AND "__new_vault_grants"."environment_slug" IS NULL) OR "__new_vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'auditor'))
+);
+--> statement-breakpoint
+INSERT INTO `__new_vault_grants`("principal", "project_id", "environment_id", "environment_slug", "role", "expires_at", "granted_at", "granted_by") SELECT "principal", "project_id", "environment_id", "environment_slug", "role", "expires_at", "granted_at", "granted_by" FROM `vault_grants`;--> statement-breakpoint
+DROP TABLE `vault_grants`;--> statement-breakpoint
+ALTER TABLE `__new_vault_grants` RENAME TO `vault_grants`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_every_project` ON `vault_grants` (`principal`) WHERE "vault_grants"."project_id" IS NULL AND "vault_grants"."environment_id" IS NULL AND "vault_grants"."environment_slug" IS NULL;--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_project` ON `vault_grants` (`principal`,`project_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_environment` ON `vault_grants` (`principal`,`environment_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_environment_slug` ON `vault_grants` (`principal`,`environment_slug`);

package/src/migrations/sqlite/0014_custom_roles.sql

@@ -0,0 +1,27 @@
+-- Roles an Owner makes (0.10): a grant names a role by its id, which the vault's policy defines; which of them an environment may be granted, the vault decides. The checks widen: the release before grants only the roles it ships.
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_vault_grants` (
+	`principal` text NOT NULL,
+	`project_id` text,
+	`environment_id` text,
+	`environment_slug` text,
+	`role` text NOT NULL,
+	`expires_at` integer,
+	`granted_at` integer NOT NULL,
+	`granted_by` text NOT NULL,
+	FOREIGN KEY (`principal`) REFERENCES `vault_members`(`principal`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE restrict,
+	FOREIGN KEY (`environment_id`) REFERENCES `environments`(`id`) ON UPDATE no action ON DELETE restrict,
+	CONSTRAINT "vault_grants_one_place" CHECK((("__new_vault_grants"."project_id" IS NULL) <> ("__new_vault_grants"."environment_id" IS NULL) AND "__new_vault_grants"."environment_slug" IS NULL) OR ("__new_vault_grants"."project_id" IS NULL AND "__new_vault_grants"."environment_id" IS NULL)),
+	CONSTRAINT "vault_grants_environment_slug_check" CHECK("__new_vault_grants"."environment_slug" IS NULL OR (length("__new_vault_grants"."environment_slug") BETWEEN 1 AND 63 AND "__new_vault_grants"."environment_slug" GLOB '[a-z0-9]*' AND "__new_vault_grants"."environment_slug" NOT GLOB '*[^a-z0-9-]*')),
+	CONSTRAINT "vault_grants_role_check" CHECK(length("__new_vault_grants"."role") BETWEEN 2 AND 32 AND "__new_vault_grants"."role" GLOB '[a-z]*' AND "__new_vault_grants"."role" NOT GLOB '*[^a-z0-9-]*')
+);
+--> statement-breakpoint
+INSERT INTO `__new_vault_grants`("principal", "project_id", "environment_id", "environment_slug", "role", "expires_at", "granted_at", "granted_by") SELECT "principal", "project_id", "environment_id", "environment_slug", "role", "expires_at", "granted_at", "granted_by" FROM `vault_grants`;--> statement-breakpoint
+DROP TABLE `vault_grants`;--> statement-breakpoint
+ALTER TABLE `__new_vault_grants` RENAME TO `vault_grants`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_every_project` ON `vault_grants` (`principal`) WHERE "vault_grants"."project_id" IS NULL AND "vault_grants"."environment_id" IS NULL AND "vault_grants"."environment_slug" IS NULL;--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_project` ON `vault_grants` (`principal`,`project_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_environment` ON `vault_grants` (`principal`,`environment_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `vault_grants_on_environment_slug` ON `vault_grants` (`principal`,`environment_slug`);