@coffre/db 0.8.2 → 0.10.0

package/src/migrations/sqlite/meta/_journal.json

@@ -71,6 +71,41 @@
       "when": 1792281880190,
       "tag": "0009_handles",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "6",
+      "when": 1792315000277,
+      "tag": "0010_handle_places",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1792317461299,
+      "tag": "0011_plain_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1792340920098,
+      "tag": "0012_sensitive_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1792343374795,
+      "tag": "0013_contributor_role",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1792345777255,
+      "tag": "0014_custom_roles",
+      "breakpoints": true
     }
   ]
 }

package/src/schema.sqlite.ts

@@ -1,4 +1,3 @@
-import { assignableToEnvironment, ROLE_NAMES } from '@coffre/core/access';
 import { sql } from 'drizzle-orm';
 import {
   blob,
@@ -177,6 +176,16 @@ export const secretVersions = sqliteTable(
     // and each says which half it holds: 'private' or 'public'.
     pairId: text('pair_id'),
     pairHalf: text('pair_half'),
+    // The value itself, for a plain one: a key marked not secret, an account's
+    // id, which whoever lists the environment sees and a read serves without
+    // the vault. Null for a secret. Its ciphertext is kept as any version's,
+    // for what opens values through the vault (a reference, a fork's copy).
+    plaintext: text(),
+    // A sensitive value: never handed back to a person, Owners included, only
+    // used for them through the credential proxy, or read by a service
+    // account. Its data key's wrap binds it, so the vault opens a version
+    // flipped back as nothing. Never plain too.
+    sensitive: flag('sensitive').notNull().default(false),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -216,9 +225,6 @@ export const dismissedKeys = sqliteTable(
   ],
 );
 
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
-
 export const vaultMembers = sqliteTable(
   'vault_members',
   {
@@ -270,11 +276,9 @@ export const vaultGrants = sqliteTable(
       sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`,
     ),
     check('vault_grants_environment_slug_check', sql`${table.environmentSlug} IS NULL OR (${isSlug(table.environmentSlug, 63)})`),
-    check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
-    check(
-      'vault_grants_environment_role_check',
-      sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`,
-    ),
+    // A role's id, one that ships or one an Owner made (`ROLE_ID`): which the instance's policy defines, and which of them an
+    // environment may be granted, the vault decides, as the policy is now (docs/design/roles.md).
+    check('vault_grants_role_check', sql`length(${table.role}) BETWEEN 2 AND 32 AND ${table.role} GLOB '[a-z]*' AND ${table.role} NOT GLOB '*[^a-z0-9-]*'`),
     unique('vault_grants_on_project').on(table.principal, table.projectId),
     unique('vault_grants_on_environment').on(table.principal, table.environmentId),
     unique('vault_grants_on_environment_slug').on(table.principal, table.environmentSlug),
@@ -671,6 +675,8 @@ export const credentials = sqliteTable(
     identityId: text('identity_id'),
     // What a service or personal token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
     scope: text(),
+    // The environments a handle was made for, by id, each with whether it was asked for as `@me`, JSON: null for any other credential, or a handle of 0.8.
+    places: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),

package/src/schema.ts

@@ -1,4 +1,3 @@
-import { assignableToEnvironment, ROLE_NAMES } from '@coffre/core/access';
 import { sql } from 'drizzle-orm';
 import {
   bigint,
@@ -171,6 +170,16 @@ export const secretVersions = pgTable(
     // and each says which half it holds: 'private' or 'public'.
     pairId: uuid('pair_id'),
     pairHalf: text('pair_half'),
+    // The value itself, for a plain one: a key marked not secret, an account's
+    // id, which whoever lists the environment sees and a read serves without
+    // the vault. Null for a secret. Its ciphertext is kept as any version's,
+    // for what opens values through the vault (a reference, a fork's copy).
+    plaintext: text(),
+    // A sensitive value: never handed back to a person, Owners included, only
+    // used for them through the credential proxy, or read by a service
+    // account. Its data key's wrap binds it, so the vault opens a version
+    // flipped back as nothing. Never plain too.
+    sensitive: boolean().notNull().default(false),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -214,10 +223,6 @@ export const dismissedKeys = pgTable(
   ],
 );
 
-/** The role catalogue, as SQL: every role, and those an environment may be granted. */
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
-
 /**
  * The vault's member directory: everyone it has admitted, written by the
  * vault alone, read by both. A principal with no row is no member.
@@ -289,11 +294,9 @@ export const vaultGrants = pgTable(
       sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`,
     ),
     check('vault_grants_environment_slug_check', sql`${table.environmentSlug} IS NULL OR ${table.environmentSlug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
-    check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
-    check(
-      'vault_grants_environment_role_check',
-      sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`,
-    ),
+    // A role's id, one that ships or one an Owner made (`ROLE_ID`): which the instance's policy defines, and which of them an
+    // environment may be granted, the vault decides, as the policy is now (docs/design/roles.md).
+    check('vault_grants_role_check', sql`${table.role} ~ '^[a-z][a-z0-9-]{1,31}$'`),
     unique('vault_grants_on_project').on(table.principal, table.projectId),
     unique('vault_grants_on_environment').on(table.principal, table.environmentId),
     unique('vault_grants_on_environment_slug').on(table.principal, table.environmentSlug),
@@ -745,6 +748,8 @@ export const credentials = pgTable(
     identityId: uuid('identity_id'),
     // What a service or personal token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
     scope: text(),
+    // The environments a handle was made for, by id, each with whether it was asked for as `@me`, JSON: null for any other credential, or a handle of 0.8.
+    places: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),