@coffre/db 0.9.0 → 0.10.0

package/src/migrations/sqlite/meta/_journal.json

@@ -85,6 +85,27 @@
       "when": 1792317461299,
       "tag": "0011_plain_values",
       "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1792340920098,
+      "tag": "0012_sensitive_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1792343374795,
+      "tag": "0013_contributor_role",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1792345777255,
+      "tag": "0014_custom_roles",
+      "breakpoints": true
     }
   ]
 }

package/src/schema.sqlite.ts

@@ -1,4 +1,3 @@
-import { assignableToEnvironment, ROLE_NAMES } from '@coffre/core/access';
 import { sql } from 'drizzle-orm';
 import {
   blob,
@@ -182,6 +181,11 @@ export const secretVersions = sqliteTable(
     // the vault. Null for a secret. Its ciphertext is kept as any version's,
     // for what opens values through the vault (a reference, a fork's copy).
     plaintext: text(),
+    // A sensitive value: never handed back to a person, Owners included, only
+    // used for them through the credential proxy, or read by a service
+    // account. Its data key's wrap binds it, so the vault opens a version
+    // flipped back as nothing. Never plain too.
+    sensitive: flag('sensitive').notNull().default(false),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -221,9 +225,6 @@ export const dismissedKeys = sqliteTable(
   ],
 );
 
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
-
 export const vaultMembers = sqliteTable(
   'vault_members',
   {
@@ -275,11 +276,9 @@ export const vaultGrants = sqliteTable(
       sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`,
     ),
     check('vault_grants_environment_slug_check', sql`${table.environmentSlug} IS NULL OR (${isSlug(table.environmentSlug, 63)})`),
-    check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
-    check(
-      'vault_grants_environment_role_check',
-      sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`,
-    ),
+    // A role's id, one that ships or one an Owner made (`ROLE_ID`): which the instance's policy defines, and which of them an
+    // environment may be granted, the vault decides, as the policy is now (docs/design/roles.md).
+    check('vault_grants_role_check', sql`length(${table.role}) BETWEEN 2 AND 32 AND ${table.role} GLOB '[a-z]*' AND ${table.role} NOT GLOB '*[^a-z0-9-]*'`),
     unique('vault_grants_on_project').on(table.principal, table.projectId),
     unique('vault_grants_on_environment').on(table.principal, table.environmentId),
     unique('vault_grants_on_environment_slug').on(table.principal, table.environmentSlug),

package/src/schema.ts

@@ -1,4 +1,3 @@
-import { assignableToEnvironment, ROLE_NAMES } from '@coffre/core/access';
 import { sql } from 'drizzle-orm';
 import {
   bigint,
@@ -176,6 +175,11 @@ export const secretVersions = pgTable(
     // the vault. Null for a secret. Its ciphertext is kept as any version's,
     // for what opens values through the vault (a reference, a fork's copy).
     plaintext: text(),
+    // A sensitive value: never handed back to a person, Owners included, only
+    // used for them through the credential proxy, or read by a service
+    // account. Its data key's wrap binds it, so the vault opens a version
+    // flipped back as nothing. Never plain too.
+    sensitive: boolean().notNull().default(false),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -219,10 +223,6 @@ export const dismissedKeys = pgTable(
   ],
 );
 
-/** The role catalogue, as SQL: every role, and those an environment may be granted. */
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
-
 /**
  * The vault's member directory: everyone it has admitted, written by the
  * vault alone, read by both. A principal with no row is no member.
@@ -294,11 +294,9 @@ export const vaultGrants = pgTable(
       sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`,
     ),
     check('vault_grants_environment_slug_check', sql`${table.environmentSlug} IS NULL OR ${table.environmentSlug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
-    check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
-    check(
-      'vault_grants_environment_role_check',
-      sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`,
-    ),
+    // A role's id, one that ships or one an Owner made (`ROLE_ID`): which the instance's policy defines, and which of them an
+    // environment may be granted, the vault decides, as the policy is now (docs/design/roles.md).
+    check('vault_grants_role_check', sql`${table.role} ~ '^[a-z][a-z0-9-]{1,31}$'`),
     unique('vault_grants_on_project').on(table.principal, table.projectId),
     unique('vault_grants_on_environment').on(table.principal, table.environmentId),
     unique('vault_grants_on_environment_slug').on(table.principal, table.environmentSlug),