@coffre/db 0.9.0 → 0.10.0

package/dist/migrations/sqlite/meta/_journal.json

@@ -85,6 +85,27 @@
       "when": 1792317461299,
       "tag": "0011_plain_values",
       "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1792340920098,
+      "tag": "0012_sensitive_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1792343374795,
+      "tag": "0013_contributor_role",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1792345777255,
+      "tag": "0014_custom_roles",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { m as schema_d_exports } from "./schema-CCYKTG-E.js";
-import { t as Database } from "./database-hd1hAll-.js";
+import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
+import { t as Database } from "./database-BFnO2b2P.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-CCYKTG-E.d.ts → schema-NBVA9q-s.d.ts}

@@ -731,6 +731,23 @@ declare const secretVersions: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    sensitive: import("drizzle-orm/pg-core").PgColumn<{
+      name: "sensitive";
+      tableName: "secret_versions";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;

package/dist/schema-sqlite.d.ts

@@ -775,6 +775,23 @@ export declare const secretVersions: import("drizzle-orm/sqlite-core").SQLiteTab
     }, {}, {
       length: undefined;
     }>;
+    sensitive: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "secret_versions";
+      dataType: "boolean";
+      columnType: "SQLiteBoolean";
+      data: boolean;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "sqlite";
 }>;

package/dist/schema-sqlite.js

@@ -1,7 +1,6 @@
 import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-BfR3JjT1.js";
 import { asPostgres } from "./portable.js";
 import { sql } from "drizzle-orm";
-import { ROLE_NAMES, assignableToEnvironment } from "@coffre/core/access";
 import { blob, check, customType, foreignKey, index, integer, primaryKey, sqliteTable, text, unique, uniqueIndex } from "drizzle-orm/sqlite-core";
 //#region src/schema.sqlite.ts
 /**
@@ -125,7 +124,8 @@ const secretVersions = sqliteTable("secret_versions", {
 	recipe: text(),
 	pairId: text("pair_id"),
 	pairHalf: text("pair_half"),
-	plaintext: text()
+	plaintext: text(),
+	sensitive: flag("sensitive").notNull().default(false)
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -157,8 +157,6 @@ const dismissedKeys = sqliteTable("dismissed_keys", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
 const vaultMembers = sqliteTable("vault_members", {
 	principal: text().primaryKey(),
 	status: text().notNull(),
@@ -195,8 +193,7 @@ const vaultGrants = sqliteTable("vault_grants", {
 }, (table) => [
 	check("vault_grants_one_place", sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`),
 	check("vault_grants_environment_slug_check", sql`${table.environmentSlug} IS NULL OR (${isSlug(table.environmentSlug, 63)})`),
-	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
-	check("vault_grants_environment_role_check", sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	check("vault_grants_role_check", sql`length(${table.role}) BETWEEN 2 AND 32 AND ${table.role} GLOB '[a-z]*' AND ${table.role} NOT GLOB '*[^a-z0-9-]*'`),
 	unique("vault_grants_on_project").on(table.principal, table.projectId),
 	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
 	unique("vault_grants_on_environment_slug").on(table.principal, table.environmentSlug),

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-hd1hAll-.js";
+import { i as Queryable } from "./database-BFnO2b2P.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -92,6 +92,27 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792317460399,
 			"tag": "0011_plain_values",
 			"breakpoints": true
+		},
+		{
+			"idx": 12,
+			"version": "7",
+			"when": 1792340919452,
+			"tag": "0012_sensitive_values",
+			"breakpoints": true
+		},
+		{
+			"idx": 13,
+			"version": "7",
+			"when": 1792343374226,
+			"tag": "0013_contributor_role",
+			"breakpoints": true
+		},
+		{
+			"idx": 14,
+			"version": "7",
+			"when": 1792345776262,
+			"tag": "0014_custom_roles",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -178,6 +199,27 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792317461299,
 			"tag": "0011_plain_values",
 			"breakpoints": true
+		},
+		{
+			"idx": 12,
+			"version": "6",
+			"when": 1792340920098,
+			"tag": "0012_sensitive_values",
+			"breakpoints": true
+		},
+		{
+			"idx": 13,
+			"version": "6",
+			"when": 1792343374795,
+			"tag": "0013_contributor_role",
+			"breakpoints": true
+		},
+		{
+			"idx": 14,
+			"version": "6",
+			"when": 1792345777255,
+			"tag": "0014_custom_roles",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-CCYKTG-E.js";
+import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-NBVA9q-s.js";
 export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -1,7 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-BfR3JjT1.js";
 import { sql } from "drizzle-orm";
-import { ROLE_NAMES, assignableToEnvironment } from "@coffre/core/access";
 import { bigint, boolean, check, customType, foreignKey, index, integer, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 //#region src/schema.ts
 var schema_exports = /* @__PURE__ */ __exportAll({
@@ -130,7 +129,8 @@ const secretVersions = pgTable("secret_versions", {
 	recipe: text(),
 	pairId: uuid("pair_id"),
 	pairHalf: text("pair_half"),
-	plaintext: text()
+	plaintext: text(),
+	sensitive: boolean().notNull().default(false)
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -169,9 +169,6 @@ const dismissedKeys = pgTable("dismissed_keys", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
-/** The role catalogue, as SQL: every role, and those an environment may be granted. */
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
 /**
 * The vault's member directory: everyone it has admitted, written by the
 * vault alone, read by both. A principal with no row is no member.
@@ -220,8 +217,7 @@ const vaultGrants = pgTable("vault_grants", {
 }, (table) => [
 	check("vault_grants_one_place", sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`),
 	check("vault_grants_environment_slug_check", sql`${table.environmentSlug} IS NULL OR ${table.environmentSlug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
-	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
-	check("vault_grants_environment_role_check", sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	check("vault_grants_role_check", sql`${table.role} ~ '^[a-z][a-z0-9-]{1,31}$'`),
 	unique("vault_grants_on_project").on(table.principal, table.projectId),
 	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
 	unique("vault_grants_on_environment_slug").on(table.principal, table.environmentSlug),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.9.0"
+    "@coffre/core": "0.10.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/grants.ts

@@ -9,6 +9,7 @@ import {
   type Conversion,
   type ConversionInput,
   type InstanceRole,
+  type BuiltinRole,
   type Role,
   type Scope,
 } from '@coffre/core/access';
@@ -129,10 +130,10 @@ export function everyProjectConversion(
     role: person ? role : 'member',
     everyProject: live
       .filter((grant) => grant.projectId === null && grant.environmentId === null)
-      .map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as Role, expiresAt: grant.expiresAt })),
+      .map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as BuiltinRole, expiresAt: grant.expiresAt })),
     grants: live
       .filter((grant) => grant.projectId !== null)
-      .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as Role, expiresAt: grant.expiresAt })),
+      .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as BuiltinRole, expiresAt: grant.expiresAt })),
     projects,
   });
 }

package/src/log.ts

@@ -283,6 +283,22 @@ export async function newestVaultEntries(db: Queryable, action: string, limit: n
   return rows as StoredEntry[];
 }
 
+/**
+ * The number of the newest entry in the vault's name, allowed, of one
+ * `action`, or null for none: whether one was appended since, and nothing
+ * of what it says, so its MAC is not checked. One indexed read.
+ */
+export async function newestVaultSeq(db: Queryable, action: string): Promise<bigint | null> {
+  const { auditLog } = tablesOf(db);
+  const [row] = await db
+    .select({ seq: auditLog.seq })
+    .from(auditLog)
+    .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, action), eq(auditLog.decision, 'allow')))
+    .orderBy(desc(auditLog.seq))
+    .limit(1);
+  return (row?.seq as bigint | undefined) ?? null;
+}
+
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export const LOOK_BACK = { page: 32, pages: 32 };
 

package/src/migrations/postgres/0012_sensitive_values.sql

@@ -0,0 +1,18 @@
+-- Sensitive values (0.10): a version never handed back to a person, which the vault's wrap of its data key binds. Defaults to false, so the release before writes on as it did.
+ALTER TABLE "secret_versions" ADD COLUMN "sensitive" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+-- A version is still only ever erased: its sensitivity with the rest of it.
+CREATE OR REPLACE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0 OR NEW.plaintext IS NOT NULL
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by,
+           NEW.recipe, NEW.pair_id, NEW.pair_half, NEW.sensitive)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by,
+           OLD.recipe, OLD.pair_id, OLD.pair_half, OLD.sensitive) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;

package/src/migrations/postgres/0013_contributor_role.sql

@@ -0,0 +1,5 @@
+-- The Contributor role (0.10): use and write, never read. The role checks widen to it, which the release before never grants.
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_environment_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_role_check" CHECK ("vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'maintainer', 'access-manager', 'auditor', 'owner'));--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_environment_role_check" CHECK (("vault_grants"."environment_id" IS NULL AND "vault_grants"."environment_slug" IS NULL) OR "vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'auditor'));

package/src/migrations/postgres/0014_custom_roles.sql

@@ -0,0 +1,4 @@
+-- Roles an Owner makes (0.10): a grant names a role by its id, which the vault's policy defines; which of them an environment may be granted, the vault decides. The checks widen: the release before grants only the roles it ships.
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_environment_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_role_check" CHECK ("vault_grants"."role" ~ '^[a-z][a-z0-9-]{1,31}$');