@coffre/db 0.9.0 → 0.10.1

package/src/migrations/sqlite/meta/_journal.json

@@ -85,6 +85,27 @@
       "when": 1792317461299,
       "tag": "0011_plain_values",
       "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1792340920098,
+      "tag": "0012_sensitive_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1792343374795,
+      "tag": "0013_contributor_role",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1792345777255,
+      "tag": "0014_custom_roles",
+      "breakpoints": true
     }
   ]
 }

package/src/prepared.ts

@@ -0,0 +1,60 @@
+import type { Query } from 'drizzle-orm';
+
+import { tablesOf, type Queryable } from './database.ts';
+import { engineOf } from './dialect.ts';
+
+/** What Drizzle works out from a select builder before it can run it, once per dialect. */
+type Built = { query: Query; fields: unknown; joinsNotNullableMap: unknown; engine: 'postgres' | 'sqlite' };
+
+/** The part of a select builder `prepared` reads, once. */
+type Select = PromiseLike<unknown> & { toSQL(): Query; prepare(...name: never[]): unknown };
+
+/**
+ * A select built once per process, or once per isolate on Workers, and run
+ * with new values each time. Drizzle rebuilds a query's SQL from its
+ * builder at every run, and that was most of a short query's CPU; this
+ * builds it from `build` the first time a database of its dialect asks,
+ * then hands the SQL and its columns to that call's own session
+ * (`session.prepareQuery`), which binds `values` to the placeholders
+ * (`sql.placeholder`) and maps the rows as the builder would.
+ *
+ * `build` must not depend on anything but the database's dialect, and the
+ * values go to the driver as they are, not through a column's encoding:
+ * strings, numbers, bigints and bytes.
+ *
+ *   const member = prepared((db) => db.select().from(tablesOf(db).vaultMembers).where(eq(…, sql.placeholder('principal'))));
+ *   const [row] = await member(db, { principal });
+ */
+export function prepared<Q extends Select>(
+  build: (db: Queryable) => Q,
+): (db: Queryable, values?: Record<string, unknown>) => Promise<Awaited<Q>> {
+  // By the dialect's tables: one Postgres build, one SQLite build.
+  const builds = new WeakMap<object, Built>();
+  return (db, values = {}) => {
+    const tables = tablesOf(db);
+    let built = builds.get(tables);
+    if (built === undefined) {
+      const builder = build(db);
+      // Drizzle's own preparation, which runs nothing, says which columns come back and which joins may be null.
+      // Unnamed on Postgres: no statement is prepared on the server, whose connections a call does not keep.
+      const { fields, joinsNotNullableMap } = (builder as unknown as { prepare(): { fields: unknown; joinsNotNullableMap: unknown } }).prepare();
+      built = { query: builder.toSQL(), fields, joinsNotNullableMap, engine: engineOf(db) };
+      builds.set(tables, built);
+    }
+    const session = (db as unknown as { session: Session }).session;
+    const query = built.engine === 'sqlite'
+      ? session.prepareQuery(built.query, built.fields, 'all', true)
+      : session.prepareQuery(built.query, built.fields, undefined, true);
+    query.joinsNotNullableMap = built.joinsNotNullableMap;
+    return (built.engine === 'sqlite' ? query.all(values) : query.execute(values)) as Promise<Awaited<Q>>;
+  };
+}
+
+/** Drizzle's session, Postgres's or SQLite's, as `prepared` calls it. */
+type Session = {
+  prepareQuery(query: Query, fields: unknown, nameOrMethod: string | undefined, isResponseInArrayMode: boolean): {
+    joinsNotNullableMap: unknown;
+    execute(values: Record<string, unknown>): Promise<unknown>;
+    all(values: Record<string, unknown>): Promise<unknown>;
+  };
+};

package/src/schema.sqlite.ts

@@ -1,4 +1,3 @@
-import { assignableToEnvironment, ROLE_NAMES } from '@coffre/core/access';
 import { sql } from 'drizzle-orm';
 import {
   blob,
@@ -182,6 +181,11 @@ export const secretVersions = sqliteTable(
     // the vault. Null for a secret. Its ciphertext is kept as any version's,
     // for what opens values through the vault (a reference, a fork's copy).
     plaintext: text(),
+    // A sensitive value: never handed back to a person, Owners included, only
+    // used for them through the credential proxy, or read by a service
+    // account. Its data key's wrap binds it, so the vault opens a version
+    // flipped back as nothing. Never plain too.
+    sensitive: flag('sensitive').notNull().default(false),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -221,9 +225,6 @@ export const dismissedKeys = sqliteTable(
   ],
 );
 
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
-
 export const vaultMembers = sqliteTable(
   'vault_members',
   {
@@ -275,11 +276,9 @@ export const vaultGrants = sqliteTable(
       sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`,
     ),
     check('vault_grants_environment_slug_check', sql`${table.environmentSlug} IS NULL OR (${isSlug(table.environmentSlug, 63)})`),
-    check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
-    check(
-      'vault_grants_environment_role_check',
-      sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`,
-    ),
+    // A role's id, one that ships or one an Owner made (`ROLE_ID`): which the instance's policy defines, and which of them an
+    // environment may be granted, the vault decides, as the policy is now (docs/design/roles.md).
+    check('vault_grants_role_check', sql`length(${table.role}) BETWEEN 2 AND 32 AND ${table.role} GLOB '[a-z]*' AND ${table.role} NOT GLOB '*[^a-z0-9-]*'`),
     unique('vault_grants_on_project').on(table.principal, table.projectId),
     unique('vault_grants_on_environment').on(table.principal, table.environmentId),
     unique('vault_grants_on_environment_slug').on(table.principal, table.environmentSlug),

package/src/schema.ts

@@ -1,4 +1,3 @@
-import { assignableToEnvironment, ROLE_NAMES } from '@coffre/core/access';
 import { sql } from 'drizzle-orm';
 import {
   bigint,
@@ -176,6 +175,11 @@ export const secretVersions = pgTable(
     // the vault. Null for a secret. Its ciphertext is kept as any version's,
     // for what opens values through the vault (a reference, a fork's copy).
     plaintext: text(),
+    // A sensitive value: never handed back to a person, Owners included, only
+    // used for them through the credential proxy, or read by a service
+    // account. Its data key's wrap binds it, so the vault opens a version
+    // flipped back as nothing. Never plain too.
+    sensitive: boolean().notNull().default(false),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -219,10 +223,6 @@ export const dismissedKeys = pgTable(
   ],
 );
 
-/** The role catalogue, as SQL: every role, and those an environment may be granted. */
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(', '));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(', '));
-
 /**
  * The vault's member directory: everyone it has admitted, written by the
  * vault alone, read by both. A principal with no row is no member.
@@ -294,11 +294,9 @@ export const vaultGrants = pgTable(
       sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`,
     ),
     check('vault_grants_environment_slug_check', sql`${table.environmentSlug} IS NULL OR ${table.environmentSlug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
-    check('vault_grants_role_check', sql`${table.role} IN (${ROLES})`),
-    check(
-      'vault_grants_environment_role_check',
-      sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`,
-    ),
+    // A role's id, one that ships or one an Owner made (`ROLE_ID`): which the instance's policy defines, and which of them an
+    // environment may be granted, the vault decides, as the policy is now (docs/design/roles.md).
+    check('vault_grants_role_check', sql`${table.role} ~ '^[a-z][a-z0-9-]{1,31}$'`),
     unique('vault_grants_on_project').on(table.principal, table.projectId),
     unique('vault_grants_on_environment').on(table.principal, table.environmentId),
     unique('vault_grants_on_environment_slug').on(table.principal, table.environmentSlug),