@coffre/vault 0.1.11 → 0.1.12

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-DfviNOts.js";
+import { n as prepareVault, t as openVault } from "./vault-DTHHQw9L.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-DfviNOts.js";
+import { n as prepareVault, t as openVault } from "./vault-DTHHQw9L.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{vault-DfviNOts.js → vault-DTHHQw9L.js}

@@ -2,7 +2,7 @@ import { ACCESS_ACTIONS, checkpointMessage, describeAccessFault, verifyCheckpoin
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { tablesOf } from "@coffre/db";
-import { allows, assignableToEnvironment, isRole, isSyncPrincipal, mayManageAccess } from "@coffre/core/access";
+import { allows, assignableToEnvironment, isRole, mayManageAccess } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
 import { checkContext } from "@coffre/core/envelope";
 import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation } from "@coffre/db/dialect";
@@ -819,6 +819,7 @@ const KEY_BUDGET_MS = 5e3;
 /** How long a decision waits for a lock: above the key budget, so a removal outwaits a read in flight. */
 const LOCK_TIMEOUT_MS = 15e3;
 const PRINCIPAL = /^(user|token|sync):[^\s:][^\s]*$/;
+const LIVE_PRINCIPAL = /^(user|token):[^\s:][^\s]*$/;
 /** Who acts for the vault itself, as when it gives a root admin a member row. */
 const VAULT_ACTOR = "system:vault";
 /** How many stored keys a KEK with no check yet is tried on: one that opens proves it. */
@@ -1518,6 +1519,14 @@ var VaultService = class {
 			fault,
 			stored: grants$1
 		};
+		if (!LIVE_PRINCIPAL.test(principal)) return {
+			principal,
+			status: "unknown",
+			live: none,
+			all: none,
+			fault,
+			stored: grants$1
+		};
 		if (row?.status !== "active") return {
 			principal,
 			status: row?.status ?? "unknown",
@@ -1559,10 +1568,10 @@ var VaultService = class {
 			since: null,
 			by: null
 		};
-		const active = !tampered && row?.status === "active";
+		const active = LIVE_PRINCIPAL.test(principal) && !tampered && row?.status === "active";
 		return {
 			principal,
-			status: tampered ? "tampered" : row?.status ?? "unknown",
+			status: tampered ? "tampered" : !LIVE_PRINCIPAL.test(principal) ? "unknown" : row?.status ?? "unknown",
 			generation: row?.generation ?? 0,
 			isRootAdmin: false,
 			isOwner: active && row.owner && principal.startsWith("user:"),
@@ -1637,7 +1646,7 @@ var VaultService = class {
 		}]);
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
-			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a principal: ${principal}`);
+			if (!LIVE_PRINCIPAL.test(principal)) throw refused("invalid", `not a principal: ${principal}`);
 			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			const places$1 = /* @__PURE__ */ new Set();
 			for (const change of input.changes) {
@@ -1653,28 +1662,12 @@ var VaultService = class {
 			for (const { projectId, environmentId } of input.changes) if (!known.projects.has(projectId) || environmentId !== null && known.environments.get(environmentId) !== projectId) throw refused("invalid", `no such place: ${environmentId === null ? projectId : `${projectId}/${environmentId}`}`);
 			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
 			if (acting.status === "tampered") throw refused("tampered");
-			if (!input.changes.every((change) => mayManageAccess(acting.live, principal, change))) throw refused("not_allowed");
+			if (!input.changes.every((change) => mayManageAccess(acting.live, change))) throw refused("not_allowed");
 			const row = d.members.get(principal);
 			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			if (row?.status === "removed") throw refused("removed");
-			if (row === void 0) {
-				if (!isSyncPrincipal(principal) || input.changes.every((change) => change.role === null)) throw refused("not_a_member");
-				d.log.push(accessEntry(actor, "member.add", principal, "allow", input, { owner: false }));
-				d.writes.push(async (at) => {
-					await insertMember(d.tx, {
-						principal,
-						status: "active",
-						owner: false,
-						generation: 0,
-						createdAt: at,
-						createdBy: actor,
-						statusChangedAt: at,
-						statusChangedBy: actor,
-						...UNSEALED
-					});
-				});
-			}
+			if (row === void 0) throw refused("not_a_member");
 			const held = subject.stored;
 			d.grants.set(principal, [...held]);
 			const changes = input.changes.map((change) => this.#apply(d, actor, principal, held, change, input));
@@ -1738,7 +1731,7 @@ var VaultService = class {
 			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
 			if (acting.status === "tampered") throw refused("tampered");
 			if (!acting.live.isOwner) throw refused("not_allowed", "only owners may add or restore members");
-			if (!PRINCIPAL.test(principal) || isSyncPrincipal(principal)) throw refused("invalid", `not a member: ${principal}`);
+			if (!LIVE_PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${principal}`);
 			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			if (input.owner === true && !principal.startsWith("user:")) throw refused("invalid", "service accounts cannot be owners");
 			const row = d.members.get(principal);
@@ -1792,6 +1785,7 @@ var VaultService = class {
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.remove", principal, "deny", input, {}, code)]);
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
+			if (!LIVE_PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${principal}`);
 			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			const row = d.members.get(principal);
 			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
@@ -1803,11 +1797,7 @@ var VaultService = class {
 				if (!holder.isOwner) throw refused("not_allowed", "only owners may remove a member whose record failed its check");
 				return this.#startOver(d, actor, principal, row, subject.fault, input, refused);
 			}
-			const places = input.source === void 0 ? held : [...held, input.source];
-			if (!(holder.isOwner || isSyncPrincipal(principal) && (held.length === 0 || places.some((place) => mayManageAccess(holder, principal, {
-				...place,
-				role: null
-			}))))) throw refused("not_allowed", "only owners may remove members");
+			if (!holder.isOwner) throw refused("not_allowed", "only owners may remove members");
 			if (row?.status !== "active") throw refused(row === void 0 ? "not_a_member" : "removed");
 			const revoked = held.filter((grant) => live(grant, d.at));
 			for (const grant of revoked) d.log.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/db": "0.1.11",
-    "@coffre/core": "0.1.11"
+    "@coffre/core": "0.1.12",
+    "@coffre/db": "0.1.12"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/vault.ts

@@ -4,7 +4,6 @@ import {
   allows,
   assignableToEnvironment,
   isRole,
-  isSyncPrincipal,
   mayManageAccess,
   type Holdings,
   type Permission,
@@ -149,7 +148,9 @@ const KEY_BUDGET_MS = 5_000;
 /** How long a decision waits for a lock: above the key budget, so a removal outwaits a read in flight. */
 const LOCK_TIMEOUT_MS = 15_000;
 
+// Historical principals remain valid audit subjects and sealed rows.
 const PRINCIPAL = /^(user|token|sync):[^\s:][^\s]*$/;
+const LIVE_PRINCIPAL = /^(user|token):[^\s:][^\s]*$/;
 
 /** Who acts for the vault itself, as when it gives a root admin a member row. */
 const VAULT_ACTOR = 'system:vault';
@@ -937,6 +938,7 @@ class VaultService implements Vault {
     const grants = row === undefined ? [] : await store.grants(db, principal);
     const fault = await this.#integrity(db, principal, row, grants, reports);
     if (fault !== null) return { principal, status: 'tampered', live: none, all: none, fault, stored: grants };
+    if (!LIVE_PRINCIPAL.test(principal)) return { principal, status: 'unknown', live: none, all: none, fault, stored: grants };
     if (row?.status !== 'active') return { principal, status: row?.status ?? 'unknown', live: none, all: none, fault, stored: grants };
     const held = grants.map((grant) => ({ ...grant, role: grant.role as Role }));
     const isOwner = row.owner && principal.startsWith('user:');
@@ -954,10 +956,10 @@ class VaultService implements Vault {
     if (this.#isRootAdmin(principal)) {
       return { principal, status: 'active', generation: row?.generation ?? 0, isRootAdmin: true, isOwner: true, grants: [], since: null, by: null };
     }
-    const active = !tampered && row?.status === 'active';
+    const active = LIVE_PRINCIPAL.test(principal) && !tampered && row?.status === 'active';
     return {
       principal,
-      status: tampered ? 'tampered' : (row?.status ?? 'unknown'),
+      status: tampered ? 'tampered' : !LIVE_PRINCIPAL.test(principal) ? 'unknown' : (row?.status ?? 'unknown'),
       generation: row?.generation ?? 0,
       isRootAdmin: false,
       isOwner: active && row.owner && principal.startsWith('user:'),
@@ -1033,7 +1035,7 @@ class VaultService implements Vault {
       }]);
     return this.#decide([actor, principal], async (d) => {
       validateCorrelation(input);
-      if (!PRINCIPAL.test(principal)) throw refused('invalid', `not a principal: ${principal}`);
+      if (!LIVE_PRINCIPAL.test(principal)) throw refused('invalid', `not a principal: ${principal}`);
       if (this.#isRootAdmin(principal)) throw refused('root_admin');
       const places = new Set<string>();
       for (const change of input.changes) {
@@ -1061,32 +1063,13 @@ class VaultService implements Vault {
       }
       const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
       if (acting.status === 'tampered') throw refused('tampered');
-      if (!input.changes.every((change) => mayManageAccess(acting.live, principal, change))) throw refused('not_allowed');
+      if (!input.changes.every((change) => mayManageAccess(acting.live, change))) throw refused('not_allowed');
 
       const row = d.members.get(principal);
       const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
       if (subject.status === 'tampered') throw refused('tampered', TAMPERED_SUBJECT);
       if (row?.status === 'removed') throw refused('removed');
-      if (row === undefined) {
-        // A sync is a member from its first grant; anyone else is admitted first.
-        if (!isSyncPrincipal(principal) || input.changes.every((change) => change.role === null)) {
-          throw refused('not_a_member');
-        }
-        d.log.push(accessEntry(actor, 'member.add', principal, 'allow', input, { owner: false }));
-        d.writes.push(async (at) => {
-          await store.insertMember(d.tx, {
-            principal,
-            status: 'active',
-            owner: false,
-            generation: 0,
-            createdAt: at,
-            createdBy: actor,
-            statusChangedAt: at,
-            statusChangedBy: actor,
-            ...UNSEALED,
-          });
-        });
-      }
+      if (row === undefined) throw refused('not_a_member');
       // The grants the check verified, not a second read: what the decision changes, and seals.
       const held = subject.stored;
       d.grants.set(principal, [...held]);
@@ -1156,7 +1139,7 @@ class VaultService implements Vault {
       const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
       if (acting.status === 'tampered') throw refused('tampered');
       if (!acting.live.isOwner) throw refused('not_allowed', 'only owners may add or restore members');
-      if (!PRINCIPAL.test(principal) || isSyncPrincipal(principal)) throw refused('invalid', `not a member: ${principal}`);
+      if (!LIVE_PRINCIPAL.test(principal)) throw refused('invalid', `not a member: ${principal}`);
       if (this.#isRootAdmin(principal)) throw refused('root_admin');
       if (input.owner === true && !principal.startsWith('user:')) {
         throw refused('invalid', 'service accounts cannot be owners');
@@ -1208,6 +1191,7 @@ class VaultService implements Vault {
       new Refused(refusal(code, message), [accessEntry(actor, 'member.remove', principal, 'deny', input, {}, code)]);
     return this.#decide([actor, principal], async (d) => {
       validateCorrelation(input);
+      if (!LIVE_PRINCIPAL.test(principal)) throw refused('invalid', `not a member: ${principal}`);
       if (this.#isRootAdmin(principal)) throw refused('root_admin');
       const row = d.members.get(principal);
       const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
@@ -1219,15 +1203,7 @@ class VaultService implements Vault {
         if (!holder.isOwner) throw refused('not_allowed', 'only owners may remove a member whose record failed its check');
         return this.#startOver(d, actor, principal, row, subject.fault!, input, refused);
       }
-      // Owners remove anyone. Removing a sync only takes access away, so
-      // whoever may take away one of its grants, or manage it at its
-      // source, may remove it, and anyone may remove one that holds nothing.
-      const places = input.source === undefined ? held : [...held, input.source];
-      const may =
-        holder.isOwner ||
-        (isSyncPrincipal(principal) &&
-          (held.length === 0 || places.some((place) => mayManageAccess(holder, principal, { ...place, role: null }))));
-      if (!may) throw refused('not_allowed', 'only owners may remove members');
+      if (!holder.isOwner) throw refused('not_allowed', 'only owners may remove members');
       if (row?.status !== 'active') throw refused(row === undefined ? 'not_a_member' : 'removed');
 
       const revoked = held.filter((grant) => live(grant, d.at));