@coffre/vault 0.10.1 → 0.11.0

package/src/store.ts

@@ -88,10 +88,10 @@ function memberColumns(db: Queryable) {
 }
 
 /** A row as stored: `role` and `scope` as their columns hold them. */
-type StoredMember = Omit<Member, 'role' | 'scope'> & { owner: boolean; role: string | null; scope: string | null };
+export type StoredMember = Omit<Member, 'role' | 'scope'> & { owner: boolean; role: string | null; scope: string | null };
 
 /** A member as their row says (`storedRole`). */
-function memberOf({ owner, role, scope, ...row }: StoredMember): Member {
+export function memberOf({ owner, role, scope, ...row }: StoredMember): Member {
   return { ...row, ...storedRole({ owner, role, scope }) };
 }
 
@@ -308,38 +308,6 @@ export async function everyProjectHolders(db: Queryable): Promise<string[]> {
 
 // --- the log --------------------------------------------------------------------
 
-/** The action of an entry that releases a key, which the bulk limit counts. */
-export const RELEASE = 'secret.read';
-
-/**
- * How many keys the vault has released to `principal` since `after`: one
- * for an entry about one secret, and as many as it lists for one about
- * several (`secrets`), a read logged once per place.
- */
-export async function releasesSince(db: Queryable, principal: string, after: number): Promise<number> {
-  const [{ n }] = await released(db, { principal, after });
-  return Number(n ?? 0);
-}
-
-const released = prepared((db) => {
-  const { auditLog } = tablesOf(db);
-  const listed = engineOf(db) === 'postgres'
-    ? sql`jsonb_array_length((${auditLog.metadata})::jsonb -> 'secrets')`
-    : sql`json_array_length(${auditLog.metadata}, '$.secrets')`;
-  return db
-    .select({ n: sql<string | number | null>`SUM(COALESCE(${listed}, 1))` })
-    .from(auditLog)
-    .where(
-      and(
-        eq(auditLog.author, 'vault'),
-        eq(auditLog.actor, sql.placeholder('principal')),
-        eq(auditLog.action, RELEASE),
-        eq(auditLog.decision, 'allow'),
-        gt(auditLog.occurredAt, sql.placeholder('after')),
-      ),
-    );
-});
-
 /** Rows of the log as the chain's codec reads them: `author` and `decision` are checked by the table. */
 function stored(rows: object[]): StoredEntry[] {
   return rows as StoredEntry[];
@@ -504,8 +472,10 @@ export async function natures(db: Queryable, secretIds: readonly string[]): Prom
 
 /**
  * For each version a rewrap would bring back into its secret, its nature
- * as stored when it is an old value, not the secret's current one; null
- * for the current one, which a mark wraps again with no value changing.
+ * when it is an old value, no looser than it was stored nor than its value
+ * was made since (the newest version of its very ciphertext), not the
+ * secret's current one; null for the current one, which a mark wraps again
+ * with no value changing.
  */
 export async function restoredNatures(
   db: Queryable,
@@ -515,7 +485,11 @@ export async function restoredNatures(
   const { secrets, secretVersions } = tablesOf(db);
   const [current, versions] = await Promise.all([
     db.select({ id: secrets.id, version: secrets.currentVersionId }).from(secrets).where(inArray(secrets.id, [...new Set(items.map((item) => item.secretId))])),
-    db.select({ id: secretVersions.id, sensitive: secretVersions.sensitive, plain: truth(isNotNull(secretVersions.plaintext)) }).from(secretVersions)
+    db.select({
+      id: secretVersions.id,
+      sensitive: sql<boolean | number>`(${secretVersions.sensitive} OR (${heldAs(secretVersions, sql`same.sensitive`)}))`,
+      plain: sql<boolean | number>`(${secretVersions.plaintext} IS NOT NULL AND (${heldAs(secretVersions, sql`same.plaintext IS NOT NULL`)}))`,
+    }).from(secretVersions)
       .where(inArray(secretVersions.id, [...new Set(items.map((item) => item.from))])),
   ]);
   const currentOf = new Map(current.map((row) => [row.id, row.version]));
@@ -698,6 +672,12 @@ export type SecretVersion = {
   current: boolean;
   /** Whether its secret's newest version is sensitive: what a rewrap of it may not loosen. */
   newestSensitive: boolean;
+  /**
+   * Whether its value was made sensitive since: the newest version of its
+   * secret with its very ciphertext, which a mark in place or a restore wraps
+   * again unchanged, is. What a rewrap of it may not loosen either.
+   */
+  heldSensitive: boolean;
 };
 
 export async function versions(db: Queryable, ids: readonly string[]): Promise<SecretVersion[]> {
@@ -723,6 +703,7 @@ export async function versions(db: Queryable, ids: readonly string[]): Promise<S
       // The newest by the versions' own order: the app may write `current_version_id`, never a version.
       newest: sql<number | string>`(SELECT max(newest.version) FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId})`,
       newestSensitive: sql<boolean | number>`(SELECT newest.sensitive FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId} ORDER BY newest.version DESC LIMIT 1)`,
+      heldSensitive: sql<boolean | number>`(${heldAs(secretVersions, sql`same.sensitive`)})`,
     })
     .from(secretVersions)
     .innerJoin(secrets, eq(secrets.id, secretVersions.secretId))
@@ -749,5 +730,15 @@ export async function versions(db: Queryable, ids: readonly string[]): Promise<S
     current: row.currentVersionId === row.id && Number(row.newest) === row.version,
     // SQLite answers a subquery's boolean as a number.
     newestSensitive: Boolean(row.newestSensitive),
+    heldSensitive: Boolean(row.heldSensitive),
   }));
 }
+
+/**
+ * `column` of the newest version of a version's secret with its very ciphertext: its value, as it is held now. Known
+ * by its IV and tag, which under one data key name one ciphertext, and which, unlike the ciphertext, no erasure empties.
+ */
+function heldAs(secretVersions: ReturnType<typeof tablesOf>['secretVersions'], column: SQL): SQL {
+  return sql`SELECT ${column} FROM secret_versions same WHERE same.secret_id = ${secretVersions.secretId}
+    AND same.iv = ${secretVersions.iv} AND same.auth_tag = ${secretVersions.authTag} ORDER BY same.version DESC LIMIT 1`;
+}