@coffre/vault 0.14.3 → 0.14.4

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-NM5NsYFs.js";
-import { n as prepareVault, t as openVault } from "./vault-B4IivgU8.js";
+import { n as prepareVault, t as openVault } from "./vault-BBdXsny3.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-NM5NsYFs.js";
-import { n as prepareVault, t as openVault } from "./vault-B4IivgU8.js";
+import { n as prepareVault, t as openVault } from "./vault-BBdXsny3.js";
 import { isUnavailable } from "@coffre/db/dialect";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";

package/dist/{vault-B4IivgU8.js → vault-BBdXsny3.js}

@@ -1216,17 +1216,16 @@ function snapshotQuery$1(asked) {
         WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq = ANY(${references})
       ),
       'released', ${released === void 0 ? sql`0` : sql`(
-          SELECT count(DISTINCT key) FROM (
-            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
-            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
-            SELECT coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq) FROM audit_log e
-            -- Each item of a list, never what lax paths would make of an object; silent, as strict paths fail on what is missing.
-            LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
-            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
-              AND e.occurred_at > ${NOW$1} + ${released.clockOffsetMs} - ${released.windowMs}
-            UNION ALL SELECT unnest(${sql.param([...released.keys])}::text[])
-          ) AS released (key)
-        )`}
+          -- The keys released within the window, but those asked for, up to one past the cap: a row for each key the
+          -- principal was ever released, however many reads of them the log holds (vault_releases, which the database
+          -- keeps from it). The bound is a subquery, evaluated once: clock_timestamp() alone is volatile, and runs a row.
+          SELECT count(*) FROM (
+            SELECT 1 FROM vault_releases
+            WHERE principal = ${released.principal} AND released_at > (SELECT ${NOW$1} + ${released.clockOffsetMs} - ${released.windowMs})
+              AND key <> ALL(${sql.param([...released.keys])}::text[])
+            LIMIT ${released.cap + 1}
+          ) AS before
+        ) + (SELECT count(DISTINCT key) FROM unnest(${sql.param([...released.keys])}::text[]) AS asked (key))`}
     ) AS snapshot`;
 }
 //#endregion
@@ -1307,17 +1306,14 @@ function snapshotQuery(asked) {
         WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq IN (SELECT value FROM json_each(${references}))
       )),
       'released', ${released === void 0 ? sql`0` : sql`(
-          SELECT count(DISTINCT key) FROM (
-            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
-            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
-            SELECT coalesce(e.secret_id, CASE WHEN one.type = 'object' AND json_type(one.value, '$.secretId') = 'text' THEN json_extract(one.value, '$.secretId') END, 'entry:' || e.seq) AS key
-            FROM audit_log e
-            LEFT JOIN json_each(CASE WHEN e.secret_id IS NULL AND json_type(e.metadata, '$.secrets') = 'array' THEN e.metadata END, '$.secrets') AS one
-            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
-              AND e.occurred_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
-            UNION ALL SELECT value FROM json_each(${JSON.stringify(released.keys)})
+          -- The keys released within the window, but those asked for, up to one past the cap (snapshot.postgres.ts).
+          SELECT count(*) FROM (
+            SELECT 1 FROM vault_releases
+            WHERE principal = ${released.principal} AND released_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
+              AND key NOT IN (SELECT value FROM json_each(${JSON.stringify(released.keys)}))
+            LIMIT ${released.cap + 1}
           )
-        )`}
+        ) + (SELECT count(DISTINCT value) FROM json_each(${JSON.stringify(released.keys)}))`}
     ) AS snapshot`;
 }
 //#endregion
@@ -2008,7 +2004,8 @@ var VaultService = class {
 			...released === void 0 ? {} : { released: {
 				...released,
 				windowMs: this.#config.bulkLimit.windowMs,
-				clockOffsetMs: this.#prepared.options.clockOffset()
+				clockOffsetMs: this.#prepared.options.clockOffset(),
+				cap: this.#config.bulkLimit.count
 			} }
 		});
 	}
@@ -4057,9 +4054,9 @@ var VaultService = class {
 		const { wrongKek, logKeys } = this.#prepared;
 		const { walks } = this.#prepared.options;
 		const found = [];
-		let seen = null;
+		let seen;
 		const resumed = await this.#db.transaction(async (tx) => {
-			seen = (await newestCheckpointEntry(tx))?.seq ?? null;
+			seen = await newestCheckpointEntry(tx);
 			await this.#sweep(tx, found);
 			const from = await this.#resume(tx, "newest");
 			if (!from.ok) return from;
@@ -4111,10 +4108,14 @@ var VaultService = class {
 				reason: scrub.reason
 			});
 			const newest = latest === void 0 ? null : JSON.parse(latest.metadata);
-			if (stalled !== null || ((await newestCheckpointEntry(d.tx))?.seq ?? null) !== seen) {
+			if (stalled !== null || ((await newestCheckpointEntry(d.tx))?.seq ?? null) !== (seen?.seq ?? null)) {
 				const standing = await this.#standingRefusal(d.tx);
 				if (standing !== null) throw refused("log_broken", standing);
 				if (stalled === null && newest !== null) return { checkpoint: signedPart(newest) };
+			} else if (seen?.decision === "deny" && walked.ok) {
+				const standing = await this.#standingRefusal(d.tx);
+				const named = typeof standing?.failedAtSeq === "number" ? BigInt(standing.failedAtSeq) : null;
+				if (named !== null && named <= walked.from.at.seq && !await this.#entryHolds(d.tx, named)) throw refused("log_broken", standing);
 			}
 			if (newest !== null && latest.seq === head.nextSeq - 1n && latest.relatedSeq === latest.seq - 1n) return { checkpoint: signedPart(newest) };
 			if (newest !== null && !await carries(d.tx, newest)) throw refused("log_broken", { reason: `the log up to entry ${newest.seq} is not the prefix the last checkpoint signed` });
@@ -4252,6 +4253,30 @@ var VaultService = class {
 		};
 	}
 	/**
+	* Whether entry `seq` is as the walk checks each: there, its hash its
+	* own, linked to the entry before, and the vault's under its MAC; and the
+	* entry after it, if any, linked to it, for a refusal can name either side
+	* of a broken link (`forward`, at the end of a batch).
+	*/
+	async #entryHolds(db, seq) {
+		const found = await entriesAt(db, seq === 0n ? [seq, seq + 1n] : [
+			seq - 1n,
+			seq,
+			seq + 1n
+		]);
+		const entry = found.get(seq);
+		const before = seq === 0n ? { hash: GENESIS_HASH } : found.get(seq - 1n);
+		if (entry === void 0 || before === void 0) return false;
+		const after = found.get(seq + 1n);
+		if (after !== void 0 && !after.prevHash.equals(entry.hash)) return false;
+		return verifyEntries([entry], {
+			keys: this.#keysFor(entry),
+			chainOnly: ["app"],
+			startSeq: seq,
+			startPrevHash: before.hash
+		}).ok;
+	}
+	/**
 	* The newest refusal for a broken log since the newest checkpoint was
 	* signed, by the vault's MAC, as it said: it stands, for every
 	* verification and checkpoint, until a checkpoint is signed, which takes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.14.3",
+  "version": "0.14.4",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.14.3",
-    "@coffre/db": "0.14.3"
+    "@coffre/core": "0.14.4",
+    "@coffre/db": "0.14.4"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/snapshot.postgres.ts

@@ -82,16 +82,15 @@ export function snapshotQuery(asked: Asked): SQL {
       'released', ${released === undefined
         ? sql`0`
         : sql`(
-          SELECT count(DISTINCT key) FROM (
-            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
-            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
-            SELECT coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq) FROM audit_log e
-            -- Each item of a list, never what lax paths would make of an object; silent, as strict paths fail on what is missing.
-            LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
-            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
-              AND e.occurred_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
-            UNION ALL SELECT unnest(${sql.param([...released.keys])}::text[])
-          ) AS released (key)
-        )`}
+          -- The keys released within the window, but those asked for, up to one past the cap: a row for each key the
+          -- principal was ever released, however many reads of them the log holds (vault_releases, which the database
+          -- keeps from it). The bound is a subquery, evaluated once: clock_timestamp() alone is volatile, and runs a row.
+          SELECT count(*) FROM (
+            SELECT 1 FROM vault_releases
+            WHERE principal = ${released.principal} AND released_at > (SELECT ${NOW} + ${released.clockOffsetMs} - ${released.windowMs})
+              AND key <> ALL(${sql.param([...released.keys])}::text[])
+            LIMIT ${released.cap + 1}
+          ) AS before
+        ) + (SELECT count(DISTINCT key) FROM unnest(${sql.param([...released.keys])}::text[]) AS asked (key))`}
     ) AS snapshot`;
 }

package/src/snapshot.sqlite.ts

@@ -88,16 +88,13 @@ export function snapshotQuery(asked: Asked): SQL {
       'released', ${released === undefined
         ? sql`0`
         : sql`(
-          SELECT count(DISTINCT key) FROM (
-            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
-            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
-            SELECT coalesce(e.secret_id, CASE WHEN one.type = 'object' AND json_type(one.value, '$.secretId') = 'text' THEN json_extract(one.value, '$.secretId') END, 'entry:' || e.seq) AS key
-            FROM audit_log e
-            LEFT JOIN json_each(CASE WHEN e.secret_id IS NULL AND json_type(e.metadata, '$.secrets') = 'array' THEN e.metadata END, '$.secrets') AS one
-            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
-              AND e.occurred_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
-            UNION ALL SELECT value FROM json_each(${JSON.stringify(released.keys)})
+          -- The keys released within the window, but those asked for, up to one past the cap (snapshot.postgres.ts).
+          SELECT count(*) FROM (
+            SELECT 1 FROM vault_releases
+            WHERE principal = ${released.principal} AND released_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
+              AND key NOT IN (SELECT value FROM json_each(${JSON.stringify(released.keys)}))
+            LIMIT ${released.cap + 1}
           )
-        )`}
+        ) + (SELECT count(DISTINCT value) FROM json_each(${JSON.stringify(released.keys)}))`}
     ) AS snapshot`;
 }

package/src/snapshot.ts

@@ -49,7 +49,9 @@ export type Snapshot = {
   /**
    * How many distinct keys `asked.released.principal` holds released within
    * its window once it is given `asked.released.keys` too: a key released
-   * again, or asked for again, counts once.
+   * again, or asked for again, counts once. Those released before are
+   * counted up to one past `asked.released.cap`, which is enough to say
+   * whether the read goes past it.
    */
   released: number;
   /** The log's head, locked, with the last entry and the newest `key.rotate`; null unless asked, or held by another. */
@@ -74,9 +76,11 @@ export type Asked = {
   references?: readonly bigint[];
   /**
    * One principal's releases within the last `windowMs` of the clock, moved
-   * on by `clockOffsetMs` as the vault's is, with `keys`, secret ids, besides.
+   * on by `clockOffsetMs` as the vault's is, with `keys`, secret ids, besides;
+   * read from `vault_releases`, which the database keeps from the log, up to
+   * `cap` + 1 of them.
    */
-  released?: { principal: string; keys: readonly string[]; windowMs: number; clockOffsetMs: number };
+  released?: { principal: string; keys: readonly string[]; windowMs: number; clockOffsetMs: number; cap: number };
   /** Lock the log's head first. */
   head?: boolean;
 };

package/src/vault.ts

@@ -498,7 +498,7 @@ class VaultService implements Vault {
       ...rest,
       principals,
       head,
-      ...(released === undefined ? {} : { released: { ...released, windowMs: this.#config.bulkLimit.windowMs, clockOffsetMs: this.#prepared.options.clockOffset() } }),
+      ...(released === undefined ? {} : { released: { ...released, windowMs: this.#config.bulkLimit.windowMs, clockOffsetMs: this.#prepared.options.clockOffset(), cap: this.#config.bulkLimit.count } }),
     });
   }
 
@@ -2578,9 +2578,9 @@ class VaultService implements Vault {
     const { walks } = this.#prepared.options;
     const found: NewEntry[] = [];
     // The newest checkpoint entry, signed or refused, as this call's snapshot found it.
-    let seen: bigint | null = null;
+    let seen: StoredEntry | undefined;
     const resumed = await this.#db.transaction(async (tx) => {
-      seen = (await store.newestCheckpointEntry(tx))?.seq ?? null;
+      seen = await store.newestCheckpointEntry(tx);
       await this.#sweep(tx, found);
       const from = await this.#resume(tx, 'newest');
       if (!from.ok) return from;
@@ -2625,10 +2625,17 @@ class VaultService implements Vault {
       // Another call checkpointed, or refused to, since this one's snapshot, or this one's rehash of the past
       // could not run: what it would sign over is not what it checked. A refusal for a broken log stands,
       // and a checkpoint signed meanwhile is the newest prefix; the next call starts from them.
-      if (stalled !== null || ((await store.newestCheckpointEntry(d.tx))?.seq ?? null) !== seen) {
+      if (stalled !== null || ((await store.newestCheckpointEntry(d.tx))?.seq ?? null) !== (seen?.seq ?? null)) {
         const standing = await this.#standingRefusal(d.tx);
         if (standing !== null) throw refused('log_broken', standing);
         if (stalled === null && newest !== null) return { checkpoint: signedPart(newest) };
+      } else if (seen?.decision === 'deny' && walked.ok) {
+        // A refusal for a broken log stands since this call's snapshot, of an entry before where its walk began, which
+        // it never read: that entry again, as the walk checks each, before anything is signed over it. Still broken,
+        // the refusal stands; whole again, the signature clears it (T104).
+        const standing = await this.#standingRefusal(d.tx);
+        const named = typeof standing?.failedAtSeq === 'number' ? BigInt(standing.failedAtSeq) : null;
+        if (named !== null && named <= walked.from.at.seq && !(await this.#entryHolds(d.tx, named))) throw refused('log_broken', standing!);
       }
       // Nothing since the last one, which signed every entry before its own: it is still the newest prefix.
       if (newest !== null && latest!.seq === head.nextSeq - 1n && latest!.relatedSeq === latest!.seq - 1n) return { checkpoint: signedPart(newest) };
@@ -2722,6 +2729,22 @@ class VaultService implements Vault {
     return { ok: true, next: null };
   }
 
+  /**
+   * Whether entry `seq` is as the walk checks each: there, its hash its
+   * own, linked to the entry before, and the vault's under its MAC; and the
+   * entry after it, if any, linked to it, for a refusal can name either side
+   * of a broken link (`forward`, at the end of a batch).
+   */
+  async #entryHolds(db: Queryable, seq: bigint): Promise<boolean> {
+    const found = await store.entriesAt(db, seq === 0n ? [seq, seq + 1n] : [seq - 1n, seq, seq + 1n]);
+    const entry = found.get(seq);
+    const before = seq === 0n ? { hash: GENESIS_HASH } : found.get(seq - 1n);
+    if (entry === undefined || before === undefined) return false;
+    const after = found.get(seq + 1n);
+    if (after !== undefined && !after.prevHash.equals(entry.hash)) return false;
+    return verifyEntries([entry], { keys: this.#keysFor(entry), chainOnly: ['app'], startSeq: seq, startPrevHash: before.hash }).ok;
+  }
+
   /**
    * The newest refusal for a broken log since the newest checkpoint was
    * signed, by the vault's MAC, as it said: it stands, for every