@coffre/vault 0.9.0 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.9.0",
-    "@coffre/db": "0.9.0"
+    "@coffre/core": "0.10.0",
+    "@coffre/db": "0.10.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/cloudflare.ts

@@ -23,6 +23,7 @@ import type {
   RewrapInput,
   SetAccessInput,
   SetSettingsInput,
+  ChangePolicyInput,
   UnwrapInput,
   Vault,
   VerifyLogInput,
@@ -94,6 +95,8 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   async remove(input: RemoveInput) { return this.#call((vault) => vault.remove(input)); }
   async settings() { return this.#call((vault) => vault.settings()); }
   async setSettings(input: SetSettingsInput) { return this.#call((vault) => vault.setSettings(input)); }
+  async policy() { return this.#call((vault) => vault.policy()); }
+  async changePolicy(input: ChangePolicyInput) { return this.#call((vault) => vault.changePolicy(input)); }
   async checkpoint() { return this.#call((vault) => vault.checkpoint()); }
   async about() { return this.#call((vault) => vault.about()); }
   async keyChecks() { return this.#call((vault) => vault.keyChecks()); }

package/src/config.ts

@@ -28,20 +28,8 @@ export type ResolvedVaultConfig = {
    */
   signingKeys: readonly Uint8Array[];
   bulkLimit: BulkLimit;
-  /** `values` when left out. */
-  people?: People;
 };
 
-/**
- * What a person's reads open (docs/design/credential-proxy.md): `values`,
- * as any member's; or `stand-ins`, where a person, on any credential of
- * theirs (a session, a personal token, an MCP connection), opens values
- * only for coffre to use for them, never to be handed back: the credential
- * proxy injects them, and the deployment's `expose` list names the few it
- * may pass on. Service accounts read values either way.
- */
-export type People = 'values' | 'stand-ins';
-
 /**
  * A key-encryption key: 32 random bytes, base64, and the id envelopes record
  * it under; or one a key service holds, such as `awsKms({ keyArn, … })`.
@@ -76,8 +64,12 @@ export type VaultConfig = {
   signingKey?: string;
   /** At most `count` data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. */
   bulkLimit?: { count: number; windowMinutes: number };
-  /** What a person's reads open (`People`): `values` unless set. */
-  people?: People;
+  /**
+   * @deprecated Gone in 0.10, and refused: each key says who sees it now. Mark
+   * those no person may read sensitive (`coffre mark <env> sensitive`), and
+   * give people read through their roles where they should see values.
+   */
+  people?: 'gone in 0.10: mark keys sensitive (coffre mark <env> sensitive), and let roles say who reads the rest';
 } & Owners;
 
 /**
@@ -146,6 +138,12 @@ function kek(entry: Kek): { provider: KekProvider; signingKey: Buffer | null } {
 
 /** Check a deployment's vault configuration, failing on the first problem. */
 export function resolveVaultConfig(config: VaultConfig): ResolvedVaultConfig {
+  if ('people' in config && config.people !== undefined) {
+    throw new Error(
+      `people is gone in 0.10 (it was ${JSON.stringify(config.people)}): each key says who sees it now. Remove people, mark the keys no person may read sensitive ` +
+        '(coffre mark <env> sensitive, or coffre set <env>/<KEY> --sensitive), and let roles say who reads the rest (docs/design/credential-proxy.md)',
+    );
+  }
   const keks = [config.kek, ...(config.previousKeks ?? [])].map(kek);
   const [current, ...previous] = keks.map((entry) => entry.provider);
   const refs = [current, ...previous].map(({ provider, keyId }) => `${provider}:${keyId}`);
@@ -156,7 +154,6 @@ export function resolveVaultConfig(config: VaultConfig): ResolvedVaultConfig {
     owners: checkOwners(config.owners ?? config.bootstrapOwners ?? config.rootAdmins ?? []),
     signingKeys: signingKeys(config.signingKey, keks),
     bulkLimit: config.bulkLimit === undefined ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit),
-    people: checkPeople(config.people ?? 'values'),
   };
 }
 
@@ -184,10 +181,6 @@ function signingKeys(given: string | undefined, keks: { provider: KekProvider; s
   return [signing, ...derived].filter((key, i, all) => all.findIndex((other) => other.equals(key)) === i);
 }
 
-function checkPeople(people: People): People {
-  if (people !== 'values' && people !== 'stand-ins') throw new Error(`people is 'values' or 'stand-ins'; got ${JSON.stringify(people)}`);
-  return people;
-}
 
 function checkBulkLimit({ count, windowMinutes }: { count: number; windowMinutes: number }): BulkLimit {
   if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0)) {

package/src/index.ts

@@ -3,6 +3,6 @@ export { checkpointMessage, verifyCheckpoint } from '@coffre/core/vault';
 export type { SecretContext } from '@coffre/core/envelope';
 export { awsKms, KekBadClaimError, KekUnavailableError } from '@coffre/core/kek';
 export type { AwsCredentials, AwsKmsOptions, KekProvider, WrappedDek } from '@coffre/core/kek';
-export type { Kek, People, VaultConfig } from './config.ts';
+export type { Kek, VaultConfig } from './config.ts';
 /** The signing key a local KEK stands for, for tools that check the vault's records from outside. */
 export { derivedSigningKey } from './config.ts';

package/src/local.ts

@@ -17,6 +17,8 @@ export const METHODS = [
   'remove',
   'settings',
   'setSettings',
+  'policy',
+  'changePolicy',
   'checkpoint',
   'about',
   'keyChecks',

package/src/store.ts

@@ -451,6 +451,13 @@ export async function endedReferences(db: Queryable, seqs: readonly bigint[]): P
 }
 
 /** The project each environment is in: a holder's ids, checked against each other. */
+/** Whether a project of this id is there, and not deleted. */
+export async function projectLive(db: Queryable, id: string): Promise<boolean> {
+  const { projects } = tablesOf(db);
+  const rows = await db.select({ deleted: truth(tombstone(projects.slug)) }).from(projects).where(eq(projects.id, id));
+  return rows.length > 0 && !rows[0]!.deleted;
+}
+
 export async function projectsOfEnvironments(db: Queryable, ids: readonly string[]): Promise<Map<string, string>> {
   if (ids.length === 0) return new Map();
   const { environments } = tablesOf(db);
@@ -481,6 +488,43 @@ export async function secretsByIds(db: Queryable, ids: readonly string[]): Promi
   return new Map(rows.map(({ project, environment, key, ...row }) => [row.secretId, { ...row, path: `${project}/${environment}/${key}` }]));
 }
 
+/**
+ * Each secret's nature, as its current version has it: plain where its
+ * value is stored as it is, sensitive where it is bound so, and otherwise
+ * secret, as is one with no value of its own.
+ */
+export async function natures(db: Queryable, secretIds: readonly string[]): Promise<Map<string, 'plain' | 'secret' | 'sensitive'>> {
+  if (secretIds.length === 0) return new Map();
+  const { secrets, secretVersions } = tablesOf(db);
+  const rows = await db
+    .select({ id: secrets.id, sensitive: secretVersions.sensitive, plain: truth(isNotNull(secretVersions.plaintext)) })
+    .from(secrets)
+    .innerJoin(secretVersions, eq(secretVersions.id, secrets.currentVersionId))
+    .where(inArray(secrets.id, [...new Set(secretIds)]));
+  return new Map(rows.map((row) => [row.id, Boolean(row.sensitive) ? 'sensitive' : Boolean(row.plain) ? 'plain' : 'secret']));
+}
+
+/**
+ * For each version a rewrap would bring back into its secret, its nature
+ * as stored when it is an old value, not the secret's current one; null
+ * for the current one, which a mark wraps again with no value changing.
+ */
+export async function restoredNatures(
+  db: Queryable,
+  items: readonly { secretId: string; from: string }[],
+): Promise<('plain' | 'secret' | 'sensitive' | null)[]> {
+  if (items.length === 0) return [];
+  const { secrets, secretVersions } = tablesOf(db);
+  const [current, versions] = await Promise.all([
+    db.select({ id: secrets.id, version: secrets.currentVersionId }).from(secrets).where(inArray(secrets.id, [...new Set(items.map((item) => item.secretId))])),
+    db.select({ id: secretVersions.id, sensitive: secretVersions.sensitive, plain: truth(isNotNull(secretVersions.plaintext)) }).from(secretVersions)
+      .where(inArray(secretVersions.id, [...new Set(items.map((item) => item.from))])),
+  ]);
+  const currentOf = new Map(current.map((row) => [row.id, row.version]));
+  const natureOf = new Map(versions.map((row) => [row.id, Boolean(row.sensitive) ? 'sensitive' as const : Boolean(row.plain) ? 'plain' as const : 'secret' as const]));
+  return items.map(({ secretId, from }) => (currentOf.get(secretId) === from ? null : natureOf.get(from) ?? 'secret'));
+}
+
 /** The vault's newest entry of any of these actions, allowed, or undefined. */
 export async function latestVaultEntry(db: Queryable, actions: readonly string[]): Promise<StoredEntry | undefined> {
   const { auditLog } = tablesOf(db);
@@ -531,6 +575,31 @@ export async function vaultEntriesOf(
   return stored(rows);
 }
 
+/** Which of these secrets' newest versions are sensitive, by the versions' own order. */
+export async function newestSensitive(db: Queryable, secretIds: readonly string[]): Promise<Set<string>> {
+  if (secretIds.length === 0) return new Set();
+  const { secretVersions } = tablesOf(db);
+  const rows = await db
+    .select({ secretId: secretVersions.secretId })
+    .from(secretVersions)
+    .where(and(
+      inArray(secretVersions.secretId, [...new Set(secretIds)]),
+      eq(secretVersions.sensitive, true),
+      sql`${secretVersions.version} = (SELECT max(newest.version) FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId})`,
+    ));
+  return new Set(rows.map((row) => row.secretId));
+}
+
+/** How many grants name `role`: all of them, or those on environments. */
+export async function grantsNaming(db: Queryable, role: string, filter: { onEnvironments?: boolean } = {}): Promise<number> {
+  const { vaultGrants } = tablesOf(db);
+  const rows = await db
+    .select({ count: sql<number | string>`count(*)` })
+    .from(vaultGrants)
+    .where(and(eq(vaultGrants.role, role), filter.onEnvironments === true ? or(isNotNull(vaultGrants.environmentId), isNotNull(vaultGrants.environmentSlug)) : undefined));
+  return Number(rows[0]?.count ?? 0);
+}
+
 /**
  * A version that still holds its wrapped key. A deleted place's versions are
  * erased, their keys emptied: there is nothing left to open, or to try a
@@ -546,7 +615,16 @@ function sealed(wrappedDek: SQLWrapper): SQL {
  * one, as a read through a reference needs. An erased version outside a
  * deleted place is no version.
  */
-export type SecretVersion = { id: string; secret: SecretRef; wrapped: WrappedKey; deleted: boolean; current: boolean };
+export type SecretVersion = {
+  id: string;
+  /** Its secret, `sensitive` as the version was written. */
+  secret: SecretRef;
+  wrapped: WrappedKey;
+  deleted: boolean;
+  current: boolean;
+  /** Whether its secret's newest version is sensitive: what a rewrap of it may not loosen. */
+  newestSensitive: boolean;
+};
 
 export async function versions(db: Queryable, ids: readonly string[]): Promise<SecretVersion[]> {
   if (ids.length === 0) return [];
@@ -567,8 +645,10 @@ export async function versions(db: Queryable, ids: readonly string[]): Promise<S
       wrappedDek: secretVersions.wrappedDek,
       deleted: truth(or(tombstone(environments.slug), tombstone(projects.slug))!),
       currentVersionId: secrets.currentVersionId,
+      sensitive: secretVersions.sensitive,
       // The newest by the versions' own order: the app may write `current_version_id`, never a version.
       newest: sql<number | string>`(SELECT max(newest.version) FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId})`,
+      newestSensitive: sql<boolean | number>`(SELECT newest.sensitive FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId} ORDER BY newest.version DESC LIMIT 1)`,
     })
     .from(secretVersions)
     .innerJoin(secrets, eq(secrets.id, secretVersions.secretId))
@@ -584,6 +664,7 @@ export async function versions(db: Queryable, ids: readonly string[]): Promise<S
       secretId: row.secretId,
       version: row.version,
       path: `${row.project}/${row.environment}/${row.key}`,
+      sensitive: row.sensitive,
     },
     wrapped: {
       kekProvider: row.kekProvider,
@@ -592,5 +673,7 @@ export async function versions(db: Queryable, ids: readonly string[]): Promise<S
       bytes: row.wrappedDek.toString('base64'),
     },
     current: row.currentVersionId === row.id && Number(row.newest) === row.version,
+    // SQLite answers a subquery's boolean as a number.
+    newestSensitive: Boolean(row.newestSensitive),
   }));
 }