@hollware/server 0.9.1 → 0.11.0

package/dist/{store-C2hiR0yd.mjs → store-DjA9s95l.mjs}

@@ -1,5 +1,5 @@
 import { newId } from "@hollware/core";
-import { and, eq, gt, isNull, sql } from "drizzle-orm";
+import { and, eq, gt, isNull, lte, sql } from "drizzle-orm";
 import { check, foreignKey, index, integer, sqliteTable, text, unique, uniqueIndex } from "drizzle-orm/sqlite-core";
 //#region src/auth/roles.ts
 /**
@@ -189,6 +189,11 @@ const entries = sqliteTable("entries", {
 	publishedAt: text("published_at"),
 	publishedSortKey: text("published_sort_key"),
 	scheduledAt: text("scheduled_at"),
+	/**
+	* When the entry went to the trash, or null. A trashed entry keeps its row, its slug and its
+	* translation group: only a draft goes there, and it comes back as the draft it was.
+	*/
+	deletedAt: text("deleted_at"),
 	...timestamps()
 }, (t) => [
 	unique("entries_id_site").on(t.id, t.siteId),
@@ -381,14 +386,16 @@ const schedules = sqliteTable("schedules", {
 /**
 * The effects of a publication (ADR-025), written in the batch that publishes or unpublishes: one
 * row per event. The Queue consumer delivers each event to every subscriber, and records it in
-* `deliveries`; `sent_at` says that the event was put on the Queue.
+* `deliveries`; `sent_at` says that the event was put on the Queue. A change of the structure of
+* the site (ADR-033) is an event too, `site.changed`, about no entry.
 */
 const outbox = sqliteTable("outbox", {
 	id: id("evt"),
 	siteId: siteId(),
-	/** `entry.published` or `entry.unpublished`. */
+	/** `entry.published`, `entry.unpublished`, or `site.changed`. */
 	kind: text("kind").notNull(),
-	entryId: text("entry_id").notNull(),
+	/** The entry of an event about one, and none for `site.changed`. */
+	entryId: text("entry_id"),
 	/** A JSON object: what subscribers get. */
 	payload: text("payload").notNull(),
 	sentAt: text("sent_at"),
@@ -401,7 +408,8 @@ const outbox = sqliteTable("outbox", {
 		columns: [t.siteId],
 		foreignColumns: [sites.id]
 	}),
-	check("outbox_kind", sql`${t.kind} IN ('entry.published', 'entry.unpublished')`),
+	check("outbox_kind", sql`${t.kind} IN ('entry.published', 'entry.unpublished', 'site.changed')`),
+	check("outbox_entry", sql`(${t.kind} = 'site.changed') = (${t.entryId} IS NULL)`),
 	check("outbox_json", sql`json_valid(${t.payload}) AND json_type(${t.payload}) = 'object'`)
 ]);
 /** Each delivery of an event to a subscriber, so that a retry never delivers it twice. */
@@ -680,6 +688,44 @@ const reviewComments = sqliteTable("review_comments", {
 	}),
 	check("review_comments_body", sql`length(${t.body}) BETWEEN 1 AND 4000`)
 ]);
+sqliteTable("audit_log", {
+	id: id("aud"),
+	siteId: siteId(),
+	/** One of `AUDIT_ACTIONS` of `@hollware/core`. */
+	action: text("action").notNull(),
+	outcome: text("outcome").notNull(),
+	/** The code of the error the caller got, when the outcome is not `ok`. */
+	errorCode: text("error_code"),
+	actorKind: text("actor_kind").notNull(),
+	actorUserId: text("actor_user_id"),
+	actorTokenId: text("actor_token_id"),
+	/** The OAuth client a person allowed: its metadata document URL, or its registered id. */
+	actorClientId: text("actor_client_id"),
+	/** What the client said about itself (its MCP client, its model), as JSON: its own claim. */
+	actorMeta: text("actor_meta"),
+	targetType: text("target_type"),
+	targetId: text("target_id"),
+	/** A small object about the change (a role, a label, scopes): never a secret or content. */
+	detail: text("detail"),
+	requestId: text("request_id"),
+	/** HMAC-SHA256 of the address under a key of the site, when the site keeps addresses. */
+	ipHash: text("ip_hash"),
+	...timestamps()
+}, (t) => [
+	unique("audit_log_id_site").on(t.id, t.siteId),
+	index("audit_log_site_time").on(t.siteId, t.createdAt, t.id),
+	index("audit_log_actor").on(t.siteId, t.actorUserId, t.createdAt),
+	index("audit_log_target").on(t.siteId, t.targetType, t.targetId, t.createdAt),
+	foreignKey({
+		name: "audit_log_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	check("audit_log_outcome", sql`${t.outcome} IN ('ok', 'denied', 'failed')`),
+	check("audit_log_actor_kind", sql`${t.actorKind} IN ('user', 'token', 'oauth_client', 'system')`),
+	check("audit_log_json", sql`(${t.actorMeta} IS NULL OR json_valid(${t.actorMeta})) AND (${t.detail} IS NULL OR json_valid(${t.detail}))`),
+	check("audit_log_sizes", sql`length(${t.action}) <= 64 AND (${t.detail} IS NULL OR length(${t.detail}) <= 2000) AND (${t.actorMeta} IS NULL OR length(${t.actorMeta}) <= 2000)`)
+]);
 //#endregion
 //#region src/identity/secrets.ts
 /**
@@ -855,6 +901,33 @@ async function findSession(db, secret, now) {
 	}).from(sessions).innerJoin(users, eq(users.id, sessions.userId)).where(and(eq(sessions.hash, await hashSecret(secret)), gt(sessions.expiresAt, now.toISOString()))).limit(1);
 	return row ?? null;
 }
+/** The passkeys of a person, the oldest first. */
+async function passkeySummaries(db, userId) {
+	return db.select({
+		id: passkeys.id,
+		label: passkeys.label,
+		createdAt: passkeys.createdAt,
+		lastUsedAt: passkeys.lastUsedAt
+	}).from(passkeys).where(eq(passkeys.userId, userId)).orderBy(passkeys.createdAt, passkeys.id);
+}
+/**
+* Removes a passkey of a person (T-54), never their last one: the statement that deletes it counts
+* the person's passkeys in the same step, so two removals at once cannot leave them with none.
+*/
+async function removePasskey(db, input) {
+	if ((await db.prepare(`DELETE FROM passkeys WHERE id = ?1 AND user_id = ?2
+       AND (SELECT count(*) FROM passkeys WHERE user_id = ?2) > 1`).bind(input.id, input.userId).run()).meta.changes === 1) return "removed";
+	return await db.prepare("SELECT 1 AS found FROM passkeys WHERE id = ?1 AND user_id = ?2").bind(input.id, input.userId).first() === null ? "not_found" : "last";
+}
+/** Ends the session of a cookie, whoever's it is: the one browser that holds it signs out. */
+async function endSession(db, secret) {
+	const [ended] = await db.delete(sessions).where(eq(sessions.hash, await hashSecret(secret))).returning({ userId: sessions.userId });
+	return ended?.userId ?? null;
+}
+/** Ends every session of a person (T-44): each browser signs in with a passkey again. */
+async function endSessions(db, userId) {
+	return (await db.delete(sessions).where(eq(sessions.userId, userId)).returning({ id: sessions.id })).length;
+}
 /** The sites a person is a member of, with their role in each, in the order they joined. */
 async function membershipsOf(db, userId) {
 	return (await db.select({
@@ -865,6 +938,15 @@ async function membershipsOf(db, userId) {
 		role: roleOf(row.role)
 	}));
 }
+/**
+* Drops what of sign-in has expired: the sessions, and the WebAuthn challenges that nobody took.
+* Anyone may ask for a challenge (`/auth/signin/options`), so without this the table would grow
+* by a row for every request (T-11 of docs/security/threat-model.md). The cron trigger calls it.
+*/
+async function dropExpired(db, now) {
+	const at = now.toISOString();
+	await db.batch([db.delete(sessions).where(lte(sessions.expiresAt, at)), db.delete(authChallenges).where(lte(authChallenges.expiresAt, at))]);
+}
 /** An invitation by its id, used or not: what a registration redeems. */
 async function invitationById(db, id) {
 	const [row] = await db.select({
@@ -879,4 +961,4 @@ async function invitationById(db, id) {
 	};
 }
 //#endregion
-export { users as A, reviewComments as C, schedules as D, revisions as E, effectiveScopes as M, isRole as N, sites as O, publications as S, revisionTags as T, entries as _, findInvitation as a, members as b, invitationById as c, redeemInvitation as d, saveChallenge as f, deliveries as g, userHandle as h, createUser as i, ROLE_SCOPES as j, tokens as k, membershipsOf as l, touchPasskey as m, createInvitation as n, findPasskey as o, takeChallenge as p, createSession as r, findSession as s, addPasskey as t, passkeysOf as u, entryEmbeddings as v, reviews as w, outbox as x, invitations as y };
+export { revisionTags as A, entryEmbeddings as C, publications as D, outbox as E, users as F, ROLE_SCOPES as I, effectiveScopes as L, schedules as M, sites as N, reviewComments as O, tokens as P, isRole as R, entries as S, members as T, saveChallenge as _, dropExpired as a, userHandle as b, findInvitation as c, invitationById as d, membershipsOf as f, removePasskey as g, redeemInvitation as h, createUser as i, revisions as j, reviews as k, findPasskey as l, passkeysOf as m, createInvitation as n, endSession as o, passkeySummaries as p, createSession as r, endSessions as s, addPasskey as t, findSession as u, takeChallenge as v, invitations as w, deliveries as x, touchPasskey as y };

package/migrations/0013_site_events.sql

@@ -0,0 +1,31 @@
+-- Edited by hand (ADR-023): the outbox takes the events of a change of a site's structure
+-- (`site.changed`, ADR-033), which are about no entry, so the table is rebuilt with a wider kind and
+-- an entry_id that only such an event leaves empty. `deliveries` points at the outbox, and SQLite
+-- counts a row that points at a dropped table as broken even when the rebuilt one holds its key, so
+-- the deliveries are set aside, the outbox is rebuilt with nothing pointing at it, and they come
+-- back, every one to a row that exists. The PRAGMA foreign_keys lines drizzle-kit writes are gone,
+-- as D1 ignores them, and the CHECKs name their columns without the temporary table's name.
+CREATE TABLE `__kept_deliveries` AS SELECT * FROM `deliveries`;--> statement-breakpoint
+DELETE FROM `deliveries`;--> statement-breakpoint
+CREATE TABLE `__new_outbox` (
+	`id` text PRIMARY KEY NOT NULL,
+	`site_id` text NOT NULL,
+	`kind` text NOT NULL,
+	`entry_id` text,
+	`payload` text NOT NULL,
+	`sent_at` text,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	FOREIGN KEY (`site_id`) REFERENCES `sites`(`id`) ON UPDATE no action ON DELETE no action,
+	CONSTRAINT "outbox_kind" CHECK("kind" IN ('entry.published', 'entry.unpublished', 'site.changed')),
+	CONSTRAINT "outbox_entry" CHECK(("kind" = 'site.changed') = ("entry_id" IS NULL)),
+	CONSTRAINT "outbox_json" CHECK(json_valid("payload") AND json_type("payload") = 'object')
+);
+--> statement-breakpoint
+INSERT INTO `__new_outbox`("id", "site_id", "kind", "entry_id", "payload", "sent_at", "created_at", "updated_at") SELECT "id", "site_id", "kind", "entry_id", "payload", "sent_at", "created_at", "updated_at" FROM `outbox`;--> statement-breakpoint
+DROP TABLE `outbox`;--> statement-breakpoint
+ALTER TABLE `__new_outbox` RENAME TO `outbox`;--> statement-breakpoint
+CREATE INDEX `outbox_unsent` ON `outbox` (`sent_at`,`created_at`);--> statement-breakpoint
+CREATE UNIQUE INDEX `outbox_id_site` ON `outbox` (`id`,`site_id`);--> statement-breakpoint
+INSERT INTO `deliveries` SELECT * FROM `__kept_deliveries`;--> statement-breakpoint
+DROP TABLE `__kept_deliveries`;

package/migrations/0014_entry_trash.sql

@@ -0,0 +1 @@
+ALTER TABLE `entries` ADD `deleted_at` text;

package/migrations/0015_site_changes_append_only.sql

@@ -0,0 +1,28 @@
+-- Written by hand (ADR-023): the history of the structure of the sites (`site_changes`, ADR-033)
+-- is append-only, as revisions and publications are (ADR-021), so it is the record of who changed
+-- what (T-83 of docs/security/threat-model.md). drizzle-kit does not model triggers; the test
+-- append-only.workerd.test.ts lists them after every migration.
+--
+-- Two of the three triggers of 0002: a line is never deleted, and never changed. There is no
+-- `_no_replace` on the unique (site_id, version): a write that lost a race to the same version in
+-- the same millisecond adds its line with INSERT OR IGNORE, which such a trigger would abort
+-- instead of ignoring; the one on the id still stops INSERT OR REPLACE of a line by its id.
+
+CREATE TRIGGER `site_changes_no_delete`
+BEFORE DELETE ON `site_changes`
+BEGIN
+	SELECT RAISE(ABORT, 'append-only: a change of the structure is never deleted');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `site_changes_immutable`
+BEFORE UPDATE ON `site_changes`
+BEGIN
+	SELECT RAISE(ABORT, 'append-only: a change of the structure never changes');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `site_changes_no_replace`
+BEFORE INSERT ON `site_changes`
+WHEN EXISTS (SELECT 1 FROM `site_changes` WHERE `id` = NEW.`id`)
+BEGIN
+	SELECT RAISE(ABORT, 'append-only: a change of the structure is written once');
+END;

package/migrations/0016_audit_log.sql

@@ -0,0 +1,65 @@
+-- Generated by drizzle-kit, then edited by hand (ADR-023): the triggers at the end are not in the
+-- schema, since drizzle-kit does not model them; append-only.workerd.test.ts lists them after
+-- every migration.
+--
+-- The activity log (ADR-037). A line is never changed and never replaced by its id. It is deleted
+-- only once it is older than the retention its site's definition holds in `audit.retentionDays`,
+-- 30 to 3650 days; a site with none keeps every line. The bounds are checked here again, so a
+-- definition written around the operations still cannot shorten the log below 30 days.
+CREATE TABLE `audit_log` (
+	`id` text PRIMARY KEY NOT NULL,
+	`site_id` text NOT NULL,
+	`action` text NOT NULL,
+	`outcome` text NOT NULL,
+	`error_code` text,
+	`actor_kind` text NOT NULL,
+	`actor_user_id` text,
+	`actor_token_id` text,
+	`actor_client_id` text,
+	`actor_meta` text,
+	`target_type` text,
+	`target_id` text,
+	`detail` text,
+	`request_id` text,
+	`ip_hash` text,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	FOREIGN KEY (`site_id`) REFERENCES `sites`(`id`) ON UPDATE no action ON DELETE no action,
+	CONSTRAINT "audit_log_outcome" CHECK("audit_log"."outcome" IN ('ok', 'denied', 'failed')),
+	CONSTRAINT "audit_log_actor_kind" CHECK("audit_log"."actor_kind" IN ('user', 'token', 'oauth_client', 'system')),
+	CONSTRAINT "audit_log_json" CHECK(("audit_log"."actor_meta" IS NULL OR json_valid("audit_log"."actor_meta")) AND ("audit_log"."detail" IS NULL OR json_valid("audit_log"."detail"))),
+	CONSTRAINT "audit_log_sizes" CHECK(length("audit_log"."action") <= 64 AND ("audit_log"."detail" IS NULL OR length("audit_log"."detail") <= 2000) AND ("audit_log"."actor_meta" IS NULL OR length("audit_log"."actor_meta") <= 2000))
+);
+--> statement-breakpoint
+CREATE INDEX `audit_log_site_time` ON `audit_log` (`site_id`,`created_at`,`id`);--> statement-breakpoint
+CREATE INDEX `audit_log_actor` ON `audit_log` (`site_id`,`actor_user_id`,`created_at`);--> statement-breakpoint
+CREATE INDEX `audit_log_target` ON `audit_log` (`site_id`,`target_type`,`target_id`,`created_at`);--> statement-breakpoint
+CREATE UNIQUE INDEX `audit_log_id_site` ON `audit_log` (`id`,`site_id`);
+
+--> statement-breakpoint
+CREATE TRIGGER `audit_log_immutable`
+BEFORE UPDATE ON `audit_log`
+BEGIN
+	SELECT RAISE(ABORT, 'append-only: a line of the activity log never changes');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `audit_log_no_replace`
+BEFORE INSERT ON `audit_log`
+WHEN EXISTS (SELECT 1 FROM `audit_log` WHERE `id` = NEW.`id`)
+BEGIN
+	SELECT RAISE(ABORT, 'append-only: a line of the activity log is written once');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `audit_log_no_delete`
+BEFORE DELETE ON `audit_log`
+WHEN NOT EXISTS (
+	SELECT 1 FROM `sites`
+	WHERE `id` = OLD.`site_id`
+		AND json_valid(`definition`)
+		AND json_type(`definition`, '$.audit.retentionDays') = 'integer'
+		AND json_extract(`definition`, '$.audit.retentionDays') BETWEEN 30 AND 3650
+		AND OLD.`created_at` < strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-' || json_extract(`definition`, '$.audit.retentionDays') || ' days')
+)
+BEGIN
+	SELECT RAISE(ABORT, 'append-only: a line of the activity log is kept for the retention of its site');
+END;