@kontrolia/db 2.0.0 → 2.1.1

package/migrations/0034_application_ownership_claim.sql

@@ -0,0 +1,91 @@
+-- Closes INT-API-007/INT-API-008/PQ-TECH-010: applications.owner_organization_id
+-- was never written by any code path in the repo — registerApplication()'s
+-- INSERT omits it, the CLI wizard runs before any organization necessarily
+-- exists and never asks who should own the app, and no INSERT/ownership-claim
+-- RLS policy ever existed for a regular user. Three real, shipped
+-- capabilities (0022's owning-org UPDATE policy, the admin-panel rotate/
+-- revoke API-key UI, the applications/members API) were all correctly built
+-- but unreachable for any application registered the intended way.
+--
+-- The actual fix is POST /api/applications/claim (auth-server), a
+-- platform-admin-gated route that runs as service_role — matching this
+-- table's original design comment (migration 0010: "applications catalog:
+-- platform-level, managed via service_role from the auth-server admin API").
+-- This migration only prepares the database side of that: audit logging for
+-- the new action, and a guard against a related gap found while designing
+-- it (see below).
+
+-- Extend the existing "database logs it, not application code" trigger
+-- (0032) to also cover ownership changes, the same way it already covers
+-- api_key_hash changes.
+create or replace function kontrolia_auth.log_application_api_key_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if old.api_key_hash is distinct from new.api_key_hash then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.owner_organization_id,
+      auth.uid(),
+      case when new.api_key_hash is null then 'application.api_key_revoked' else 'application.api_key_rotated' end,
+      'application',
+      new.id::text,
+      jsonb_build_object('slug', new.slug)
+    );
+  end if;
+
+  if old.owner_organization_id is distinct from new.owner_organization_id then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.owner_organization_id,
+      auth.uid(),
+      case when old.owner_organization_id is null then 'application.ownership_claimed' else 'application.ownership_transferred' end,
+      'application',
+      new.id::text,
+      jsonb_build_object('slug', new.slug, 'previous_owner_organization_id', old.owner_organization_id)
+    );
+  end if;
+
+  return new;
+end;
+$$;
+
+-- Found while designing the claim route, reading every existing policy on
+-- this table: 0022's "owning org admins can update their application" UPDATE
+-- policy checks USING/WITH CHECK is_org_admin(owner_organization_id) against
+-- the OLD row and the NEW row independently — it never requires those two
+-- organization ids to be the SAME org. A user who administers two different
+-- organizations, one of which already owns an application, could already
+-- reassign that application to their other org via a plain RLS-authenticated
+-- UPDATE, with neither org's other admins involved — the same dual-org-admin
+-- shape as this session's earlier PQ-SEC-005, on a different table. Since the
+-- product has no legitimate "transfer ownership" capability (only "claim an
+-- unowned application", which the new route performs as service_role), the
+-- simplest correct fix is to remove the capability entirely for any other
+-- caller: once owner_organization_id is set, only service_role may change it.
+create or replace function kontrolia_auth.prevent_application_ownership_reassignment()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if auth.role() = 'service_role' then
+    return new;
+  end if;
+
+  if old.owner_organization_id is not null and new.owner_organization_id is distinct from old.owner_organization_id then
+    raise exception 'No se puede reasignar la propiedad de una aplicación ya reclamada.';
+  end if;
+
+  return new;
+end;
+$$;
+
+drop trigger if exists prevent_application_ownership_reassignment on kontrolia_auth.applications;
+create trigger prevent_application_ownership_reassignment
+  before update on kontrolia_auth.applications
+  for each row execute function kontrolia_auth.prevent_application_ownership_reassignment();

package/migrations/0035_restore_is_platform_admin_claim.sql

@@ -0,0 +1,102 @@
+-- CRITICAL regression found live while testing the new applications/claim
+-- route (migration 0034): migration 0030's `create or replace function
+-- kontrolia_auth.custom_access_token_hook` fully replaced the function body
+-- to anchor roles/permissions to is_system_role, but its jsonb_set calls only
+-- covered organization_id/roles/permissions — it silently dropped the
+-- is_platform_admin claim that 0020's version set. `create or replace`
+-- replaces the whole body, so anything not repeated in the new version is
+-- gone, not merged.
+--
+-- Live-reproduced: generated a real magic-link session for a genuine
+-- platform_admins row (raul.dolores@gmail.com) against the running local
+-- sandbox and decoded the resulting JWT — no is_platform_admin claim present
+-- at all. Every platform-admin-gated route (POST/DELETE /api/platform-admins,
+-- GET/POST/PUT /api/oauth-clients, and the new POST /api/applications/claim)
+-- has been checking `claims.is_platform_admin`, which has been `undefined`
+-- (falsy, so at least fails closed — no privilege escalation, just a broken
+-- feature) for every real user since 0030 shipped earlier today. Nothing
+-- caught this because verification since 0030 used direct-SQL/service-role
+-- testing for those routes rather than a real fresh login.
+
+create or replace function kontrolia_auth.custom_access_token_hook(event jsonb)
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  claims jsonb;
+  target_user_id uuid;
+  active_org_id uuid;
+  active_membership_id uuid;
+  role_names text[];
+  permission_keys text[];
+  platform_admin boolean;
+begin
+  claims := coalesce(event->'claims', '{}'::jsonb);
+  target_user_id := (event->>'user_id')::uuid;
+
+  select active_organization_id into active_org_id
+  from kontrolia_auth.sessions_context
+  where user_id = target_user_id;
+
+  if active_org_id is null then
+    select organization_id into active_org_id
+    from kontrolia_auth.memberships
+    where user_id = target_user_id and status = 'active'
+    order by created_at asc
+    limit 1;
+  end if;
+
+  if active_org_id is not null then
+    select id into active_membership_id
+    from kontrolia_auth.memberships
+    where user_id = target_user_id
+      and organization_id = active_org_id
+      and status = 'active';
+  end if;
+
+  if active_membership_id is not null then
+    select coalesce(array_agg(distinct r.slug), '{}')
+      into role_names
+    from kontrolia_auth.membership_roles mr
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where mr.membership_id = active_membership_id and r.is_system_role;
+
+    select coalesce(array_agg(distinct p.key), '{}')
+      into permission_keys
+    from (
+      select p.id, p.key
+      from kontrolia_auth.membership_roles mr
+      join kontrolia_auth.role_permissions rp on rp.role_id = mr.role_id
+      join kontrolia_auth.permissions p on p.id = rp.permission_id
+      where mr.membership_id = active_membership_id
+      union
+      select p.id, p.key
+      from kontrolia_auth.user_permissions up
+      join kontrolia_auth.permissions p on p.id = up.permission_id
+      where up.membership_id = active_membership_id and up.effect = 'allow'
+    ) p
+    where not exists (
+      select 1 from kontrolia_auth.user_permissions up_deny
+      where up_deny.membership_id = active_membership_id
+        and up_deny.permission_id = p.id
+        and up_deny.effect = 'deny'
+    );
+  else
+    role_names := '{}';
+    permission_keys := '{}';
+  end if;
+
+  select exists(select 1 from kontrolia_auth.platform_admins where user_id = target_user_id) into platform_admin;
+
+  claims := jsonb_set(claims, '{organization_id}', coalesce(to_jsonb(active_org_id), 'null'::jsonb));
+  claims := jsonb_set(claims, '{roles}', to_jsonb(coalesce(role_names, '{}')));
+  claims := jsonb_set(claims, '{permissions}', to_jsonb(coalesce(permission_keys, '{}')));
+  claims := jsonb_set(claims, '{is_platform_admin}', to_jsonb(coalesce(platform_admin, false)));
+
+  event := jsonb_set(event, '{claims}', claims);
+  return event;
+end;
+$$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontrolia/db",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "license": "MIT",
   "description": "KontrolIA Auth database layer: SQL migrations for the `kontrolia` schema (organizations, RBAC, Custom Access Token Hook) and a connection-string-agnostic migration runner.",
   "keywords": [