@kubun/store-credential 0.17.3 → 0.17.4

package/lib/api.d.ts

@@ -235,6 +235,11 @@ export type CredentialStoreAPI = {
      * whatever it means by "key" before calling.
      */
     getAliasEntryID(namespace: string, key: string): Promise<string | null>;
+    /**
+     * The provider namespace this entry is aliased under, or null when the entry
+     * has no alias row. UNIQUE(entry_id) makes this a 1:1 reverse lookup.
+     */
+    aliasNamespaceForEntry(entryID: string): Promise<string | null>;
     /** Point `(namespace, key)` at `entryID`, replacing any prior target. */
     setAliasEntryID(namespace: string, key: string, entryID: string): Promise<void>;
     /**
@@ -243,8 +248,22 @@ export type CredentialStoreAPI = {
      * existing alias and never binds a nonexistent entry. Classifies the outcome
      * instead of throwing, since both unique constraints are expected outcomes a
      * caller branches on, not exceptional ones.
+     *
+     * When `expectedKeyID` is given, the bind is additionally conditioned, in the
+     * same statement, on the entry belonging to that key. This closes a
+     * time-of-check/time-of-use gap for callers that cannot wrap the check and the
+     * bind in one transaction: an entry verified to belong to a key can be moved to
+     * another key (a supported manager operation) before an unconditioned insert
+     * fires, which would point this alias at an entry now owned by a different key.
+     * Folding the key check into the insert refuses atomically. When omitted, only
+     * entry existence is required (owner-gated callers verify authority elsewhere).
      */
-    bindAliasIfAbsent(namespace: string, aliasKey: string, entryID: string): Promise<'inserted' | 'entry-missing' | {
+    bindAliasIfAbsent(params: {
+        namespace: string;
+        aliasKey: string;
+        entryID: string;
+        expectedKeyID?: string;
+    }): Promise<'inserted' | 'entry-missing' | {
         conflict: 'alias';
         existing: string;
     } | {

package/lib/api.js

@@ -566,6 +566,10 @@ export function createCredentialStore(db, adapter) {
             const row = await db.selectFrom('kubun_credential_aliases').select('entry_id').where('namespace', '=', namespace).where('alias_key', '=', key).executeTakeFirst();
             return row?.entry_id ?? null;
         },
+        async aliasNamespaceForEntry (entryID) {
+            const row = await db.selectFrom('kubun_credential_aliases').select('namespace').where('entry_id', '=', entryID).executeTakeFirst();
+            return row?.namespace ?? null;
+        },
         async setAliasEntryID (namespace, key, entryID) {
             await gatedIfAmbient(()=>db.insertInto('kubun_credential_aliases').values({
                     namespace,
@@ -578,7 +582,7 @@ export function createCredentialStore(db, adapter) {
                         entry_id: entryID
                     })).execute());
         },
-        async bindAliasIfAbsent (namespace, aliasKey, entryID) {
+        async bindAliasIfAbsent ({ namespace, aliasKey, entryID, expectedKeyID }) {
             // Entry-existence-conditioned insert: the alias row is written only in the same
             // statement that confirms the entry exists. ON CONFLICT DO NOTHING fires for either
             // the (namespace, alias_key) PK or the UNIQUE(entry_id); the read-back names which.
@@ -595,7 +599,10 @@ export function createCredentialStore(db, adapter) {
                         'namespace',
                         'alias_key',
                         'entry_id'
-                    ]).expression((eb)=>eb.selectFrom('kubun_credential_entries').where('entry_id', '=', entryID).select((eb2)=>[
+                    ]).expression((eb)=>eb.selectFrom('kubun_credential_entries').where('entry_id', '=', entryID)// Same-statement key gate (see doc): bind only while the entry
+                        // still belongs to expectedKeyID, so a concurrent cross-key move
+                        // cannot slip an alias onto an entry that has left this key.
+                        .$if(expectedKeyID != null, (qb)=>qb.where('key_id', '=', expectedKeyID)).select((eb2)=>[
                                 eb2.val(namespace).as('namespace'),
                                 eb2.val(aliasKey).as('alias_key'),
                                 eb2.ref('entry_id').as('entry_id')
@@ -627,7 +634,9 @@ export function createCredentialStore(db, adapter) {
                     .where('entry_id', '=', observedExisting)// The observed pointer must still be dangling (its entry absent)...
                     .where((eb)=>eb.not(eb.exists(eb.selectFrom('kubun_credential_entries as e').select(sql`1`.as('one')).whereRef('e.entry_id', '=', 'kubun_credential_aliases.entry_id'))))// ...and the target must be present, so repair can never form a NEW dangling
                     // pointer even if the target is deleted between the pre-check and here.
-                    .where((eb)=>eb.exists(eb.selectFrom('kubun_credential_entries as t').select(sql`1`.as('one')).where('t.entry_id', '=', entryID))).executeTakeFirst();
+                    // When key-gated, the target must also still belong to expectedKeyID, so a
+                    // repair cannot repoint onto an entry that has moved to another key.
+                    .where((eb)=>eb.exists(eb.selectFrom('kubun_credential_entries as t').select(sql`1`.as('one')).where('t.entry_id', '=', entryID).$if(expectedKeyID != null, (qb)=>qb.where('t.key_id', '=', expectedKeyID)))).executeTakeFirst();
                     return (res.numUpdatedRows ?? 0n) > 0n;
                 };
                 if (!db.isTransaction) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/store-credential",
-  "version": "0.17.3",
+  "version": "0.17.4",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,