@lifeaitools/clauth 2.15.3 → 2.15.4

package/supabase/functions/auth-vault/index.ts

@@ -1,12 +1,5 @@
-// clauth — auth-vault Edge Function v3
-// IP whitelist + machine lockout (fail_count + locked) remain. Rate limiting
-// and audit logging (clauth_audit) removed 2026-09-03 -- see the comments at
-// validateHMAC and where auditLog used to be defined for why: the rate-limit
-// check was an unindexed COUNT against clauth_audit run on EVERY request,
-// pre-auth, and every rejection it produced also wrote an audit row -- a
-// feedback loop that took the whole project down under sustained load. The
-// security value it provided was already covered, tighter, by the
-// per-machine 5-failed-attempts lockout below.
+// clauth — auth-vault Edge Function v2
+// Added: IP whitelist, rate limiting, machine lockout (fail_count + locked)
 
 import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
 
@@ -18,6 +11,8 @@ const ADMIN_BOOTSTRAP_TOKEN = Deno.env.get("CLAUTH_ADMIN_BOOTSTRAP_TOKEN")!;
 const ALLOWED_IPS: string[] = (Deno.env.get("CLAUTH_ALLOWED_IPS") || "")
   .split(",").map(s => s.trim()).filter(Boolean);
 
+const RATE_LIMIT_MAX    = 30;
+const RATE_LIMIT_WINDOW = 60;
 const REPLAY_WINDOW_MS  = 5 * 60 * 1000;
 const MAX_FAIL_COUNT    = 5;
 const DEFAULT_INSTALL_ID = "default";
@@ -60,22 +55,18 @@ function checkIP(ip: string): { allowed: boolean; reason?: string } {
   return { allowed: false, reason: `IP not whitelisted: ${ip}` };
 }
 
-// rate-limiting removed 2026-09-03 -- see supervisor-registry.js's own
-// state.json lock history for the shape of this bug: checkRateLimit() ran
-// this exact query -- a COUNT against clauth_audit filtered by machine_hash
-// and created_at -- on EVERY request, BEFORE authentication (validateHMAC
-// below), against a table with no index on either column and no retention.
-// As the table grew (174,385 rows, unbounded), the scan cost grew with it;
-// under sustained traffic the queries started stacking, Postgres killed them
-// at statement_timeout, and Cloudflare killed the stacked connections at its
-// own 90s ceiling (522s) -- and every one of those rejections ALSO wrote an
-// audit row (see auditLog's removal below), so the failure fed itself. The
-// actual security protection this duplicated is already provided, tighter,
-// by the per-machine lockout in validateHMAC below (5 failed attempts locks
-// the machine -- well under the 30-per-60s this used to allow). Rate
-// limiting for a genuine runaway client belongs at Cloudflare, in front of
-// this function, not as a synchronous Postgres query on the hot path of
-// every request.
+async function checkRateLimit(sb: any, machine_hash: string): Promise<{ allowed: boolean; reason?: string }> {
+  const windowStart = new Date(Date.now() - RATE_LIMIT_WINDOW * 1000).toISOString();
+  const { count } = await sb.from("clauth_audit")
+    .select("id", { count: "exact", head: true })
+    .eq("machine_hash", machine_hash)
+    .gte("created_at", windowStart);
+  if ((count || 0) >= RATE_LIMIT_MAX) {
+    return { allowed: false, reason: `Rate limit: ${count}/${RATE_LIMIT_MAX} per ${RATE_LIMIT_WINDOW}s` };
+  }
+  return { allowed: true };
+}
+
 async function validateHMAC(sb: any, body: any): Promise<{ valid: boolean; reason?: string }> {
   const now = Date.now();
   if (Math.abs(now - body.timestamp) > REPLAY_WINDOW_MS) return { valid: false, reason: "timestamp_expired" };
@@ -108,23 +99,20 @@ async function validateHMAC(sb: any, body: any): Promise<{ valid: boolean; reaso
   return { valid: true };
 }
 
-// auditLog() removed 2026-09-03 alongside checkRateLimit() -- it wrote a row
-// to clauth_audit on every path through this function, including rejections
-// (rate-limited, auth-denied, IP-blocked), which is what turned "the table
-// got slow" into a feedback loop (more rejections -> more rows -> slower
-// scans -> more rejections). No retention policy ever existed for this
-// table. If durable audit logging is wanted back, it needs its own design --
-// write-only, indexed for its actual read pattern (if any), with a real
-// retention/partition policy -- not a bare insert-on-every-call with no cap.
+async function auditLog(sb: any, machine_hash: string, service_name: string, action: string, result: string, detail?: string) {
+  await sb.from("clauth_audit").insert({ machine_hash, service_name, action, result, detail });
+}
+
 async function handleRetrieve(sb: any, body: any, mh: string) {
   const { service } = body;
   if (!service) return { error: "service required" };
   const { data: svc } = await sb.from("clauth_services").select("*").eq("name", service).single();
-  if (!svc)           return { error: "service_not_found" };
-  if (!svc.enabled)   return { error: "service_disabled" };
-  if (!svc.vault_key) return { error: "no_key_stored" };
+  if (!svc)           { await auditLog(sb, mh, service, "retrieve", "fail", "service_not_found"); return { error: "service_not_found" }; }
+  if (!svc.enabled)   { await auditLog(sb, mh, service, "retrieve", "denied", "service_disabled"); return { error: "service_disabled" }; }
+  if (!svc.vault_key) { await auditLog(sb, mh, service, "retrieve", "fail", "no_key_stored"); return { error: "no_key_stored" }; }
   const { data: secret } = await sb.rpc("vault_decrypt_secret", { secret_name: svc.vault_key });
   await sb.from("clauth_services").update({ last_retrieved: new Date().toISOString() }).eq("name", service);
+  await auditLog(sb, mh, service, "retrieve", "success");
   return { service, key_type: svc.key_type, value: secret };
 }
 
@@ -133,8 +121,9 @@ async function handleWrite(sb: any, body: any, mh: string) {
   if (!service || !value) return { error: "service and value required" };
   const vaultKey = `clauth.${service}`;
   const { error } = await sb.rpc("vault_upsert_secret", { secret_name: vaultKey, secret_value: typeof value === "string" ? value : JSON.stringify(value) });
-  if (error) return { error: error.message };
+  if (error) { await auditLog(sb, mh, service, "write", "fail", error.message); return { error: error.message }; }
   await sb.from("clauth_services").update({ vault_key: vaultKey, last_rotated: new Date().toISOString() }).eq("name", service);
+  await auditLog(sb, mh, service, "write", "success");
   return { success: true, service, vault_key: vaultKey };
 }
 
@@ -144,6 +133,7 @@ async function handleEnable(sb: any, body: any, mh: string) {
   q = service !== "all" ? q.eq("name", service) : q.not("vault_key", "is", null);
   const { error } = await q;
   if (error) return { error: error.message };
+  await auditLog(sb, mh, service, enabled ? "enable" : "disable", "success");
   return { success: true, service, enabled };
 }
 
@@ -154,6 +144,7 @@ async function handleAdd(sb: any, body: any, mh: string) {
   if (project) row.project = project;
   const { error } = await sb.from("clauth_services").insert(row);
   if (error) return { error: error.message };
+  await auditLog(sb, mh, name, "add", "success");
   return { success: true, name, label, key_type, project: project || null };
 }
 
@@ -166,6 +157,7 @@ async function handleUpdate(sb: any, body: any, mh: string) {
   if (description !== undefined) updates.description = description || null;
   const { error } = await sb.from("clauth_services").update(updates).eq("name", service);
   if (error) return { error: error.message };
+  await auditLog(sb, mh, service, "update", "success", `fields: ${Object.keys(updates).join(", ")}`);
   return { success: true, service, ...updates };
 }
 
@@ -174,6 +166,7 @@ async function handleRemove(sb: any, body: any, mh: string) {
   if (confirm !== `CONFIRM REMOVE ${service.toUpperCase()}`) return { error: "confirm phrase mismatch" };
   await sb.rpc("vault_delete_secret", { secret_name: `clauth.${service}` });
   await sb.from("clauth_services").delete().eq("name", service);
+  await auditLog(sb, mh, service, "remove", "success");
   return { success: true, service };
 }
 
@@ -189,6 +182,7 @@ async function handleRevoke(sb: any, body: any, mh: string) {
     await sb.rpc("vault_delete_secret", { secret_name: `clauth.${service}` });
     await sb.from("clauth_services").update({ vault_key: null, enabled: false }).eq("name", service);
   }
+  await auditLog(sb, mh, service, "revoke", "success");
   return { success: true, service };
 }
 
@@ -199,6 +193,7 @@ async function handleStatus(sb: any, body: any, mh: string) {
     .order("name");
   if (body.project) q = q.eq("project", body.project);
   const { data: services } = await q;
+  await auditLog(sb, mh, "all", "status", "success");
   return { services: services || [] };
 }
 
@@ -209,6 +204,7 @@ async function handleChangePassword(sb: any, body: any, mh: string) {
     .update({ hmac_seed_hash: new_hmac_seed_hash, fail_count: 0, locked: false })
     .eq("machine_hash", mh);
   if (error) return { error: error.message };
+  await auditLog(sb, mh, "system", "change-password", "success");
   return { success: true };
 }
 
@@ -235,8 +231,12 @@ async function handleCreateEnrollment(sb: any, body: any, mh: string) {
     created_by_machine_hash: mh,
     expires_at,
   });
-  if (error) return { error: error.message };
+  if (error) {
+    await auditLog(sb, mh, "system", "create-enrollment", "fail", error.message);
+    return { error: error.message };
+  }
 
+  await auditLog(sb, mh, "system", "create-enrollment", "success", `install_id=${install_id}`);
   return { success: true, enrollment_code: code, install_id, expires_at, label };
 }
 
@@ -274,6 +274,7 @@ async function handleRedeemEnrollment(sb: any, body: any) {
   if (consumeError) return { error: consumeError.message };
   if (!consumedRows || consumedRows.length !== 1) return { error: "enrollment_already_used" };
 
+  await auditLog(sb, machine_hash, "system", "redeem-enrollment", "success", `install_id=${install_id}`);
   return { success: true, machine_hash, install_id };
 }
 
@@ -313,11 +314,21 @@ Deno.serve(async (req: Request) => {
 
   const ipCheck = checkIP(ip);
   if (!ipCheck.allowed) {
+    await auditLog(sb, body.machine_hash || "unknown", "system", route, "blocked", ipCheck.reason);
     return Response.json({ error: "ip_blocked", reason: ipCheck.reason }, { status: 403 });
   }
 
+  if (body.machine_hash) {
+    const rateCheck = await checkRateLimit(sb, body.machine_hash);
+    if (!rateCheck.allowed) {
+      await auditLog(sb, body.machine_hash, "system", route, "rate_limited", rateCheck.reason);
+      return Response.json({ error: "rate_limited", reason: rateCheck.reason }, { status: 429 });
+    }
+  }
+
   const authResult = await validateHMAC(sb, { machine_hash: body.machine_hash, token: body.token, timestamp: body.timestamp, password: body.password });
   if (!authResult.valid) {
+    await auditLog(sb, body.machine_hash || "unknown", body.service || "unknown", route, "denied", authResult.reason);
     return Response.json({ error: "auth_failed", reason: authResult.reason }, { status: 401 });
   }
 

package/cli/http/components/test-static-oauth-component.js

@@ -1,233 +0,0 @@
-// cli/http/components/test-static-oauth-component.js
-// TEST-ONLY, entirely additive: a minimal static-client OAuth 2.0 provider
-// (client_id + client_secret, authorization_code + refresh_token grants)
-// fronting one dummy MCP tool at /test/mcp. Built to test claude.ai's
-// BUILT-IN custom-connector OAuth support (manual client_id/secret entry —
-// no Dynamic Client Registration) side-by-side with the existing DCR+PKCE+
-// attestation stack in oauth-component.js / mcp-transport-component.js.
-// This file does not import from, call into, or modify either of those —
-// separate Maps, separate routes, separate discovery paths.
-//
-// Static credentials come from env so nothing is hardcoded/committed. If
-// unset, a random pair is generated at daemon start and logged once — read
-// it from clauth-serve.log to configure the claude.ai connector.
-//   CLAUTH_TEST_OAUTH_CLIENT_ID / CLAUTH_TEST_OAUTH_CLIENT_SECRET
-//
-// Access tokens are deliberately short-lived (10 min) so refresh_token
-// behavior is observable within a normal test session rather than needing
-// to wait 24h like the real flow.
-
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-import { readRawBody } from "../request-utils.js";
-
-const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
-const ACCESS_TTL_MS = 10 * 60 * 1000;
-const REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-
-function log(msg) {
-  try { fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] test-oauth: ${msg}\n`); } catch {}
-}
-
-// Constant-time string compare, safe for unequal lengths (timingSafeEqual
-// throws rather than returning false when buffers differ in length).
-function safeEqual(a, b) {
-  const bufA = Buffer.from(String(a ?? ""), "utf8");
-  const bufB = Buffer.from(String(b ?? ""), "utf8");
-  if (bufA.length !== bufB.length) return false;
-  return crypto.timingSafeEqual(bufA, bufB);
-}
-
-export function registerTestStaticOAuthRoutes(ctx) {
-  const CLIENT_ID = process.env.CLAUTH_TEST_OAUTH_CLIENT_ID || crypto.randomBytes(8).toString("hex");
-  const CLIENT_SECRET = process.env.CLAUTH_TEST_OAUTH_CLIENT_SECRET || crypto.randomBytes(24).toString("hex");
-  log(`static client ready — client_id=${CLIENT_ID} client_secret=${CLIENT_SECRET}`);
-  // No Dynamic Client Registration in this static-client model, so there is
-  // no per-client redirect_uris list to validate against by default — the
-  // real oauth-component.js has one (client.redirect_uris); this needs its
-  // own. Fails closed: unset means no redirect_uri is accepted, not "accept
-  // anything", matching this whole surface's opt-in-only posture.
-  const ALLOWED_REDIRECT_URIS = (process.env.CLAUTH_TEST_OAUTH_REDIRECT_URIS || "")
-    .split(",").map((s) => s.trim()).filter(Boolean);
-
-  const codes = new Map();         // code -> { redirect_uri, expires }
-  const accessTokens = new Map();  // token -> { expires }
-  const refreshTokens = new Map(); // token -> { expires }
-
-  function issueTokenPair() {
-    const access_token = crypto.randomBytes(32).toString("hex");
-    const refresh_token = crypto.randomBytes(32).toString("hex");
-    accessTokens.set(access_token, { expires: Date.now() + ACCESS_TTL_MS });
-    refreshTokens.set(refresh_token, { expires: Date.now() + REFRESH_TTL_MS });
-    return { access_token, refresh_token };
-  }
-
-  // ── Discovery ──
-  // Namespaced entirely under /test/ — mcp-transport-component.js registers
-  // a broad /^\/\.well-known\// catch-all BEFORE this component runs, and
-  // registerPatternRoute matches in registration order (first match wins,
-  // confirmed serve.js:2523), so a bare /.well-known/... path here would be
-  // silently swallowed by that existing route rather than reaching this one.
-  ctx.registerPatternRoute("GET", /^\/test\/\.well-known\/oauth-protected-resource$/, async (req, res) => {
-    const base = ctx.oauthBase();
-    res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
-    return res.end(JSON.stringify({
-      resource: `${base}/test/mcp`,
-      authorization_servers: [`${base}/test`],
-      scopes_supported: ["test:tools"],
-      bearer_methods_supported: ["header"],
-    }));
-  });
-  function authServerMetadata(base) {
-    return {
-      issuer: `${base}/test`,
-      authorization_endpoint: `${base}/test/authorize`,
-      token_endpoint: `${base}/test/token`,
-      response_types_supported: ["code"],
-      grant_types_supported: ["authorization_code", "refresh_token"],
-      token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic"],
-      code_challenge_methods_supported: ["S256"],
-      scopes_supported: ["test:tools"],
-    };
-  }
-  function serveAuthServerMetadata(req, res) {
-    const base = ctx.oauthBase();
-    res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
-    return res.end(JSON.stringify(authServerMetadata(base)));
-  }
-  // Observed via live claude.ai request log (2026-08-31): it tries several
-  // conventional discovery URL shapes before falling back to guessing
-  // <origin>/authorize directly. RFC 8414's actual spec puts .well-known
-  // BEFORE the issuer's path (/.well-known/oauth-authorization-server/test),
-  // not after -- that was the original bug here. Serving every shape it was
-  // observed trying, rather than guessing which one it "should" use.
-  ctx.registerPatternRoute("GET", /^\/\.well-known\/oauth-authorization-server\/test$/, serveAuthServerMetadata);
-  ctx.registerPatternRoute("GET", /^\/\.well-known\/openid-configuration\/test$/, serveAuthServerMetadata);
-  ctx.registerPatternRoute("GET", /^\/test\/\.well-known\/openid-configuration$/, serveAuthServerMetadata);
-  ctx.registerPatternRoute("GET", /^\/test\/\.well-known\/oauth-authorization-server$/, serveAuthServerMetadata);
-
-  // ── Authorize — static client, auto-approve (test only), PKCE optional
-  // since this exists specifically to test claude.ai's own client behavior,
-  // not to enforce our own policy on it. ──
-  ctx.registerWriteRoute("GET", "/test/authorize", async (req, res, url) => {
-    const clientId = url.searchParams.get("client_id");
-    const redirectUri = url.searchParams.get("redirect_uri");
-    const state = url.searchParams.get("state");
-    if (clientId !== CLIENT_ID || !redirectUri || !ALLOWED_REDIRECT_URIS.includes(redirectUri)) {
-      res.writeHead(400, { "Content-Type": "text/plain" });
-      return res.end("invalid client_id or unregistered redirect_uri");
-    }
-    const code = crypto.randomBytes(24).toString("hex");
-    codes.set(code, { redirect_uri: redirectUri, expires: Date.now() + 300_000 });
-    const redirect = new URL(redirectUri);
-    redirect.searchParams.set("code", code);
-    if (state) redirect.searchParams.set("state", state);
-    log(`authorize -> code issued for client ${clientId}`);
-    res.writeHead(302, { Location: redirect.toString(), "Cache-Control": "no-store" });
-    return res.end();
-  });
-
-  // ── Token — authorization_code AND refresh_token grants ──
-  ctx.registerWriteRoute("POST", "/test/token", async (req, res) => {
-    const raw = await readRawBody(req);
-    const ct = req.headers["content-type"] || "";
-    const body = ct.includes("application/json") ? JSON.parse(raw || "{}") : Object.fromEntries(new URLSearchParams(raw));
-
-    // Client auth: client_secret_post (body) or client_secret_basic (header)
-    let clientId = body.client_id, clientSecret = body.client_secret;
-    const authHeader = req.headers.authorization;
-    if (!clientSecret && authHeader?.startsWith("Basic ")) {
-      const [u, p] = Buffer.from(authHeader.slice(6), "base64").toString().split(":");
-      clientId = clientId || u; clientSecret = p;
-    }
-    if (clientId !== CLIENT_ID || !safeEqual(clientSecret, CLIENT_SECRET)) {
-      log(`token: client auth failed (client_id=${clientId})`);
-      res.writeHead(401, { "Content-Type": "application/json" });
-      return res.end(JSON.stringify({ error: "invalid_client" }));
-    }
-
-    if (body.grant_type === "authorization_code") {
-      const stored = codes.get(body.code);
-      codes.delete(body.code);
-      if (!stored || stored.expires < Date.now() || stored.redirect_uri !== body.redirect_uri) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        return res.end(JSON.stringify({ error: "invalid_grant" }));
-      }
-      const pair = issueTokenPair();
-      log(`token: issued via authorization_code`);
-      res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
-      return res.end(JSON.stringify({ ...pair, token_type: "Bearer", scope: "test:tools", expires_in: ACCESS_TTL_MS / 1000 }));
-    }
-
-    if (body.grant_type === "refresh_token") {
-      const stored = refreshTokens.get(body.refresh_token);
-      if (!stored || stored.expires < Date.now()) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        return res.end(JSON.stringify({ error: "invalid_grant" }));
-      }
-      refreshTokens.delete(body.refresh_token); // rotate — old refresh token is one-time use
-      const pair = issueTokenPair();
-      log(`token: rotated via refresh_token`);
-      res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
-      return res.end(JSON.stringify({ ...pair, token_type: "Bearer", scope: "test:tools", expires_in: ACCESS_TTL_MS / 1000 }));
-    }
-
-    res.writeHead(400, { "Content-Type": "application/json" });
-    return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
-  });
-
-  // ── MCP endpoint — self-contained, one dummy tool, no dependency on the
-  // real vault/tool surface. 401 gate mirrors the real transport's shape. ──
-  ctx.registerWriteRoute("POST", "/test/mcp", async (req, res) => {
-    const authHeader = req.headers.authorization;
-    const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-    const stored = token && accessTokens.get(token);
-    if (!stored || stored.expires < Date.now()) {
-      const base = ctx.oauthBase();
-      res.writeHead(401, {
-        "Content-Type": "application/json",
-        "WWW-Authenticate": `Bearer realm="test-MCP", resource_metadata="${base}/test/.well-known/oauth-protected-resource"`,
-        "Cache-Control": "no-store",
-      });
-      return res.end(JSON.stringify({ error: "unauthorized", error_description: "Bearer token required or expired" }));
-    }
-    let body;
-    try { body = JSON.parse(await readRawBody(req)); } catch {
-      res.writeHead(400, { "Content-Type": "application/json" });
-      return res.end(JSON.stringify({ error: "Invalid JSON" }));
-    }
-    const { id, method, params } = body;
-    if (method === "notifications/initialized" || method === "initialized") { res.writeHead(202); return res.end(); }
-    if (method === "initialize") {
-      return respond(res, req, { jsonrpc: "2.0", id, result: {
-        protocolVersion: "2025-03-26",
-        serverInfo: { name: "test-mcp", version: "0.1.0" },
-        capabilities: { tools: { listChanged: true } },
-      } });
-    }
-    if (method === "tools/list") {
-      return respond(res, req, { jsonrpc: "2.0", id, result: { tools: [{
-        name: "test_ping",
-        description: "Returns a fixed value — used only to confirm the static-client OAuth token grants tool access.",
-        inputSchema: { type: "object", properties: {} },
-      }] } });
-    }
-    if (method === "tools/call" && params?.name === "test_ping") {
-      log(`tools/call test_ping invoked`);
-      return respond(res, req, { jsonrpc: "2.0", id, result: { content: [{ type: "text", text: "pong from test-mcp" }] } });
-    }
-    return respond(res, req, { jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown method: ${method}` } });
-  });
-
-  function respond(res, req, payload) {
-    if ((req.headers.accept || "").includes("text/event-stream")) {
-      const buf = Buffer.from(`event: message\ndata: ${JSON.stringify(payload)}\n\n`, "utf8");
-      res.writeHead(200, { "Content-Type": "text/event-stream", "Content-Length": buf.length, "Cache-Control": "no-cache" });
-      return res.end(buf);
-    }
-    res.writeHead(200, { "Content-Type": "application/json" });
-    return res.end(JSON.stringify(payload));
-  }
-}

package/supabase/migrations/004_remove_audit_and_rate_limiting.sql

@@ -1,29 +0,0 @@
--- Migration: remove clauth_audit and the rate-limiting it backed
--- Applied live to the LIFEAI project 2026-09-03; this file makes a fresh
--- `supabase db push` (a new operator following the setup guide) match that
--- same state instead of creating a table the current auth-vault code never
--- reads or writes.
---
--- Root cause of the 2026-09-03 incident this closes: checkRateLimit() in
--- supabase/functions/auth-vault/index.ts ran an unindexed COUNT against
--- clauth_audit, filtered by machine_hash + created_at, on EVERY request,
--- BEFORE authentication. As the table grew unbounded (no retention policy
--- ever existed), the scan cost grew with it; under sustained traffic the
--- queries stacked, Postgres killed them at statement_timeout, and Cloudflare
--- killed the stacked connections at its own 90s ceiling (522s). Every one of
--- those rejections also wrote an audit row via auditLog(), which fed the
--- same table the check was scanning -- a self-reinforcing feedback loop.
---
--- The security value the rate limiter provided was already covered, tighter,
--- by the per-machine lockout in validateHMAC (clauth_machines.fail_count /
--- .locked -- 5 failed attempts locks the machine, well under the 30-per-60s
--- window this used to allow). Rate limiting for a genuine runaway client
--- belongs at Cloudflare, in front of this function, not as a synchronous
--- Postgres query on the hot path of every request.
---
--- Confirmed before dropping the live table: no function in pg_proc
--- referenced clauth_audit in its source, and no trigger targeted it --
--- auth-vault's own auditLog() (now removed from the deployed function) was
--- its only writer, and RLS (no_anon_audit, see 001_clauth_schema.sql) meant
--- no client ever had direct write access either.
-DROP TABLE IF EXISTS public.clauth_audit CASCADE;