@mccaskie-labs/workbench-config 0.1.25 → 0.1.26

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.26
+
+### Patch Changes
+
+- The database manifest gains the sign-in bot check: Control's `cf_turnstile_widget_create` and `cf_turnstile_widget_delete`, the `TURNSTILE_SITE_KEY` and `TURNSTILE_SECRET_KEY` config (written by `cf_worker_secret_put` sources `turnstile_sitekey` and `turnstile_secret`), the rule `database.sign-in-checks-for-bots` and its drill probe `database.sign-in-bot-check`.
+
 ## 0.1.25
 
 ### Patch Changes

package/capabilities/database.json

@@ -24,7 +24,9 @@
       "sb_query",
       "sb_project_delete",
       "cf_worker_secret_put",
-      "vendor_settings_apply"
+      "vendor_settings_apply",
+      "cf_turnstile_widget_create",
+      "cf_turnstile_widget_delete"
     ]
   },
   "config": [
@@ -70,6 +72,28 @@
         "production"
       ],
       "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+    },
+    {
+      "name": "TURNSTILE_SITE_KEY",
+      "required": false,
+      "secret": false,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+    },
+    {
+      "name": "TURNSTILE_SECRET_KEY",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
     }
   ],
   "actions": [
@@ -104,7 +128,7 @@
     {
       "tool": "cf_worker_secret_put",
       "gate": "two_step_when",
-      "when": "source supabase_secret, or replacing a secret that exists",
+      "when": "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)",
       "ships": "4"
     },
     {
@@ -112,6 +136,16 @@
       "gate": "two_step_when",
       "when": "production, after the first successful apply on that database; staging and check_only are free",
       "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_create",
+      "gate": "free",
+      "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_delete",
+      "gate": "two_step",
+      "ships": "5"
     }
   ],
   "rules": [
@@ -170,6 +204,13 @@
       "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
       "enforced_by": "review",
       "probe": "database.session-cookie"
+    },
+    {
+      "id": "database.sign-in-checks-for-bots",
+      "kind": "must",
+      "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+      "enforced_by": "review",
+      "probe": "database.sign-in-bot-check"
     }
   ],
   "examples": [
@@ -252,6 +293,13 @@
       "expect": "pass",
       "cost_hint_usd": 0,
       "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
+    },
+    {
+      "id": "database.sign-in-bot-check",
+      "half": "drill",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does"
     }
   ]
 }

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "ecc54c728515";
+export declare const MANIFEST_VERSION: "7d046814165b";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -421,7 +421,7 @@ export declare const capabilities: {
         readonly summary: "Each project has its own Supabase projects, <id>-staging and <id>-production. Apps use them natively through workbench-supabase; Control creates them, writes their URL and keys onto the Workers, and applies migrations read from the repo.";
         readonly status: "built";
         readonly surfaces: {
-            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply"];
+            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply", "cf_turnstile_widget_create", "cf_turnstile_widget_delete"];
             readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError", "createSessions", "safeReturnPath", "sameOrigin"];
         };
         readonly config: readonly [{
@@ -448,6 +448,18 @@ export declare const capabilities: {
             readonly secret: true;
             readonly environments: readonly ["development", "staging", "production"];
             readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
+        }, {
+            readonly name: "TURNSTILE_SITE_KEY";
+            readonly required: false;
+            readonly secret: false;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it";
+        }, {
+            readonly name: "TURNSTILE_SECRET_KEY";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it";
         }];
         readonly actions: readonly [{
             readonly tool: "sb_project_create";
@@ -475,13 +487,21 @@ export declare const capabilities: {
         }, {
             readonly tool: "cf_worker_secret_put";
             readonly gate: "two_step_when";
-            readonly when: "source supabase_secret, or replacing a secret that exists";
+            readonly when: "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)";
             readonly ships: "4";
         }, {
             readonly tool: "vendor_settings_apply";
             readonly gate: "two_step_when";
             readonly when: "production, after the first successful apply on that database; staging and check_only are free";
             readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_create";
+            readonly gate: "free";
+            readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_delete";
+            readonly gate: "two_step";
+            readonly ships: "5";
         }];
         readonly rules: readonly [{
             readonly id: "database.rls-isolates-users";
@@ -531,6 +551,12 @@ export declare const capabilities: {
             readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
             readonly enforced_by: "review";
             readonly probe: "database.session-cookie";
+        }, {
+            readonly id: "database.sign-in-checks-for-bots";
+            readonly kind: "must";
+            readonly text: "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in-bot-check";
         }];
         readonly examples: readonly [{
             readonly id: "database.example.user-client";
@@ -600,6 +626,12 @@ export declare const capabilities: {
             readonly expect: "pass";
             readonly cost_hint_usd: 0;
             readonly note: "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute";
+        }, {
+            readonly id: "database.sign-in-bot-check";
+            readonly half: "drill";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does";
         }];
     };
     readonly email: {

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "ecc54c728515";
+export const MANIFEST_VERSION = "7d046814165b";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -621,7 +621,9 @@ export const capabilities = {
                 "sb_query",
                 "sb_project_delete",
                 "cf_worker_secret_put",
-                "vendor_settings_apply"
+                "vendor_settings_apply",
+                "cf_turnstile_widget_create",
+                "cf_turnstile_widget_delete"
             ],
             "package": [
                 "supabaseConfig",
@@ -678,6 +680,28 @@ export const capabilities = {
                     "production"
                 ],
                 "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+            },
+            {
+                "name": "TURNSTILE_SITE_KEY",
+                "required": false,
+                "secret": false,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+            },
+            {
+                "name": "TURNSTILE_SECRET_KEY",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
             }
         ],
         "actions": [
@@ -712,7 +736,7 @@ export const capabilities = {
             {
                 "tool": "cf_worker_secret_put",
                 "gate": "two_step_when",
-                "when": "source supabase_secret, or replacing a secret that exists",
+                "when": "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)",
                 "ships": "4"
             },
             {
@@ -720,6 +744,16 @@ export const capabilities = {
                 "gate": "two_step_when",
                 "when": "production, after the first successful apply on that database; staging and check_only are free",
                 "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_create",
+                "gate": "free",
+                "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_delete",
+                "gate": "two_step",
+                "ships": "5"
             }
         ],
         "rules": [
@@ -778,6 +812,13 @@ export const capabilities = {
                 "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
                 "enforced_by": "review",
                 "probe": "database.session-cookie"
+            },
+            {
+                "id": "database.sign-in-checks-for-bots",
+                "kind": "must",
+                "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+                "enforced_by": "review",
+                "probe": "database.sign-in-bot-check"
             }
         ],
         "examples": [
@@ -860,6 +901,13 @@ export const capabilities = {
                 "expect": "pass",
                 "cost_hint_usd": 0,
                 "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
+            },
+            {
+                "id": "database.sign-in-bot-check",
+                "half": "drill",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does"
             }
         ]
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",