@rehearsal-db/core 0.1.0-beta.12 → 0.1.0-beta.14

package/src/source/postgresql_access.mjs

@@ -6,20 +6,23 @@
 import { createHash, randomBytes } from "node:crypto";
 import {
   chmod,
+  link,
+  lstat,
   mkdir,
   open,
   readFile,
-  rename,
   rm,
   writeFile,
 } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import pg from "pg";
 import {
   assertSourceAccessConfirmation,
   createSourceRetirementPlan,
+  sourceAccessPolicyFingerprint,
   sourceTargetFingerprint,
 } from "./access.mjs";
+import { verifyExternalPostgresqlReader } from "./external_reader.mjs";
 
 const { Client } = pg;
 const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
@@ -41,6 +44,36 @@ const ensureOwnedPath = (projectRoot, relativePath) => {
   return path;
 };
 
+const isInside = (root, path) => {
+  const child = relative(root, path);
+  return Boolean(child) && !child.startsWith("..") && !isAbsolute(child);
+};
+
+const resolveSourceStateRoot = ({
+  projectRoot,
+  artifactRoot = join(projectRoot, ".rehearsal"),
+}) => ensureOwnedPath(projectRoot, artifactRoot);
+
+export const resolvePostgresqlSourceStatePaths = ({
+  projectRoot = process.cwd(),
+  artifactRoot = join(projectRoot, ".rehearsal"),
+  credentialFile,
+}) => {
+  const stateRoot = resolveSourceStateRoot({ projectRoot, artifactRoot });
+  const credentialPath = ensureOwnedPath(projectRoot, credentialFile);
+  const secretsRoot = join(stateRoot, "secrets");
+  if (!isInside(secretsRoot, credentialPath)) {
+    throw new Error(
+      "Source reader credential must stay inside this target's configured .rehearsal/secrets directory.",
+    );
+  }
+  return Object.freeze({
+    stateRoot,
+    credentialPath,
+    receiptPath: join(stateRoot, "source-access-receipt.json"),
+  });
+};
+
 const readerConnectionString = (
   administratorConnectionString,
   role,
@@ -64,6 +97,22 @@ const writeExclusiveSecret = async (path, content) => {
   await chmod(path, 0o600);
 };
 
+const assertSourceStateAvailable = async (...paths) => {
+  for (const path of paths) {
+    try {
+      await lstat(path);
+    } catch (error) {
+      if (error?.code === "ENOENT") continue;
+      throw error;
+    }
+    const error = new Error(
+      "Source-access state already exists and will not be overwritten.",
+    );
+    error.code = "EEXIST";
+    throw error;
+  }
+};
+
 const connection = async (connectionString, clientFactory) => {
   const client = clientFactory
     ? await clientFactory(connectionString)
@@ -180,60 +229,163 @@ const runDenyChecks = async (client, plan) => {
   }
 };
 
+const assertApprovedOwnerScopes = (plan, environment) => {
+  for (const relation of plan.policy.relations) {
+    if (relation.rowScope.kind !== "approved-owner") continue;
+    const value = environment[relation.rowScope.valueEnvironmentVariable];
+    if (
+      !value ||
+      createHash("sha256").update(value).digest("hex") !==
+        plan.review.relations.find((entry) => entry.view === relation.view)
+          ?.rowScope.valueSha256
+    ) {
+      throw new Error(
+        "Approved owner scope changed after the reviewed source-access preview.",
+      );
+    }
+  }
+};
+
+const buildSourceAccessReceipt = ({ plan, expiresAt }) => ({
+  receiptVersion: 1,
+  accessMode: plan.policy.reader.mode,
+  policyFingerprint: sourceAccessPolicyFingerprint(plan.policy),
+  targetFingerprint: plan.policy.targetFingerprint,
+  planDigest: plan.digest,
+  exportSchema: plan.policy.exportSchema,
+  views: plan.policy.relations.map((relation) => relation.view).sort(),
+  relations: plan.policy.relations.map((relation) => ({
+    ...relation.source,
+    columns: relation.columns,
+  })),
+  migrationLedger: plan.policy.migrationLedger,
+  readerRole: plan.policy.reader.role,
+  ...(plan.policy.reader.mode === "managed"
+    ? { ownerRole: plan.policy.reader.ownerRole }
+    : {}),
+  expiresAt,
+});
+
+const activateExternalPostgresqlSourceAccess = async ({
+  plan,
+  projectRoot,
+  artifactRoot,
+  environment,
+  clientFactory,
+  now,
+}) => {
+  const connectionString =
+    environment[plan.policy.reader.connectionEnvironmentVariable];
+  if (!connectionString) {
+    throw new Error(
+      `Missing ${plan.policy.reader.connectionEnvironmentVariable}.`,
+    );
+  }
+  assertTarget(plan, connectionString);
+  assertApprovedOwnerScopes(plan, environment);
+  const { credentialPath, receiptPath } = resolvePostgresqlSourceStatePaths({
+    projectRoot,
+    artifactRoot,
+    credentialFile: plan.policy.reader.credentialFile,
+  });
+  await assertSourceStateAvailable(credentialPath, receiptPath);
+  const verified = await verifyExternalPostgresqlReader({
+    plan,
+    connectionString,
+    clientFactory,
+    now,
+  });
+  const temporaryCredentialPath = `${credentialPath}.building-${process.pid}`;
+  const receipt = buildSourceAccessReceipt({
+    plan,
+    expiresAt: verified.expiresAt,
+  });
+  let receiptWritten = false;
+  try {
+    await writeExclusiveSecret(
+      temporaryCredentialPath,
+      `REHEARSAL_SOURCE_DATABASE_URL=${connectionString}\n`,
+    );
+    await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`, {
+      flag: "wx",
+      mode: 0o600,
+    });
+    receiptWritten = true;
+    await chmod(receiptPath, 0o600);
+    await link(temporaryCredentialPath, credentialPath);
+    await rm(temporaryCredentialPath, { force: true });
+  } catch (error) {
+    await rm(temporaryCredentialPath, { force: true });
+    if (receiptWritten) await rm(receiptPath, { force: true });
+    throw error;
+  }
+  return { receipt, credentialPath, receiptPath };
+};
+
 export const applyPostgresqlSourceAccess = async ({
   plan,
   confirmation,
   projectRoot = process.cwd(),
+  artifactRoot = join(projectRoot, ".rehearsal"),
   environment = process.env,
   clientFactory,
   now = new Date(),
 }) => {
   assertSourceAccessConfirmation(plan, confirmation);
+  if (plan.policy.reader.mode === "external") {
+    return activateExternalPostgresqlSourceAccess({
+      plan,
+      projectRoot,
+      artifactRoot,
+      environment,
+      clientFactory,
+      now,
+    });
+  }
   const administratorConnectionString =
     environment[plan.policy.administratorEnvironmentVariable];
   if (!administratorConnectionString) {
     throw new Error(`Missing ${plan.policy.administratorEnvironmentVariable}.`);
   }
   assertTarget(plan, administratorConnectionString);
-  for (const relation of plan.policy.relations) {
-    if (relation.rowScope.kind !== "approved-owner") continue;
-    const value = environment[relation.rowScope.valueEnvironmentVariable];
-    if (
-      !value ||
-      createHash("sha256").update(value).digest("hex") !==
-        plan.review.relations.find((entry) => entry.view === relation.view)
-          ?.rowScope.valueSha256
-    ) {
-      throw new Error(
-        "Approved owner scope changed after the reviewed source-access preview.",
-      );
-    }
-  }
+  assertApprovedOwnerScopes(plan, environment);
   const password = randomBytes(32).toString("base64url");
   const expiresAt = new Date(
     now.valueOf() + plan.policy.reader.validForMinutes * 60_000,
   ).toISOString();
-  const credentialPath = ensureOwnedPath(
-    projectRoot,
-    plan.policy.reader.credentialFile,
-  );
-  const receiptPath = ensureOwnedPath(
+  const { credentialPath, receiptPath } = resolvePostgresqlSourceStatePaths({
     projectRoot,
-    ".rehearsal/source-access-receipt.json",
-  );
+    artifactRoot,
+    credentialFile: plan.policy.reader.credentialFile,
+  });
   const temporaryCredentialPath = `${credentialPath}.building-${process.pid}`;
   const readerUrl = readerConnectionString(
     administratorConnectionString,
     plan.policy.reader.role,
     password,
   );
-  await writeExclusiveSecret(
-    temporaryCredentialPath,
-    `REHEARSAL_SOURCE_DATABASE_URL=${readerUrl}\n`,
-  );
-  const client = await connection(administratorConnectionString, clientFactory);
-  let committed = false;
+  let receiptReserved = false;
+  let credentialLinked = false;
+  try {
+    await writeExclusiveSecret(
+      temporaryCredentialPath,
+      `REHEARSAL_SOURCE_DATABASE_URL=${readerUrl}\n`,
+    );
+    const receiptReservation = await open(receiptPath, "wx", 0o600);
+    receiptReserved = true;
+    await receiptReservation.close();
+    await link(temporaryCredentialPath, credentialPath);
+    credentialLinked = true;
+    await rm(temporaryCredentialPath, { force: true });
+  } catch (error) {
+    await rm(temporaryCredentialPath, { force: true });
+    if (credentialLinked) await rm(credentialPath, { force: true });
+    if (receiptReserved) await rm(receiptPath, { force: true });
+    throw error;
+  }
+  let client;
   try {
+    client = await connection(administratorConnectionString, clientFactory);
     await client.query("begin");
     await client.query(
       "select pg_advisory_xact_lock(hashtext('rehearsal-source-access'))",
@@ -318,32 +470,19 @@ export const applyPostgresqlSourceAccess = async ({
     );
     await runDenyChecks(client, plan);
     await client.query("commit");
-    committed = true;
   } catch (error) {
-    await client.query("rollback").catch(() => undefined);
+    await client?.query("rollback").catch(() => undefined);
+    await Promise.all([
+      rm(credentialPath, { force: true }),
+      rm(receiptPath, { force: true }),
+    ]);
     throw error;
   } finally {
-    await client.end?.();
-    if (!committed) await rm(temporaryCredentialPath, { force: true });
+    await client?.end?.();
   }
-  await rename(temporaryCredentialPath, credentialPath);
-  const receipt = {
-    receiptVersion: 1,
-    targetFingerprint: plan.policy.targetFingerprint,
-    planDigest: plan.digest,
-    exportSchema: plan.policy.exportSchema,
-    views: plan.policy.relations.map((relation) => relation.view).sort(),
-    relations: plan.policy.relations.map((relation) => ({
-      ...relation.source,
-      columns: relation.columns,
-    })),
-    migrationLedger: plan.policy.migrationLedger,
-    readerRole: plan.policy.reader.role,
-    ownerRole: plan.policy.reader.ownerRole,
-    expiresAt,
-  };
+  const receipt = buildSourceAccessReceipt({ plan, expiresAt });
   await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`, {
-    flag: "wx",
+    flag: "w",
     mode: 0o600,
   });
   await chmod(receiptPath, 0o600);
@@ -352,11 +491,12 @@ export const applyPostgresqlSourceAccess = async ({
 
 export const planPostgresqlSourceAccessRetirement = async ({
   projectRoot = process.cwd(),
+  artifactRoot = join(projectRoot, ".rehearsal"),
   targetFingerprint,
 }) => {
-  const receiptPath = ensureOwnedPath(
-    projectRoot,
-    ".rehearsal/source-access-receipt.json",
+  const receiptPath = join(
+    resolveSourceStateRoot({ projectRoot, artifactRoot }),
+    "source-access-receipt.json",
   );
   const receipt = JSON.parse(await readFile(receiptPath, "utf8"));
   return {
@@ -371,6 +511,7 @@ export const retirePostgresqlSourceAccess = async ({
   confirmation,
   administratorEnvironmentVariable,
   projectRoot = process.cwd(),
+  artifactRoot = join(projectRoot, ".rehearsal"),
   environment = process.env,
   credentialFile,
   clientFactory,
@@ -380,6 +521,23 @@ export const retirePostgresqlSourceAccess = async ({
       `Source retirement confirmation does not match. Expected ${plan.digest}.`,
     );
   }
+  const { credentialPath, receiptPath } = resolvePostgresqlSourceStatePaths({
+    projectRoot,
+    artifactRoot,
+    credentialFile,
+  });
+  if (resolve(plan.receiptPath) !== receiptPath) {
+    throw new Error(
+      "Source retirement receipt does not belong to this target's configured state root.",
+    );
+  }
+  if (plan.review.accessMode === "external") {
+    await Promise.all([
+      rm(credentialPath, { force: true }),
+      rm(receiptPath, { force: true }),
+    ]);
+    return { retired: true, providerResourcesPreserved: true };
+  }
   const administratorConnectionString =
     environment[administratorEnvironmentVariable];
   if (!administratorConnectionString)
@@ -473,8 +631,8 @@ export const retirePostgresqlSourceAccess = async ({
     await client.end?.();
   }
   await Promise.all([
-    rm(ensureOwnedPath(projectRoot, credentialFile), { force: true }),
-    rm(plan.receiptPath, { force: true }),
+    rm(credentialPath, { force: true }),
+    rm(receiptPath, { force: true }),
   ]);
   return { retired: true };
 };

package/src/source/privacy_paths.mjs

@@ -0,0 +1,38 @@
+/** Coordinate private source prefixes with reviewed privacy path mappings. */
+
+import { validateExecutablePrivacyPolicy } from "../baseline/privacy_engine.mjs";
+import { validateSourceAccessPolicy } from "./access.mjs";
+
+export const resolvePrivacyMappedAssets = ({
+  sourcePolicy,
+  privacyPolicy,
+  environment = process.env,
+}) => {
+  const source = validateSourceAccessPolicy(sourcePolicy);
+  const privacy = validateExecutablePrivacyPolicy(privacyPolicy);
+
+  return Object.freeze(
+    source.assets.map((asset) => {
+      if (!asset.pathMapping) return asset;
+      const mapping = privacy.pathMappings[asset.pathMapping];
+      if (!mapping) {
+        throw new Error(
+          `Storage asset references unknown privacy path mapping ${asset.pathMapping}.`,
+        );
+      }
+      const binding = privacy.bindings[mapping.binding];
+      if (binding.environmentVariable !== asset.prefixEnvironmentVariable) {
+        throw new Error(
+          `Storage asset ${asset.bucket} must use the environment variable reviewed by privacy path mapping ${asset.pathMapping}.`,
+        );
+      }
+      const prefix = environment[asset.prefixEnvironmentVariable];
+      if (typeof prefix !== "string" || !prefix) {
+        throw new Error(
+          `Storage asset ${asset.bucket} requires ${asset.prefixEnvironmentVariable}.`,
+        );
+      }
+      return Object.freeze({ ...asset, prefix });
+    }),
+  );
+};