pi-roundtable 0.9.12 → 0.10.0

package/src/core/identity/access-policy.ts

@@ -37,18 +37,45 @@ export interface AccessTier {
 	everyone?: boolean | readonly string[];
 }
 
+/** Whether someone the rules admit gets a principal at first contact (`admitted`), or only already linked identities are served (`linked`). */
+export type Provisioning = "admitted" | "linked";
+
+/** The provisioning mode for every surface, or per surface; a surface a map leaves out is `linked`, so a misspelled surface name cannot admit everyone. */
+export type ProvisioningRule =
+	| Provisioning
+	| Readonly<Record<string, Provisioning>>;
+
+/** The mode that applies to a contact on this surface. */
+export function provisioningOf(
+	rule: ProvisioningRule,
+	surface: string,
+): Provisioning {
+	if (typeof rule === "string") return rule;
+	return (Object.hasOwn(rule, surface) ? rule[surface] : undefined) ?? "linked";
+}
+
 /** Who the host serves, and at which tier. */
 export interface AccessRules {
 	/** The owners, the first of them the primary owner. The owner tier comes only from here or the CLI, never from a role a surface reports. */
 	owners: readonly AccessOwner[];
 	admins?: AccessTier;
 	members?: AccessTier;
-	/** `admitted`: someone the rules admit gets a principal at first contact, and a 0.8 speaker claims theirs; `linked`: only identities already linked, such as by the CLI or the configuration, are served. Owners are never admitted. */
-	provisioning: "admitted" | "linked";
+	/** `admitted`: someone the rules admit gets a principal at first contact, and a 0.8 speaker claims theirs; `linked`: only identities already linked, such as by the CLI or the configuration, are served. A map gives a mode per surface, such as `{ web: "admitted", discord: "linked" }`, and leaves an unnamed surface `linked`. Owners are never admitted. */
+	provisioning: ProvisioningRule;
 	/** How many days a principal whose tier came only from the rules on contact may go unseen before their background turns are refused. */
 	backgroundStaleDays: number;
+	/** The identity providers whose people may link their own account through `IDENTITY_LINKS`; without it that service is not provided. */
+	selfLink?: SelfLinkRules;
+}
+
+/** Which providers' identities a person may link to their own principal themselves. */
+export interface SelfLinkRules {
+	providers: readonly string[];
 }
 
+/** Providers whose identities are credentials or carried-over ids, never a person's own account to link. */
+const NOT_SELF_LINKABLE = ["token", "legacy"];
+
 const holds = (
 	tier: AccessTier | undefined,
 	facts: ActorFacts,
@@ -77,6 +104,15 @@ export function factsTier(
 	return undefined;
 }
 
+/** How the rules provision a contact with these facts, by the surface they came through. */
+export function provisioningFor(
+	rules: Pick<AccessRules, "provisioning">,
+	facts: ActorFacts,
+	conversation?: ChannelKey,
+): Provisioning {
+	return provisioningOf(rules.provisioning, surfaceOf(facts, conversation));
+}
+
 /** The configured owner whose identities include these facts', if any. */
 export function ownerOfFacts(
 	rules: Pick<AccessRules, "owners">,
@@ -139,6 +175,12 @@ export function checkAccessRules(rules: AccessRules): AccessRules {
 			seenIdentity.set(identity, n);
 		});
 	});
+	if (typeof rules.provisioning !== "string")
+		for (const [surface, mode] of Object.entries(rules.provisioning))
+			if (surface.trim() === "" || (mode !== "admitted" && mode !== "linked"))
+				throw new ConfigError(
+					`config access.provisioning.${surface}: expected "admitted" or "linked" for a named surface, got ${JSON.stringify(mode)}. Write it like { web: "admitted", discord: "linked" }.`,
+				);
 	checkTier(rules.admins, "access.admins");
 	checkTier(rules.members, "access.members");
 	if (
@@ -150,6 +192,27 @@ export function checkAccessRules(rules: AccessRules): AccessRules {
 		throw new ConfigError(
 			`config access.backgroundStaleDays: expected a positive whole number of days, got ${JSON.stringify(rules.backgroundStaleDays)}.`,
 		);
+	if (rules.selfLink) {
+		const { providers } = rules.selfLink;
+		if (providers.length === 0)
+			throw new ConfigError(
+				'config access.selfLink.providers: expected at least one provider, such as ["discord"]. Remove selfLink to switch self-linking off.',
+			);
+		providers.forEach((provider, i) => {
+			if (provider.trim() === "")
+				throw new ConfigError(
+					`config access.selfLink.providers[${i}]: expected a provider such as discord, got ${JSON.stringify(provider)}.`,
+				);
+			if (provider === "oidc")
+				throw new ConfigError(
+					`config access.selfLink.providers[${i}]: an OIDC provider is written oidc:<base64url issuer>, not oidc.`,
+				);
+			if (NOT_SELF_LINKABLE.includes(provider))
+				throw new ConfigError(
+					`config access.selfLink.providers[${i}]: ${provider} identities are not a person's own account; list the provider of the account people sign in with, such as discord.`,
+				);
+		});
+	}
 	return rules;
 }
 

package/src/core/identity/caching-principal-store.ts

@@ -86,8 +86,8 @@ export class CachingPrincipalStore implements PrincipalStore {
 	admit(identity: IdentityRef, displayName: string, id?: string) {
 		return this.#write(this.#store.admit(identity, displayName, id));
 	}
-	unlink(provider: string, subject: string) {
-		return this.#write(this.#store.unlink(provider, subject));
+	unlink(provider: string, subject: string, source?: LinkSource) {
+		return this.#write(this.#store.unlink(provider, subject, source));
 	}
 	grant(principalId: string, role: Tier, source: RoleSource) {
 		return this.#write(this.#store.grant(principalId, role, source));

package/src/core/identity/identity-links.ts

@@ -0,0 +1,96 @@
+import { IdentityError } from "../domain/errors.ts";
+import { freeze } from "../freeze.ts";
+import type { Logger } from "../log.ts";
+import type { SelfLinkRules } from "./access-policy.ts";
+import { identityOf, parseIdentity } from "./actor-facts.ts";
+import {
+	type IdentityLink,
+	type IdentityRef,
+	type PrincipalStore,
+	SYSTEM_PRINCIPAL,
+} from "./principal-store.ts";
+
+/**
+ * The links people make to their own principal: a plugin that proved who someone is, such as one
+ * that checked a code against a signed-in person, links the account that person controls. Provided
+ * as `IDENTITY_LINKS` only when the configuration lists the providers in `access.selfLink`;
+ * `IDENTITY` stays read-only. A link made here has the source `self`, and only such a link is
+ * unlinked here.
+ */
+export interface IdentityLinks {
+	/**
+	 * Links the identity, written `<provider>:<subject>`, to the principal, and gives the link.
+	 * Linking it again to the same principal changes nothing, also when the principal has since been
+	 * granted the owner role: a link made before keeps. Throws IdentityError for a provider
+	 * `access.selfLink` does not list, the system principal, a principal that holds the owner role
+	 * or does not exist, text that is no identity, and an identity linked to another principal.
+	 */
+	link(principalId: string, identity: string): Promise<IdentityLink>;
+	/**
+	 * Unlinks the identity; true when a self link was removed, false when there was none to remove
+	 * (it was linked to no one, or its link went away meanwhile). Throws IdentityError for a link
+	 * another source made, such as the configuration or the CLI: those are not unlinked here.
+	 */
+	unlink(identity: string): Promise<boolean>;
+}
+
+/** The self-link service over the principal store, for the providers the configuration lists. */
+export function identityLinks(
+	store: PrincipalStore,
+	rules: SelfLinkRules,
+	logger: Logger,
+): IdentityLinks {
+	const parse = (identity: string): IdentityRef => {
+		const ref = parseIdentity(identity);
+		if (!ref)
+			throw new IdentityError(
+				`${JSON.stringify(identity)} is not an identity written <provider>:<subject>`,
+			);
+		return ref;
+	};
+	return Object.freeze({
+		async link(principalId, identity) {
+			const ref = parse(identity);
+			if (!rules.providers.includes(ref.provider))
+				throw new IdentityError(
+					`${ref.provider} identities may not be linked by their person: access.selfLink lists ${rules.providers.join(", ")}`,
+				);
+			if (principalId === SYSTEM_PRINCIPAL)
+				throw new IdentityError(
+					`the host's own principal "${SYSTEM_PRINCIPAL}" has no identities`,
+				);
+			const link = await store.link(principalId, ref, "self");
+			logger.info(
+				{
+					principal: principalId,
+					identity: identityOf(ref),
+					source: link.source,
+				},
+				"an identity was linked by its person",
+			);
+			return freeze(structuredClone(link));
+		},
+		async unlink(identity) {
+			const ref = parse(identity);
+			// The cached read only names the principal in the log: it may be up to 30 s old, so it
+			// decides nothing. Only a self link goes: one the configuration or the CLI took over is kept.
+			const before = await store.identity(ref.provider, ref.subject);
+			const removed = await store.unlink(ref.provider, ref.subject, "self");
+			if (removed) {
+				logger.info(
+					{ principal: before?.principalId, identity: identityOf(ref) },
+					"an identity was unlinked by its person",
+				);
+				return true;
+			}
+			// Nothing went: read again (a write through the store drops its cached reads) to tell a link
+			// another source took over from one that is gone.
+			const now = await store.identity(ref.provider, ref.subject);
+			if (now && now.source !== "self")
+				throw new IdentityError(
+					`${identityOf(ref)} was linked by ${now.source}, not by its person; it is not unlinked here`,
+				);
+			return false;
+		},
+	} satisfies IdentityLinks);
+}

package/src/core/identity/identity-plugin.ts

@@ -1,6 +1,7 @@
 import type { RoundtablePlugin } from "../plugin.ts";
-import { IDENTITY } from "../services.ts";
+import { IDENTITY, IDENTITY_LINKS } from "../services.ts";
 import type { AccessRules } from "./access-policy.ts";
+import { identityLinks } from "./identity-links.ts";
 import { type BackfillSummary, identityMigrations } from "./identity-schema.ts";
 import { PgIdentityService } from "./identity-service.ts";
 import { identityView } from "./identity-view.ts";
@@ -29,7 +30,8 @@ export function backfillLine(summary: BackfillSummary): string {
  * The principals, their identity links, and their roles: the tables, the backfill that makes a
  * principal of every person 0.8 stored, and the identity service over them provided as
  * `IDENTITY`, read-only, its configured owners and the plugins' declared identities synced at
- * setup. It runs first, so every later plugin may read it.
+ * setup. When the rules list `selfLink` providers it also provides `IDENTITY_LINKS`. It runs
+ * first, so every later plugin may read them.
  */
 export function identityPlugin(options: IdentityOptions): RoundtablePlugin {
 	const { rules } = options;
@@ -40,7 +42,7 @@ export function identityPlugin(options: IdentityOptions): RoundtablePlugin {
 		migrations: identityMigrations(rules, (made) => {
 			summary = made;
 		}),
-		provides: [IDENTITY],
+		provides: rules.selfLink ? [IDENTITY, IDENTITY_LINKS] : [IDENTITY],
 		setup: async ({ database, services, logger }) => {
 			if (summary) logger.info(backfillLine(summary));
 			const identity = new PgIdentityService(
@@ -50,6 +52,11 @@ export function identityPlugin(options: IdentityOptions): RoundtablePlugin {
 			);
 			await identity.syncConfig();
 			services.provide(IDENTITY, identityView(identity));
+			if (rules.selfLink)
+				services.provide(
+					IDENTITY_LINKS,
+					identityLinks(identity.store, rules.selfLink, logger),
+				);
 			return {};
 		},
 	};

package/src/core/identity/identity-schema.ts

@@ -10,6 +10,7 @@ import {
 } from "./principal-store.ts";
 import {
 	PRINCIPAL_PLUGIN_LINKS,
+	PRINCIPAL_SELF_LINKS,
 	PRINCIPAL_TABLES,
 	PRINCIPALS_CLAIMABLE,
 } from "./principal-tables.ts";
@@ -259,7 +260,7 @@ export async function backfillPrincipals(
 
 /**
  * The identity plugin's migrations: its tables once, the claimable column and the plugins' link
- * source once each (apart, so a database an earlier build made the tables on gets them too), then
+ * source and the people's own link source once each (apart, so a database an earlier build made the tables on gets them too), then
  * the backfill at every boot, which hands its summary to `report`.
  */
 export function identityMigrations(
@@ -270,6 +271,7 @@ export function identityMigrations(
 		{ name: "principals", up: PRINCIPAL_TABLES },
 		{ name: "principals-claimable", up: PRINCIPALS_CLAIMABLE },
 		{ name: "principals-plugin-links", up: PRINCIPAL_PLUGIN_LINKS },
+		{ name: "principals-self-links", up: PRINCIPAL_SELF_LINKS },
 		{
 			name: "backfill",
 			runs: "every-boot",

package/src/core/identity/identity-service.ts

@@ -6,6 +6,7 @@ import {
 	type AccessRules,
 	checkAccessRules,
 	factsTier,
+	provisioningFor,
 } from "./access-policy.ts";
 import {
 	type ActorFacts,
@@ -45,7 +46,7 @@ export interface IdentityService {
 	 * linked identity is its principal's; an unlinked one first claims the principal of its 0.8
 	 * id (`legacyId`) when the backfill made it and no identity was ever linked to it, unless it
 	 * holds the owner role, taking the facts' name when the backfill named it by its id, and is
-	 * otherwise admitted as a new principal when the rules give it a tier. Both happen only when `provisioning` is `admitted`; under `linked` only identities
+	 * otherwise admitted as a new principal when the rules give it a tier. Both happen only when `provisioning` is `admitted` on the contact's surface; under `linked` only identities
 	 * already linked are served. A disabled principal is no one. The tier is the higher of the
 	 * principal's lasting roles and what the rules give the facts on this contact.
 	 */
@@ -392,7 +393,8 @@ export class PgIdentityService implements IdentityService, ContactAssessor {
 		facts: ActorFacts,
 		conversation: ChannelKey | undefined,
 	): Promise<{ principalId: string; tier: Tier } | undefined> {
-		if (this.#rules.provisioning !== "admitted") return undefined;
+		if (provisioningFor(this.#rules, facts, conversation) !== "admitted")
+			return undefined;
 		// An owner's identity, or a plugin's, is its principal's alone, linked at boot: unlinked
 		// meanwhile, it is no one until then.
 		if (this.#bootIdentities.has(identityOf(facts))) return undefined;
@@ -434,7 +436,7 @@ export class PgIdentityService implements IdentityService, ContactAssessor {
 		let link = await this.store.identity(ref.provider, ref.subject);
 		if (
 			!link &&
-			this.#rules.provisioning === "admitted" &&
+			provisioningFor(this.#rules, facts, conversation) === "admitted" &&
 			!this.#bootIdentities.has(identityOf(ref))
 		) {
 			if (assessed === facts.legacyId)

package/src/core/identity/principal-store.ts

@@ -1,9 +1,33 @@
 import type { SQL } from "bun";
-import type { Pronouns } from "../config/config.ts";
 import { IdentityError } from "../domain/errors.ts";
 import type { Tier } from "../speakers.ts";
+import type {
+	IdentityLink,
+	IdentityRef,
+	LinkSource,
+	NewPrincipal,
+	PrincipalRecord,
+	PrincipalStore,
+	Pronouns,
+	RoleGrant,
+	RoleHolder,
+	RoleSource,
+} from "./principal-types.ts";
 import { isPrincipalId, newPrincipalId } from "./ulid.ts";
 
+export type {
+	IdentityLink,
+	IdentityRef,
+	LinkSource,
+	NewPrincipal,
+	Principal,
+	PrincipalRecord,
+	PrincipalStore,
+	Pronouns,
+	RoleGrant,
+	RoleHolder,
+	RoleSource,
+} from "./principal-types.ts";
 /** The principal the host's own turns run as: an ops report, a webhook's. It has no identity, cannot sign in, and keeps no memory. */
 export const SYSTEM_PRINCIPAL = "system";
 
@@ -16,41 +40,6 @@ export const LEGACY_PROVIDER = "legacy";
 /** 0.8's speaker id for the owner writing through an outside agent over MCP: the primary owner. */
 export const LEGACY_REMOTE_SPEAKER = "remote-mcp";
 
-export type { Pronouns };
-
-/** A person the host serves, whichever surface they reach it through. */
-export interface Principal {
-	/** Opaque: a speaker id carried over from 0.8, or `p_<ulid>` for one made since. */
-	id: string;
-	displayName: string;
-	pronouns?: Pronouns;
-	disabled: boolean;
-}
-
-/** A principal as stored, with when it was made and when it was last seen. */
-export interface PrincipalRecord extends Principal {
-	locale?: string;
-	timeZone?: string;
-	createdAt: Date;
-	lastSeenAt?: Date;
-	/** The tier it was last seen at; it only ever lowers what a background turn may do, never grants. */
-	lastTier?: Tier;
-	/** Whether the person of its 0.8 speaker id may still claim it: only one the backfill made, until any identity is linked to it. */
-	claimable: boolean;
-}
-
-/** An identity on one provider: `discord` and a user id, `oidc:<issuer>` and a subject, `token` and a name. */
-export interface IdentityRef {
-	provider: string;
-	subject: string;
-}
-
-/**
- * How an identity came to be linked: by the configuration, a plugin declaring it
- * (`RoundtablePlugin.identities`), the CLI, admission on first contact, or a 0.8 speaker id claimed.
- */
-export type LinkSource = "config" | "plugin" | "cli" | "jit" | "legacy";
-
 /** Which source a link made again by another becomes: the configuration's over all, a plugin's over the rest. */
 const LINK_RANK: Readonly<Record<LinkSource, number>> = {
 	config: 2,
@@ -58,106 +47,9 @@ const LINK_RANK: Readonly<Record<LinkSource, number>> = {
 	cli: 0,
 	jit: 0,
 	legacy: 0,
+	self: 0,
 };
 
-export interface IdentityLink extends IdentityRef {
-	principalId: string;
-	source: LinkSource;
-	linkedAt: Date;
-}
-
-/** Where a role came from. The configuration's are synced at every boot; a CLI grant stays until the CLI revokes it. */
-export type RoleSource = "config" | "cli";
-
-export interface RoleGrant {
-	role: Tier;
-	source: RoleSource;
-	grantedAt: Date;
-}
-
-/** A principal holding a role, and where the role came from. */
-export interface RoleHolder {
-	principalId: string;
-	source: RoleSource;
-}
-
-export interface NewPrincipal {
-	/** The id to keep, for a principal carried over from 0.8; otherwise a new `p_` id is made. */
-	id?: string;
-	displayName: string;
-	pronouns?: Pronouns;
-}
-
-/** The principals, their linked identities, and their lasting roles. */
-export interface PrincipalStore {
-	get(id: string): Promise<PrincipalRecord | undefined>;
-	list(): Promise<PrincipalRecord[]>;
-	/** Refuses an id already taken, and the system principal's. */
-	create(input: NewPrincipal): Promise<PrincipalRecord>;
-	/** Changes the name or the pronouns; `pronouns: null` clears them. */
-	update(
-		id: string,
-		change: { displayName?: string; pronouns?: Pronouns | null },
-	): Promise<PrincipalRecord | undefined>;
-	/**
-	 * Links the identity to the principal; linking it again to the same one changes nothing, but
-	 * that the configuration linking it makes the link the configuration's, and a plugin linking it
-	 * makes one the CLI, a first contact, or a claim made the plugin's; to another one is refused. A
-	 * principal with any identity linked is no longer claimable, even after the identity is
-	 * unlinked, except by a plugin's link: a plugin's credential is not the person's own identity,
-	 * so it leaves their 0.8 claim to them.
-	 */
-	link(
-		principalId: string,
-		identity: IdentityRef,
-		source: LinkSource,
-	): Promise<IdentityLink>;
-	/**
-	 * The identity's link, claiming the principal for it when the identity is still unlinked and
-	 * the principal claimable and not an owner; undefined when it may not be claimed. A principal
-	 * is claimed at most once. A claim names the principal `displayName`, when given, while its
-	 * name is still its id, as the backfill names someone it knows no name of; a real name stays.
-	 */
-	claim(
-		principalId: string,
-		identity: IdentityRef,
-		displayName?: string,
-	): Promise<IdentityLink | undefined>;
-	/**
-	 * The identity's link, making a new `p_` principal for it, of `id` when given, when it is still
-	 * unlinked; however many contacts admit it at once, one principal is made.
-	 */
-	admit(
-		identity: IdentityRef,
-		displayName: string,
-		id?: string,
-	): Promise<IdentityLink>;
-	/** Whether there was a link to remove. */
-	unlink(provider: string, subject: string): Promise<boolean>;
-	identity(
-		provider: string,
-		subject: string,
-	): Promise<IdentityLink | undefined>;
-	identitiesOf(principalId: string): Promise<IdentityLink[]>;
-	/** Every link made by `source`, such as the configuration's. */
-	linksFrom(source: LinkSource): Promise<IdentityLink[]>;
-	/** Grants a lasting role. A CLI grant is kept as the CLI's even when the configuration grants the same role. */
-	grant(principalId: string, role: Tier, source: RoleSource): Promise<void>;
-	/** Revokes the role, or only the grant from `source`; whether there was one to revoke. */
-	revoke(
-		principalId: string,
-		role: Tier,
-		source?: RoleSource,
-	): Promise<boolean>;
-	rolesOf(principalId: string): Promise<RoleGrant[]>;
-	/** Every principal holding the role. */
-	holders(role: Tier): Promise<RoleHolder[]>;
-	disable(id: string): Promise<void>;
-	enable(id: string): Promise<void>;
-	/** Records that the principal was seen at `at` (default now), at this tier, or null when refused. */
-	touch(id: string, tier: Tier | null, at?: Date): Promise<void>;
-}
-
 interface PrincipalRow {
 	id: string;
 	display_name: string;
@@ -302,14 +194,29 @@ export class PgPrincipalStore implements PrincipalStore {
 					RETURNING *`;
 				return linkOf(owned[0] ?? existing);
 			}
+			// A person's own link is refused to an owner, judged in this write rather than on a cached read.
 			const spent =
 				source === "plugin"
 					? await tx`SELECT id FROM principals WHERE id = ${principalId}`
-					: await tx`
-						UPDATE principals SET claimable = false WHERE id = ${principalId}
-						RETURNING id`;
-			if (spent.length === 0)
+					: source === "self"
+						? await tx`
+							UPDATE principals SET claimable = false
+							WHERE id = ${principalId} AND NOT EXISTS (
+								SELECT 1 FROM principal_roles WHERE principal_id = ${principalId} AND role = 'owner'
+							)
+							RETURNING id`
+						: await tx`
+							UPDATE principals SET claimable = false WHERE id = ${principalId}
+							RETURNING id`;
+			if (spent.length === 0) {
+				const present =
+					await tx`SELECT id FROM principals WHERE id = ${principalId}`;
+				if (present.length > 0)
+					throw new IdentityError(
+						`principal ${principalId} is an owner; owners' identities are linked in access.owners or with roundtable principal link`,
+					);
 				throw new IdentityError(`there is no principal ${principalId}`);
+			}
 			const made: IdentityRow[] = await tx`
 				INSERT INTO principal_identities (provider, subject, principal_id, source)
 				VALUES (${provider}, ${subject}, ${principalId}, ${source})
@@ -377,10 +284,20 @@ export class PgPrincipalStore implements PrincipalStore {
 		});
 	}
 
-	async unlink(provider: string, subject: string): Promise<boolean> {
-		const rows = await this.#sql`
-			DELETE FROM principal_identities WHERE provider = ${provider} AND subject = ${subject}
-			RETURNING provider`;
+	async unlink(
+		provider: string,
+		subject: string,
+		source?: LinkSource,
+	): Promise<boolean> {
+		const rows =
+			source === undefined
+				? await this.#sql`
+					DELETE FROM principal_identities WHERE provider = ${provider} AND subject = ${subject}
+					RETURNING provider`
+				: await this.#sql`
+					DELETE FROM principal_identities
+					WHERE provider = ${provider} AND subject = ${subject} AND source = ${source}
+					RETURNING provider`;
 		return rows.length > 0;
 	}
 

package/src/core/identity/principal-tables.ts

@@ -44,10 +44,18 @@ export const PRINCIPALS_CLAIMABLE = async (sql: SQL): Promise<void> => {
 	await sql`ALTER TABLE principals ADD COLUMN IF NOT EXISTS claimable boolean NOT NULL DEFAULT false`;
 };
 
-/** Links a plugin declares: their own source, beside the four the tables were made with. */
+/** Links a plugin declares: their own source, beside the four the tables were made with. It accepts `self` too, so a rerun on a database that holds self links does not fail. */
 export const PRINCIPAL_PLUGIN_LINKS = async (sql: SQL): Promise<void> => {
 	await sql`ALTER TABLE principal_identities DROP CONSTRAINT IF EXISTS principal_identities_source_check`;
 	await sql`
 		ALTER TABLE principal_identities ADD CONSTRAINT principal_identities_source_check
-		CHECK (source IN ('config', 'plugin', 'cli', 'jit', 'legacy'))`;
+		CHECK (source IN ('config', 'plugin', 'cli', 'jit', 'legacy', 'self'))`;
+};
+
+/** Links people make themselves through `IDENTITY_LINKS`: their own source, beside the five before it. */
+export const PRINCIPAL_SELF_LINKS = async (sql: SQL): Promise<void> => {
+	await sql`ALTER TABLE principal_identities DROP CONSTRAINT IF EXISTS principal_identities_source_check`;
+	await sql`
+		ALTER TABLE principal_identities ADD CONSTRAINT principal_identities_source_check
+		CHECK (source IN ('config', 'plugin', 'cli', 'jit', 'legacy', 'self'))`;
 };