memgres 0.10.0__tar.gz → 0.12.0__tar.gz

{memgres-0.10.0 → memgres-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgres
-Version: 0.10.0
+Version: 0.12.0
 Summary: Drop-in memory for AI agents: one Postgres, lexical + semantic recall, diff-versioned history, GDPR-erasable.
 Author: mozgsml
 License-Expression: MIT
@@ -216,6 +216,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
 | `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
+| `MEMGRES_REQUIRED_FIELDS` | — | comma-separated fields a content-storing write must carry (`source`, `reason`), refused by name when absent. A policy about a corpus, not a property of the software: a scratch database wants none, a corporate one wants `source`. `move`/`retag` are exempt. Announced in `server_info.write_requirements` |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |
 | `MEMGRES_REQUIRE_PARENT` | `false` | `true` = a node's parent path must already exist |
 | `MEMGRES_HISTORY` | `true` | keep the hash-chained diff history (deleted with the record) |

{memgres-0.10.0 → memgres-0.12.0}/README.md

@@ -180,6 +180,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
 | `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
+| `MEMGRES_REQUIRED_FIELDS` | — | comma-separated fields a content-storing write must carry (`source`, `reason`), refused by name when absent. A policy about a corpus, not a property of the software: a scratch database wants none, a corporate one wants `source`. `move`/`retag` are exempt. Announced in `server_info.write_requirements` |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |
 | `MEMGRES_REQUIRE_PARENT` | `false` | `true` = a node's parent path must already exist |
 | `MEMGRES_HISTORY` | `true` | keep the hash-chained diff history (deleted with the record) |

{memgres-0.10.0 → memgres-0.12.0}/memgres/__init__.py

@@ -23,7 +23,7 @@ from .schema import migrate, SchemaMismatch, SCHEMA_VERSION
 from .search import Hit, recall
 from .blame import annotate, annotate_grouped, reconstruct, replay
 from .store import (Store, Memory, Conflict, NotFound, TooLarge, NoParent,
-                    MissingTitle)
+                    MissingTitle, MissingField)
 from .identity import (
     Principal, AuthError, SpaceNotFound,
     resolve, resolve_space, new_token, valid_format,
@@ -38,6 +38,7 @@ __all__ = [
     "Config", "load_config",
     "Store", "Memory", "Conflict", "NotFound", "TooLarge", "NoParent",
     "MissingTitle",
+    "MissingField",
     "make_diff", "apply_diff", "content_hash", "DiffConflict",
     "Embedder", "get_embedder",
     "migrate", "SchemaMismatch", "SCHEMA_VERSION",

{memgres-0.10.0 → memgres-0.12.0}/memgres/_version.py

@@ -8,4 +8,4 @@ here at release; nowhere else carries the number.
 PEP 440: a ``.devN`` suffix marks an unreleased build ahead of the last tag.
 """
 
-__version__ = "0.10.0"
+__version__ = "0.12.0"

{memgres-0.10.0 → memgres-0.12.0}/memgres/admin.py

@@ -362,7 +362,14 @@ def edit_namespace(conn, p: Principal, *, namespace_id: str,
     the instruction agents read to choose a namespace could not be fixed through
     any door at all.
     """
-    require_namespace_admin(conn, p, namespace_id)
+    # Description and instruction are administration; the NAME is closer to
+    # disposal — renaming out from under an owner breaks every by-name call they
+    # and every member make, and an admin member was given authority over the
+    # contents, not over how the namespace is addressed.
+    if name is not None:
+        require_namespace_owner(conn, p, namespace_id)
+    else:
+        require_namespace_admin(conn, p, namespace_id)
     identity.edit_namespace(conn, namespace_id, description=description,
                             instruction=instruction, name=name)
     out = {"namespace_id": namespace_id}
@@ -382,6 +389,11 @@ def require_namespace_owner(conn, p: Principal, namespace_id: str) -> None:
     matters here — which is why this is its own check rather than a flag.
     """
     require_namespace_admin(conn, p, namespace_id)      # ceiling + scope + exists
+    # A namespace-pinned token is issued to WORK in that namespace; disposing of
+    # it is a step beyond what the pin implies, and the deployment-wide acts all
+    # demand an unscoped credential for the same reason.
+    if p.scope_namespace_id is not None:
+        raise Forbidden("this act needs an unscoped admin credential")
     if p.is_admin:
         return
     if identity.namespace_owner(conn, namespace_id) != p.user_id:
@@ -505,7 +517,7 @@ def _unreachable_warning(conn, user_id: str,
 def issue_token(conn, p: Principal, *, user_id: str,
                 namespace_id: Optional[str] = None, permission: str = "write",
                 label: str = "", expires_days: Optional[int] = None,
-                sink_dir: str = "") -> dict:
+                sink_dir: str = "", defer_delivery: bool = False) -> dict:
     """Mint a token for `user_id`. The secret is returned once and never again.
 
     `expires_days` rather than a timestamp: both doors were converting the same
@@ -525,12 +537,39 @@ def issue_token(conn, p: Principal, *, user_id: str,
     secret, tid = identity.issue_token(conn, user_id, namespace_id=namespace_id,
                                        permission=permission, label=label,
                                        expires_at=expires_at)
+    if defer_delivery:
+        # The caller will commit and THEN write the file. Writing it inside the
+        # transaction leaves a 0600 file holding a live-looking secret for a
+        # token that a rollback removed — the CLI already delivers outside its
+        # transaction for exactly this reason, and the doors did not.
+        return {"secret": secret, "id": tid, "warning": warning}
     out = deliver_secret(secret, tid, sink_dir)
     if warning:
         out["warning"] = warning
     return out
 
 
+def deliver_key(out: dict, sink_dir: str) -> dict:
+    """Apply the deployment's delivery policy to a freshly minted ENROLLMENT KEY.
+
+    The 0.9.0 wave took the token out of the reply and left the key in it — but
+    a key is a bearer credential for as long as it lives, and whoever reads it
+    first gets the account it names. An operator who set a sink said "secrets do
+    not come back in replies", and meant this one too.
+    """
+    if not sink_dir or "key" not in out:
+        return out
+    key = out.pop("key")
+    out["path"] = identity.stash_secret(sink_dir, out["id"], key,
+                                        suffix=".key")
+    out["delivered"] = "file"
+    out["exposed"] = False
+    out["note"] = ("the key was written to that file on the server and "
+                   "deliberately NOT returned here — read it there and hand it "
+                   "to its owner")
+    return out
+
+
 def deliver_secret(secret: str, token_id: str, sink_dir: str) -> dict:
     """The reply for a freshly minted token: the secret itself, or — when the
     deployment set a sink — only where it was put. One function so both minting
@@ -583,7 +622,11 @@ def list_enrollments(conn, p: Principal, *,
     require_manage_users(p)
     if user_id is not None:
         _require_target_is_plain_user(conn, p, user_id, "listing enrollment keys")
-    return identity.list_enrollments(conn, user_id=user_id)
+        return identity.list_enrollments(conn, user_id=user_id)
+    # Unfiltered, the listing handed a user_manager the credential timeline of
+    # the accounts ABOVE it — `list_tokens` refuses exactly that. The guard has
+    # to apply to the shape without a target too, or it is only a speed bump.
+    return identity.list_enrollments(conn, plain_users_only=not p.is_admin)
 
 
 def revoke_enrollment(conn, p: Principal, *, enrollment_id: str) -> bool:
@@ -692,11 +735,26 @@ def request_access(conn, p: Principal, *, namespace_id: str,
     """
     if p.user_id is None:
         raise identity.AuthError("this token has no owning user")
+    # You may not ask for more than this credential could exercise if granted.
+    # A read-only agent token filing an `admin` request is the input half of an
+    # over-grant: the approver sees a plausible ask and the account keeps the
+    # membership long after that token is gone.
+    permission = identity.perm_min(permission, p.permission)
     perm = identity.reaches(conn, p.user_id, namespace_id)
     if perm is not None:
         return {"status": "already_reachable", "permission": perm}
     identity.request_access(conn, p.user_id, namespace_id, permission)
-    return {"status": "submitted"}
+    # What is actually pending, which is not always what was asked: a request
+    # you already hold may be lowered but not raised, and a read-only credential
+    # cannot ask beyond its ceiling. Saying so beats a receipt that agrees with
+    # you and a grant that does not.
+    with conn.cursor() as cur:
+        cur.execute("SELECT requested_permission FROM access_request WHERE "
+                    "requester_user_id=%s AND namespace_id=%s",
+                    (p.user_id, identity._as_uuid(namespace_id)))
+        row = cur.fetchone()
+    return {"status": "submitted",
+            "permission": row[0] if row else permission}
 
 
 def list_requests(conn, p: Principal, *, namespace_id: str) -> List[dict]:
@@ -705,16 +763,32 @@ def list_requests(conn, p: Principal, *, namespace_id: str) -> List[dict]:
     return identity.list_requests(conn, namespace_id)
 
 
-def decide_access(conn, p: Principal, *, request_id: str, approve: bool) -> None:
-    """Approve or deny a request, authorized against the namespace it targets."""
+def decide_access(conn, p: Principal, *, request_id: str, approve: bool,
+                  expect_permission: Optional[str] = None) -> None:
+    """Approve or deny a request, authorized against the namespace it targets.
+
+    `expect_permission` is the permission the approver SAW in `list_requests`.
+    Pass it: without it, approval grants whatever the row says when it is read,
+    and a requester can raise their own pending ask between the listing and the
+    decision. `request_access` no longer amends a pending request, so this is
+    the second lock on the same door rather than the only one.
+
+    Both "no such request" and "a request you may not decide" answer the same
+    way, for the same reason `request_access` does: which uuids are real is not
+    something a refusal should confirm.
+    """
     with conn.cursor() as cur:
         cur.execute("SELECT namespace_id FROM access_request WHERE id=%s",
                     (request_id,))
         row = cur.fetchone()
     if row is None:
         raise identity.SpaceNotFound("no such request")
-    require_namespace_admin(conn, p, str(row[0]))
+    try:
+        require_namespace_admin(conn, p, str(row[0]))
+    except (Forbidden, identity.SpaceNotFound):
+        raise identity.SpaceNotFound("no such request") from None
     if approve:
-        identity.approve_request(conn, request_id)
+        identity.approve_request(conn, request_id,
+                                 expect_permission=expect_permission)
     else:
         identity.deny_request(conn, request_id)

{memgres-0.10.0 → memgres-0.12.0}/memgres/bootstrap.py

@@ -44,22 +44,26 @@ def _read_or_create_token_file(path: str) -> Tuple[str, Optional[str]]:
     """Return ``(secret, generated_path)``. If the file has a token, read it
     (``generated_path`` None). If missing/empty, generate a fresh ``mgk_`` token,
     write it ``0600``, and return the path so the caller can log it."""
+    # O_NOFOLLOW on the READ as well: whoever can plant a symlink here would
+    # otherwise CHOOSE the deployment's bootstrap admin token by pointing this
+    # at a file they wrote. Reading through it is the more dangerous half.
     try:
-        with open(path, "r", encoding="utf-8") as f:
+        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
+        with os.fdopen(fd, "r", encoding="utf-8") as f:
             existing = f.read().strip()
     except FileNotFoundError:
         existing = ""
     except OSError as e:                                  # unreadable → fail loud
-        raise BootstrapError(f"cannot read MEMGRES_ADMIN_TOKEN_FILE {path!r}: {e}")
+        raise BootstrapError(
+            f"cannot read MEMGRES_ADMIN_TOKEN_FILE {path!r}: {e}"
+            + (" (a symlink is refused here on purpose)"
+               if os.path.islink(path) else ""))
     if existing:
         return existing, None
 
     secret = identity.new_token()
     try:
-        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-        with os.fdopen(fd, "w", encoding="utf-8") as f:
-            f.write(secret + "\n")
-        os.chmod(path, 0o600)            # tighten even if the file pre-existed
+        identity.write_private(path, secret + "\n")
     except OSError as e:
         raise BootstrapError(f"cannot write MEMGRES_ADMIN_TOKEN_FILE {path!r}: {e}")
     return secret, path

{memgres-0.10.0 → memgres-0.12.0}/memgres/config.py

@@ -79,6 +79,8 @@ class Config:
     # organization
     tree_enabled: bool           # ltree path column + GiST index for fast subtree selection
     require_title: bool          # True = a write that stores CONTENT must caption it
+    required_fields: tuple       # extra fields a content-storing write must carry
+                                 # (MEMGRES_REQUIRED_FIELDS=source), refused when absent
     require_parent: bool         # False = sparse paths (create food.apple with no food row);
                                  # True = a node's parent path must already exist as a memory
     # history
@@ -222,6 +224,10 @@ def load() -> Config:
         token_sink=_str("MEMGRES_TOKEN_SINK", ""),
         tree_enabled=_bool("MEMGRES_TREE", True),
         require_title=_bool("MEMGRES_REQUIRE_TITLE", True),
+        required_fields=tuple(
+            f for f in (x.strip().lower()
+                        for x in _str("MEMGRES_REQUIRED_FIELDS", "").split(","))
+            if f),
         require_parent=_bool("MEMGRES_REQUIRE_PARENT", False),
         history_enabled=_bool("MEMGRES_HISTORY", True),
         fts_language=_str("MEMGRES_FTS_LANGUAGE", "simple"),

{memgres-0.10.0 → memgres-0.12.0}/memgres/identity.py

@@ -27,12 +27,15 @@ from __future__ import annotations
 import datetime as dt
 import hashlib
 import hmac
+import logging
 import os
 import re
 import secrets
 from dataclasses import dataclass
 from typing import List, Optional, Sequence, Tuple
 
+logger = logging.getLogger("memgres.identity")
+
 # ─── token format: mgk_ + 43 url-safe chars (256-bit) ────────────────────────
 TOKEN_RE = re.compile(r"^mgk_[A-Za-z0-9_-]{43}$")
 
@@ -205,7 +208,22 @@ def resolve(conn, cfg, secret: Optional[str], *, touch: bool = True) -> Principa
                     # an account that is off has to be off for every token it
                     # holds and every one it could still be issued, and the only
                     # place all of those meet is authentication.
-                    raise AuthError("this account is disabled")
+                    #
+                    # One exception, and it is the recovery path: bootstrap
+                    # stores the env secret AS A TOKEN of the seeded admin, so
+                    # this lookup matches it first and disabling that account
+                    # would take the operator's out-of-band way back in with it.
+                    # Two ordinary control-plane calls could then leave a
+                    # deployment nobody can enter. The env secret keeps working,
+                    # as the anonymous root it is when no account holds it.
+                    if not (cfg.admin_token
+                            and hmac.compare_digest(secret, cfg.admin_token)):
+                        raise AuthError("this account is disabled")
+                    logger.warning(
+                        "memgres: the bootstrap admin account is disabled; the "
+                        "env break-glass token authenticated as anonymous root")
+                    return Principal(user_id=None, permission="admin",
+                                     scope_namespace_id=None, is_admin=True)
                 if touch:
                     cur.execute("UPDATE token SET last_used_at=now() WHERE id=%s",
                                 (tid,))
@@ -779,21 +797,43 @@ def list_users(conn, *, role: Optional[str] = None, limit: Optional[int] = None,
 
 
 # ─── service roles (control plane; see SERVICE_ROLES) ────────────────────────
+# Every anti-lockout count asks the same question — "is anyone left who can
+# undo this?" — and a disabled account is not anyone. Two of these used to count
+# disabled admins as present, which let the guards be walked around: disable the
+# second superadmin (allowed, two are active), then DEMOTE the first through
+# `revoke_superadmin`, which saw two superadmins and agreed. End state: zero
+# active superadmins and recovery by hand-editing the database.
+_ACTIVE_ADMIN = "role IN ('user_manager','superadmin') AND disabled_at IS NULL"
+_ACTIVE_SUPERADMIN = "role='superadmin' AND disabled_at IS NULL"
+
+
 def count_service_admins(conn) -> int:
-    """How many users hold an admin role (user_manager or superadmin). Zero ⇒ a
-    fresh install with no control plane — the trigger for bootstrap seeding."""
+    """How many users hold an admin role AND can still use it. Zero ⇒ nobody is
+    running the control plane — the trigger for bootstrap seeding, which is
+    exactly what should happen when the last admin has been switched off."""
     with conn.cursor() as cur:
-        cur.execute("SELECT count(*) FROM app_user WHERE role IN "
-                    "('user_manager','superadmin')")
+        cur.execute(f"SELECT count(*) FROM app_user WHERE {_ACTIVE_ADMIN}")
         return int(cur.fetchone()[0])
 
 
 def count_superadmins(conn) -> int:
+    """Active superadmins. See `_ACTIVE_ADMIN` for why `disabled_at` matters."""
     with conn.cursor() as cur:
-        cur.execute("SELECT count(*) FROM app_user WHERE role='superadmin'")
+        cur.execute(f"SELECT count(*) FROM app_user WHERE {_ACTIVE_SUPERADMIN}")
         return int(cur.fetchone()[0])
 
 
+def _lock_admin_rows(cur) -> None:
+    """Serialize the anti-lockout guards against each other.
+
+    Both `set_disabled` and `revoke_superadmin` read a count and then write.
+    Two sessions removing the last two superadmins each saw two, and both were
+    allowed. Locking the admin rows first makes the second one read the first
+    one's result instead of the state it started from.
+    """
+    cur.execute(f"SELECT id FROM app_user WHERE {_ACTIVE_ADMIN} FOR UPDATE")
+
+
 def get_role(conn, user_id: str) -> Optional[str]:
     with conn.cursor() as cur:
         cur.execute("SELECT role FROM app_user WHERE id=%s", (user_id,))
@@ -828,9 +868,10 @@ def revoke_superadmin(conn, user_id: str, *, demote_to: str = "user") -> None:
             raise SpaceNotFound(f"no such user {user_id}")
         if row[0] != "superadmin":
             return                        # nothing to revoke
-        cur.execute("SELECT count(*) FROM app_user WHERE role='superadmin'")
+        _lock_admin_rows(cur)
+        cur.execute(f"SELECT count(*) FROM app_user WHERE {_ACTIVE_SUPERADMIN}")
         if int(cur.fetchone()[0]) <= 1:
-            raise AuthError("cannot revoke the last superadmin")
+            raise AuthError("cannot revoke the last active superadmin")
         cur.execute("UPDATE app_user SET role=%s WHERE id=%s", (demote_to, user_id))
 
 
@@ -853,8 +894,8 @@ def set_disabled(conn, user_id: str, disabled: bool) -> dict:
             return {"user_id": str(user_id), "disabled": bool(disabled),
                     "unchanged": True}
         if disabled and role == "superadmin":
-            cur.execute("SELECT count(*) FROM app_user WHERE role='superadmin' "
-                        "AND disabled_at IS NULL")
+            _lock_admin_rows(cur)
+            cur.execute(f"SELECT count(*) FROM app_user WHERE {_ACTIVE_SUPERADMIN}")
             if int(cur.fetchone()[0]) <= 1:
                 raise AuthError("cannot disable the last active superadmin")
         cur.execute("UPDATE app_user SET disabled_at = %s WHERE id=%s",
@@ -1139,8 +1180,28 @@ def transfer_namespace(conn, namespace_id: str, new_owner_user_id: str, *,
         # The receiving account has its own names and aliases, and (owner, name)
         # is unique: without this the transfer dies on a constraint violation
         # rather than on an explanation.
-        _require_name_free(cur, str(new_owner_user_id), name,
-                           except_namespace_id=namespace_id)
+        #
+        # The message deliberately does NOT say which of theirs it collides
+        # with. Quoting the target's inventory made this a free, repeatable
+        # probe of another tenant's namespace names — the check runs before the
+        # UPDATE, so a positive costs the prober nothing.
+        try:
+            _require_name_free(cur, str(new_owner_user_id), name,
+                               except_namespace_id=namespace_id)
+        except SpaceAmbiguous:
+            raise SpaceAmbiguous(
+                "the receiving account cannot hold a namespace by this name — "
+                "rename it first, then transfer") from None
+        # The per-account cap is enforced where namespaces are CREATED; a
+        # transfer is the other way one arrives. Without this an account could
+        # mint its 50, push them onto someone else, and repeat — leaving a
+        # victim owning namespaces they never asked for and cannot delete.
+        cur.execute("SELECT count(*) FROM namespace WHERE owner_user_id=%s",
+                    (_as_uuid(new_owner_user_id),))
+        if cur.fetchone()[0] >= MAX_NAMESPACES_PER_USER:
+            raise SpaceAmbiguous(
+                f"the receiving account already owns {MAX_NAMESPACES_PER_USER} "
+                "namespaces, which is the cap")
         cur.execute("DELETE FROM namespace_member WHERE namespace_id=%s AND "
                     "user_id=%s", (_as_uuid(namespace_id), _as_uuid(new_owner_user_id)))
         cur.execute("UPDATE namespace SET owner_user_id=%s WHERE id=%s",
@@ -1258,8 +1319,9 @@ def issue_token(conn, user_id: str, *, namespace_id: Optional[str] = None,
         return secret, str(cur.fetchone()[0])
 
 
-def stash_secret(sink_dir: str, token_id: str, secret: str) -> str:
-    """Write a freshly minted secret to ``<sink_dir>/<token_id>.token`` (0600)
+def stash_secret(sink_dir: str, token_id: str, secret: str,
+                 *, suffix: str = ".token") -> str:
+    """Write a freshly minted secret to ``<sink_dir>/<token_id><suffix>`` (0600)
     and return the path.
 
     The out-of-band delivery channel for a deployment whose callers are agents.
@@ -1271,15 +1333,57 @@ def stash_secret(sink_dir: str, token_id: str, secret: str) -> str:
     The directory is created 0700 if missing, and the file is opened with
     ``O_CREAT`` at 0600 so the secret is never briefly world-readable.
     """
-    os.makedirs(sink_dir, mode=0o700, exist_ok=True)
-    path = os.path.join(sink_dir, f"{token_id}.token")
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    with os.fdopen(fd, "w") as fh:
-        fh.write(secret + "\n")
-    os.chmod(path, 0o600)               # tighten even if the file pre-existed
+    _make_private_dir(sink_dir)
+    path = os.path.join(sink_dir, f"{token_id}{suffix}")
+    write_private(path, secret + "\n")
     return path
 
 
+def _make_private_dir(path: str) -> None:
+    """Create `path` (and its parents) 0700, and tighten it if it already exists.
+
+    `os.makedirs(mode=…)` applies the mode to the LEAF only, and not at all to a
+    directory that is already there — so a sink an operator made by hand at 0755
+    stayed 0755, and every intermediate directory was created 0775. The
+    docstring above used to promise otherwise, which is the worse half: an
+    operator who read it believed the secrets were private.
+    """
+    parts = []
+    head = os.path.abspath(path)
+    while head and not os.path.isdir(head):
+        head, tail = os.path.split(head)
+        parts.append(os.path.join(head, tail))
+    for d in reversed(parts):
+        os.mkdir(d, 0o700)
+    if os.path.isdir(path) and not os.path.islink(path):
+        os.chmod(path, 0o700)
+
+
+def write_private(path: str, text: str) -> None:
+    """Write `text` to `path` as a fresh 0600 file, refusing to follow a symlink.
+
+    Three defects this closes, all measured:
+
+    * without ``O_NOFOLLOW`` the write follows a symlink, so anyone who can
+      plant one where a secret is about to land redirects it into a file they
+      own — proven end to end with the provisioning CLI;
+    * without ``O_EXCL`` (and the unlink before it), ``O_CREAT``'s mode is
+      IGNORED for a file that already exists, so the secret sat in a 0644 file
+      for the duration of the write and only became 0600 afterwards;
+    * a partially written secret is never left behind, because the target is
+      removed and recreated rather than truncated in place.
+    """
+    try:
+        os.unlink(path)
+    except FileNotFoundError:
+        pass
+    except IsADirectoryError:
+        raise ValueError(f"{path} is a directory") from None
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+    with os.fdopen(fd, "w") as fh:
+        fh.write(text)
+
+
 # ─── enrollment: bind a token the client generated itself ────────────────────
 def new_enrollment_key() -> str:
     """A fresh one-time key: ``mge_`` + 43 url-safe chars."""
@@ -1381,6 +1485,15 @@ def redeem_enrollment(conn, key: str, secret: str) -> dict:
         if cur.fetchone() is not None:
             raise AuthError("that credential is already known to this server — "
                             "generate a fresh one")
+        # An offboarded account still had usable keys in flight: the binding
+        # succeeded, the key was spent, the reply said "bound" — and the token
+        # was refused at the first call. No access was gained, but the answer
+        # was a lie and the key was gone. Refuse while it still costs nothing.
+        cur.execute("SELECT 1 FROM app_user WHERE id=%s AND disabled_at IS NOT NULL",
+                    (uid,))
+        if cur.fetchone() is not None:
+            raise AuthError("that account is disabled — ask whoever issued this "
+                            "key to re-enable it first")
         tid = register_token(conn, str(uid), secret, namespace_id=
                              str(nsid) if nsid else None,
                              permission=perm, label=label or "enrolled")
@@ -1391,19 +1504,31 @@ def redeem_enrollment(conn, key: str, secret: str) -> dict:
             "enrollment_id": str(eid)}
 
 
-def list_enrollments(conn, *, user_id: Optional[str] = None) -> List[dict]:
-    """Pending and spent keys — metadata only, never the key itself."""
+def list_enrollments(conn, *, user_id: Optional[str] = None,
+                     plain_users_only: bool = False) -> List[dict]:
+    """Pending and spent keys — metadata only, never the key itself.
+
+    `plain_users_only` hides keys belonging to admin-role accounts, which is
+    what the provisioning tier is allowed to see (see `admin.list_enrollments`).
+    """
     # `expired` is computed by the DATABASE: the key's clock and the reader's
     # are not the same clock, and a listing that disagreed with what redeeming
     # does would be worse than no listing.
-    sql = ("SELECT id, user_id, namespace_id, permission, label, created_by, "
-           "created_at, expires_at, used_at, used_token_id, revoked_at, "
-           "expires_at <= now() AS expired FROM enrollment_key")
+    sql = ("SELECT k.id, k.user_id, k.namespace_id, k.permission, k.label, "
+           "k.created_by, k.created_at, k.expires_at, k.used_at, "
+           "k.used_token_id, k.revoked_at, k.expires_at <= now() AS expired "
+           "FROM enrollment_key k")
     args: list = []
+    where = []
     if user_id is not None:
-        sql += " WHERE user_id=%s"
+        where.append("k.user_id=%s")
         args.append(user_id)
-    sql += " ORDER BY created_at DESC, id"
+    if plain_users_only:
+        sql += " JOIN app_user u ON u.id = k.user_id"
+        where.append("u.role = 'user'")
+    if where:
+        sql += " WHERE " + " AND ".join(where)
+    sql += " ORDER BY k.created_at DESC, k.id"
     with conn.cursor() as cur:
         cur.execute(sql, args)
         cols = [c.name for c in cur.description]
@@ -1578,14 +1703,42 @@ def request_access(conn, requester_user_id: str, namespace_id: str,
                 raise ValueError(
                     f"you already have {MAX_PENDING_REQUESTS_PER_USER} requests "
                     "waiting to be decided, which is the cap")
+        # 🔴 A PENDING request may be LOWERED but never RAISED. It used to be
+        # freely rewritable, so a requester could file `read`, let the owner see
+        # `read` in `list_requests`, and raise it to `admin` before — or
+        # during — the approval: approval grants what the row says when it is
+        # read, so the admin authorized one thing and granted another. Measured
+        # working both across the natural gap and inside the approver's own
+        # transaction, since READ COMMITTED gives each statement its own
+        # snapshot.
+        #
+        # Lowering stays allowed because it cannot be an over-grant, and because
+        # a caller at the cap has no other way to withdraw an `admin` ask (an
+        # amendment adds no row, so the cap does not apply to it). A DECIDED
+        # request may be re-opened at any level: that is a fresh decision the
+        # owner makes with the value in front of them.
+        rank = "array_position(ARRAY['read','write','admin'], %s)"
         cur.execute(
             "INSERT INTO access_request (requester_user_id, namespace_id, "
             "requested_permission) VALUES (%s, %s, %s) "
             "ON CONFLICT (requester_user_id, namespace_id) DO UPDATE "
             "SET requested_permission=EXCLUDED.requested_permission, "
-            "    status='pending', decided_at=NULL RETURNING id",
+            "    status='pending', decided_at=NULL "
+            "WHERE access_request.status <> 'pending' "
+            f"   OR {rank % 'EXCLUDED.requested_permission'} < "
+            f"      {rank % 'access_request.requested_permission'} "
+            "RETURNING id, requested_permission",
             (requester_user_id, namespace_id, permission))
-        return str(cur.fetchone()[0])
+        row = cur.fetchone()
+        if row is not None:
+            return str(row[0])
+        # The conflicting row was pending and at least as strong: it stands, and
+        # the caller is told which permission is actually on the table.
+        cur.execute("SELECT id, requested_permission FROM access_request "
+                    "WHERE requester_user_id=%s AND namespace_id=%s",
+                    (requester_user_id, namespace_id))
+        row = cur.fetchone()
+        return str(row[0])
 
 
 def list_requests(conn, namespace_id: str, *, pending_only: bool = True) -> List[dict]:
@@ -1607,16 +1760,30 @@ def list_requests(conn, namespace_id: str, *, pending_only: bool = True) -> List
         return out
 
 
-def approve_request(conn, request_id: str) -> None:
-    """Grant the requested membership and close the request."""
+def approve_request(conn, request_id: str, *,
+                    expect_permission: Optional[str] = None) -> None:
+    """Grant the requested membership and close the request.
+
+    `expect_permission` is what the approver SAW when they decided. Supplying it
+    turns "the request changed under me" from a silent over-grant into a refusal.
+    """
     with conn.cursor() as cur:
+        # FOR UPDATE so the row cannot change between the authorization above
+        # and the grant below. Belt to the braces in `request_access`: that stops
+        # a pending request being amended at all, this stops any future writer
+        # from reintroducing the race.
         cur.execute("SELECT requester_user_id, namespace_id, requested_permission "
-                    "FROM access_request WHERE id=%s AND status='pending'",
+                    "FROM access_request WHERE id=%s AND status='pending' "
+                    "FOR UPDATE",
                     (request_id,))
         row = cur.fetchone()
         if row is None:
             raise SpaceNotFound(f"no pending request {request_id}")
         requester, nsid, perm = row
+        if expect_permission is not None and perm != expect_permission:
+            raise AuthError(
+                f"this request now asks for '{perm}', not '{expect_permission}' "
+                "— look at it again before approving")
     add_member(conn, str(nsid), str(requester), perm)
     with conn.cursor() as cur:
         cur.execute("UPDATE access_request SET status='approved', decided_at=now() "

{memgres-0.10.0 → memgres-0.12.0}/memgres/info.py

@@ -65,6 +65,14 @@ def server_info(cfg: Config, embed_dim: Optional[int] = None) -> dict:
             "renew_on_read": bool(days > 0 and cfg.renew_on_read),
             "policy": _retention_policy(days, cfg.renew_on_read),
         },
+        # What a write MUST carry here. Announced rather than discovered from a
+        # refusal: a client that learns the rule by being rejected has already
+        # composed the memory, and a rule nobody can see before writing is a rule
+        # that gets satisfied with junk on the second attempt.
+        "write_requirements": {
+            "title": cfg.require_title,
+            "fields": list(cfg.required_fields),
+        },
         "recall_modes": ["lexical"] if lexical_only
         else ["lexical", "semantic", "hybrid", "auto"],
         "vector_backend": cfg.vector_backend,