Moheeb Zara
59e9fcbd4f
Migration 035 adds door_connections (per-space controller integration: secret_ref -> AES-256-GCM secrets vault, never a plaintext password; pinned_host SSRF pin; native_heatsync|generic_http adapter; allow_member_self_entry opt-in for phase 3) and door_access_log (append-only, secrets redacted, service-client-only writes; immutable). RLS additive/default-deny: connections CRUD = door.manage; log SELECT = door.manage/operate. Safety core is pure and heavily unit-tested (door-logic, suite 409): validateDoorTarget (request host must equal the pinned host; metadata/link-local always blocked; http(s) only), the firmware-verified HeatSync encoders with fixed-width zero-padding (slot 3 / perm 3 / tag 8 / 4-char password), generic template substitution, and redactDoorSecrets. lib/door/executor.ts is the single hardened egress: re-validates the pin, refuses redirects, caps time and body, redacts before any audit write. The door password is read from the secrets vault and decrypted server-side only, never returned or logged. /door/manage (door.manage) configures connections, picks a vault secret, and runs a safe status-only test. Sidebar Admin link added; "Learn" moved before "People" per request. Docs updated.
96 lines
5.5 KiB
SQL
96 lines
5.5 KiB
SQL
-- =============================================================================
|
|
-- 035: Door connections + access log (Door epic, phase 2)
|
|
-- =============================================================================
|
|
-- door_connections is a per-space configured integration to a physical door
|
|
-- controller. SECURITY-CRITICAL:
|
|
--
|
|
-- * The shared door password is NOT stored here. secret_ref references a
|
|
-- row in the existing AES-256-GCM `secrets` vault; the executor loads and
|
|
-- decrypts it server-side only and never returns/logs it.
|
|
-- * pinned_host is the SSRF pin: the executor will only ever call that exact
|
|
-- host (no redirects, size/time caps). A door is LAN-only, so private
|
|
-- ranges are allowed -- but only the pinned host, never metadata.
|
|
-- * adapter is 'native_heatsync' (verified query-string firmware) or
|
|
-- 'generic_http' (admin-supplied per-verb templates).
|
|
-- * allow_member_self_entry opts a connection into the member "buzz me in"
|
|
-- action (phase 3). Off by default; elevated risk, per-connection only.
|
|
--
|
|
-- door_access_log is an append-only audit of every door action (who, what,
|
|
-- result), with secrets redacted before write. No client write policy: only
|
|
-- the validated service-client executor inserts rows.
|
|
--
|
|
-- No new permission codes: door.manage / door.operate were added in 034.
|
|
-- RLS (additive, default-deny; the guarded surface):
|
|
-- * door_connections: all CRUD = door.manage.
|
|
-- * door_access_log SELECT = door.manage OR door.operate; NO
|
|
-- INSERT/UPDATE/DELETE policy (service-client executor only; immutable).
|
|
-- No anonymous path.
|
|
--
|
|
-- Idempotent: CREATE TABLE/INDEX IF NOT EXISTS, DROP POLICY IF EXISTS then
|
|
-- CREATE.
|
|
-- =============================================================================
|
|
|
|
CREATE TABLE IF NOT EXISTS public.door_connections (
|
|
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
|
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
|
name text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 200),
|
|
adapter text NOT NULL DEFAULT 'generic_http'
|
|
CHECK (adapter IN ('native_heatsync','generic_http')),
|
|
base_url text NOT NULL CHECK (base_url ~ '^https?://'),
|
|
pinned_host text NOT NULL CHECK (char_length(pinned_host) BETWEEN 1 AND 255),
|
|
auth_mode text NOT NULL DEFAULT 'none'
|
|
CHECK (auth_mode IN ('none','query','header','bearer')),
|
|
auth_param text,
|
|
secret_ref uuid REFERENCES public.secrets(id) ON DELETE SET NULL,
|
|
verbs jsonb NOT NULL DEFAULT '{}',
|
|
allow_member_self_entry boolean NOT NULL DEFAULT false,
|
|
is_enabled boolean NOT NULL DEFAULT true,
|
|
created_by uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX IF NOT EXISTS idx_door_connections_space ON public.door_connections (space_id);
|
|
|
|
CREATE TABLE IF NOT EXISTS public.door_access_log (
|
|
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
|
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
|
connection_id uuid REFERENCES public.door_connections(id) ON DELETE SET NULL,
|
|
actor_member_id uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
|
target_member_id uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
|
action text NOT NULL,
|
|
success boolean NOT NULL DEFAULT false,
|
|
detail text,
|
|
occurred_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX IF NOT EXISTS idx_door_access_log_space ON public.door_access_log (space_id, occurred_at DESC);
|
|
|
|
ALTER TABLE public.door_connections ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE public.door_access_log ENABLE ROW LEVEL SECURITY;
|
|
|
|
DROP POLICY IF EXISTS door_connections_select ON public.door_connections;
|
|
DROP POLICY IF EXISTS door_connections_insert ON public.door_connections;
|
|
DROP POLICY IF EXISTS door_connections_update ON public.door_connections;
|
|
DROP POLICY IF EXISTS door_connections_delete ON public.door_connections;
|
|
CREATE POLICY door_connections_select ON public.door_connections FOR SELECT
|
|
USING (public.user_has_permission(auth.uid(), space_id, 'door.manage'));
|
|
CREATE POLICY door_connections_insert ON public.door_connections FOR INSERT
|
|
WITH CHECK (public.user_has_permission(auth.uid(), space_id, 'door.manage'));
|
|
CREATE POLICY door_connections_update ON public.door_connections FOR UPDATE
|
|
USING (public.user_has_permission(auth.uid(), space_id, 'door.manage'));
|
|
CREATE POLICY door_connections_delete ON public.door_connections FOR DELETE
|
|
USING (public.user_has_permission(auth.uid(), space_id, 'door.manage'));
|
|
|
|
DROP POLICY IF EXISTS door_access_log_select ON public.door_access_log;
|
|
CREATE POLICY door_access_log_select ON public.door_access_log FOR SELECT
|
|
USING (
|
|
public.user_has_permission(auth.uid(), space_id, 'door.manage')
|
|
OR public.user_has_permission(auth.uid(), space_id, 'door.operate')
|
|
);
|
|
-- No INSERT/UPDATE/DELETE policy: the validated service-client executor is
|
|
-- the only writer, and the audit trail is immutable.
|
|
|
|
DROP TRIGGER IF EXISTS trg_door_connections_touch ON public.door_connections;
|
|
CREATE TRIGGER trg_door_connections_touch
|
|
BEFORE UPDATE ON public.door_connections
|
|
FOR EACH ROW EXECUTE FUNCTION public.touch_updated_at();
|