mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-23 03:18:09 +08:00
239 lines
9.6 KiB
TypeScript
239 lines
9.6 KiB
TypeScript
import { defineLocalSqliteMigration } from './sqlMigration';
|
|
|
|
export const local0067ToolResultRekeyOverlaysMigration =
|
|
defineLocalSqliteMigration({
|
|
id: '0067-tool-result-rekey-overlays',
|
|
statements: [
|
|
`
|
|
CREATE TABLE "ToolExecutionResultRekeyOverlays" (
|
|
overlay_id TEXT PRIMARY KEY NOT NULL,
|
|
artifact_id TEXT NOT NULL,
|
|
source_binding_digest TEXT NOT NULL,
|
|
revision INTEGER NOT NULL,
|
|
previous_overlay_digest TEXT,
|
|
from_key_id TEXT NOT NULL,
|
|
target_catalog_authority TEXT NOT NULL,
|
|
target_catalog_generation INTEGER NOT NULL,
|
|
target_catalog_digest TEXT NOT NULL,
|
|
target_key_id TEXT NOT NULL,
|
|
target_material_proof TEXT NOT NULL,
|
|
mutation_id TEXT NOT NULL UNIQUE,
|
|
command_digest TEXT NOT NULL,
|
|
overlay_digest TEXT NOT NULL UNIQUE,
|
|
rekeyed_at_ms INTEGER NOT NULL,
|
|
overlay_json TEXT NOT NULL,
|
|
UNIQUE (artifact_id, revision),
|
|
UNIQUE (artifact_id, revision, overlay_digest),
|
|
CONSTRAINT ql3_tool_result_rekey_artifact_fk
|
|
FOREIGN KEY (artifact_id)
|
|
REFERENCES "ToolExecutionResultKeyBindings" (artifact_id)
|
|
ON DELETE RESTRICT,
|
|
CONSTRAINT ql3_tool_result_rekey_binding_fk
|
|
FOREIGN KEY (source_binding_digest)
|
|
REFERENCES "ToolExecutionResultKeyBindings" (binding_digest)
|
|
ON DELETE RESTRICT,
|
|
CONSTRAINT ql3_tool_result_rekey_previous_fk
|
|
FOREIGN KEY (previous_overlay_digest)
|
|
REFERENCES "ToolExecutionResultRekeyOverlays" (overlay_digest)
|
|
ON DELETE RESTRICT,
|
|
CONSTRAINT ql3_tool_result_rekey_catalog_fk
|
|
FOREIGN KEY (
|
|
target_catalog_authority,
|
|
target_catalog_generation,
|
|
target_catalog_digest
|
|
)
|
|
REFERENCES "ToolResultKeyCatalogGenerations" (
|
|
authority, generation, catalog_digest
|
|
) ON DELETE RESTRICT,
|
|
CONSTRAINT ql3_tool_result_rekey_revision_check CHECK (
|
|
revision BETWEEN 1 AND 2147483647 AND
|
|
(
|
|
(revision = 1 AND previous_overlay_digest IS NULL) OR
|
|
(revision > 1 AND previous_overlay_digest IS NOT NULL)
|
|
)
|
|
),
|
|
CONSTRAINT ql3_tool_result_rekey_authority_check CHECK (
|
|
target_catalog_authority = 'trusted-tool-results'
|
|
),
|
|
CONSTRAINT ql3_tool_result_rekey_identity_check CHECK (
|
|
length(overlay_id) BETWEEN 1 AND 128 AND
|
|
length(artifact_id) BETWEEN 1 AND 128 AND
|
|
length(mutation_id) BETWEEN 1 AND 128 AND
|
|
length(from_key_id) BETWEEN 1 AND 128 AND
|
|
from_key_id NOT GLOB '*[^A-Za-z0-9._-]*' AND
|
|
substr(from_key_id, 1, 1) GLOB '[A-Za-z0-9]' AND
|
|
length(target_key_id) BETWEEN 1 AND 128 AND
|
|
target_key_id NOT GLOB '*[^A-Za-z0-9._-]*' AND
|
|
substr(target_key_id, 1, 1) GLOB '[A-Za-z0-9]' AND
|
|
from_key_id <> target_key_id AND
|
|
target_catalog_generation BETWEEN 1 AND 2147483647
|
|
),
|
|
CONSTRAINT ql3_tool_result_rekey_digest_check CHECK (
|
|
(
|
|
previous_overlay_digest IS NULL OR
|
|
length(previous_overlay_digest) = 64 AND
|
|
previous_overlay_digest NOT GLOB '*[^0-9a-f]*'
|
|
) AND
|
|
length(source_binding_digest) = 64 AND
|
|
source_binding_digest NOT GLOB '*[^0-9a-f]*' AND
|
|
length(target_catalog_digest) = 64 AND
|
|
target_catalog_digest NOT GLOB '*[^0-9a-f]*' AND
|
|
length(target_material_proof) = 64 AND
|
|
target_material_proof NOT GLOB '*[^0-9a-f]*' AND
|
|
length(command_digest) = 64 AND
|
|
command_digest NOT GLOB '*[^0-9a-f]*' AND
|
|
length(overlay_digest) = 64 AND
|
|
overlay_digest NOT GLOB '*[^0-9a-f]*'
|
|
),
|
|
CONSTRAINT ql3_tool_result_rekey_budget_check CHECK (
|
|
rekeyed_at_ms >= 0 AND
|
|
length(CAST(overlay_json AS BLOB)) BETWEEN 2 AND 393216
|
|
),
|
|
CONSTRAINT ql3_tool_result_rekey_json_check CHECK (
|
|
json_valid(overlay_json) AND
|
|
json_type(overlay_json) = 'object' AND
|
|
json_extract(overlay_json, '$.schema') =
|
|
'qinglong/tool-execution-result-rekey-overlay@v1' AND
|
|
json_extract(overlay_json, '$.overlayId') = overlay_id AND
|
|
json_extract(overlay_json, '$.sourceArtifact.artifactId') =
|
|
artifact_id AND
|
|
json_extract(overlay_json, '$.sourceBindingDigest') =
|
|
source_binding_digest AND
|
|
json_extract(overlay_json, '$.revision') = revision AND
|
|
(
|
|
(
|
|
previous_overlay_digest IS NULL AND
|
|
json_type(overlay_json, '$.previousOverlayDigest') = 'null'
|
|
) OR
|
|
json_extract(overlay_json, '$.previousOverlayDigest') =
|
|
previous_overlay_digest
|
|
) AND
|
|
json_extract(overlay_json, '$.fromKeyId') = from_key_id AND
|
|
json_extract(overlay_json, '$.targetCatalogFence.generation') =
|
|
target_catalog_generation AND
|
|
json_extract(overlay_json, '$.targetCatalogFence.catalogDigest') =
|
|
target_catalog_digest AND
|
|
json_extract(overlay_json, '$.targetCatalogFence.keyId') =
|
|
target_key_id AND
|
|
json_extract(overlay_json, '$.targetCatalogFence.materialProof') =
|
|
target_material_proof AND
|
|
json_extract(overlay_json, '$.rekeyedAtMs') = rekeyed_at_ms AND
|
|
json_extract(overlay_json, '$.overlayDigest') = overlay_digest
|
|
)
|
|
)
|
|
`,
|
|
`CREATE INDEX ql3_tool_result_rekey_artifact_idx ON "ToolExecutionResultRekeyOverlays" (artifact_id, revision DESC)`,
|
|
`CREATE INDEX ql3_tool_result_rekey_target_idx ON "ToolExecutionResultRekeyOverlays" (target_key_id, artifact_id, revision DESC)`,
|
|
`
|
|
CREATE TABLE "ToolExecutionResultRekeyHeads" (
|
|
artifact_id TEXT PRIMARY KEY NOT NULL,
|
|
revision INTEGER NOT NULL,
|
|
overlay_id TEXT NOT NULL UNIQUE,
|
|
overlay_digest TEXT NOT NULL UNIQUE,
|
|
target_catalog_generation INTEGER NOT NULL,
|
|
target_catalog_digest TEXT NOT NULL,
|
|
target_key_id TEXT NOT NULL,
|
|
updated_at_ms INTEGER NOT NULL,
|
|
CONSTRAINT ql3_tool_result_rekey_head_overlay_fk
|
|
FOREIGN KEY (artifact_id, revision, overlay_digest)
|
|
REFERENCES "ToolExecutionResultRekeyOverlays" (
|
|
artifact_id, revision, overlay_digest
|
|
) ON DELETE RESTRICT,
|
|
CONSTRAINT ql3_tool_result_rekey_head_identity_check CHECK (
|
|
revision BETWEEN 1 AND 2147483647 AND
|
|
length(artifact_id) BETWEEN 1 AND 128 AND
|
|
length(overlay_id) BETWEEN 1 AND 128 AND
|
|
length(target_key_id) BETWEEN 1 AND 128 AND
|
|
target_key_id NOT GLOB '*[^A-Za-z0-9._-]*' AND
|
|
substr(target_key_id, 1, 1) GLOB '[A-Za-z0-9]' AND
|
|
target_catalog_generation BETWEEN 1 AND 2147483647 AND
|
|
updated_at_ms >= 0
|
|
),
|
|
CONSTRAINT ql3_tool_result_rekey_head_digest_check CHECK (
|
|
length(overlay_digest) = 64 AND
|
|
overlay_digest NOT GLOB '*[^0-9a-f]*' AND
|
|
length(target_catalog_digest) = 64 AND
|
|
target_catalog_digest NOT GLOB '*[^0-9a-f]*'
|
|
)
|
|
)
|
|
`,
|
|
`CREATE INDEX ql3_tool_result_rekey_head_target_idx ON "ToolExecutionResultRekeyHeads" (target_key_id, artifact_id)`,
|
|
`
|
|
CREATE TABLE "ToolResultKeyRetirementReceipts" (
|
|
receipt_digest TEXT PRIMARY KEY NOT NULL,
|
|
catalog_authority TEXT NOT NULL,
|
|
catalog_generation INTEGER NOT NULL,
|
|
catalog_digest TEXT NOT NULL,
|
|
key_id TEXT NOT NULL,
|
|
material_proof TEXT NOT NULL,
|
|
mutation_id TEXT NOT NULL UNIQUE,
|
|
command_digest TEXT NOT NULL,
|
|
binding_count INTEGER NOT NULL,
|
|
overlay_head_count INTEGER NOT NULL,
|
|
uncovered_binding_count INTEGER NOT NULL,
|
|
uncovered_overlay_head_count INTEGER NOT NULL,
|
|
coverage_digest TEXT NOT NULL,
|
|
created_at_ms INTEGER NOT NULL,
|
|
receipt_json TEXT NOT NULL,
|
|
CONSTRAINT ql3_tool_result_key_retirement_catalog_fk
|
|
FOREIGN KEY (
|
|
catalog_authority, catalog_generation, catalog_digest
|
|
)
|
|
REFERENCES "ToolResultKeyCatalogGenerations" (
|
|
authority, generation, catalog_digest
|
|
) ON DELETE RESTRICT,
|
|
CONSTRAINT ql3_tool_result_key_retirement_authority_check CHECK (
|
|
catalog_authority = 'trusted-tool-results'
|
|
),
|
|
CONSTRAINT ql3_tool_result_key_retirement_identity_check CHECK (
|
|
catalog_generation BETWEEN 1 AND 2147483647 AND
|
|
length(key_id) BETWEEN 1 AND 128 AND
|
|
key_id NOT GLOB '*[^A-Za-z0-9._-]*' AND
|
|
substr(key_id, 1, 1) GLOB '[A-Za-z0-9]' AND
|
|
length(mutation_id) BETWEEN 1 AND 128
|
|
),
|
|
CONSTRAINT ql3_tool_result_key_retirement_count_check CHECK (
|
|
binding_count BETWEEN 0 AND 2147483647 AND
|
|
overlay_head_count BETWEEN 0 AND 2147483647 AND
|
|
uncovered_binding_count = 0 AND
|
|
uncovered_overlay_head_count = 0 AND
|
|
created_at_ms >= 0
|
|
),
|
|
CONSTRAINT ql3_tool_result_key_retirement_digest_check CHECK (
|
|
length(receipt_digest) = 64 AND
|
|
receipt_digest NOT GLOB '*[^0-9a-f]*' AND
|
|
length(catalog_digest) = 64 AND
|
|
catalog_digest NOT GLOB '*[^0-9a-f]*' AND
|
|
length(material_proof) = 64 AND
|
|
material_proof NOT GLOB '*[^0-9a-f]*' AND
|
|
length(command_digest) = 64 AND
|
|
command_digest NOT GLOB '*[^0-9a-f]*' AND
|
|
length(coverage_digest) = 64 AND
|
|
coverage_digest NOT GLOB '*[^0-9a-f]*'
|
|
),
|
|
CONSTRAINT ql3_tool_result_key_retirement_json_check CHECK (
|
|
json_valid(receipt_json) AND
|
|
json_type(receipt_json) = 'object' AND
|
|
json_extract(receipt_json, '$.schema') =
|
|
'qinglong/tool-result-key-retirement-receipt@v1' AND
|
|
json_extract(receipt_json, '$.catalogGeneration') =
|
|
catalog_generation AND
|
|
json_extract(receipt_json, '$.catalogDigest') = catalog_digest AND
|
|
json_extract(receipt_json, '$.keyId') = key_id AND
|
|
json_extract(receipt_json, '$.materialProof') = material_proof AND
|
|
json_extract(receipt_json, '$.mutationId') = mutation_id AND
|
|
json_extract(receipt_json, '$.bindingCount') = binding_count AND
|
|
json_extract(receipt_json, '$.overlayHeadCount') =
|
|
overlay_head_count AND
|
|
json_extract(receipt_json, '$.uncoveredBindingCount') = 0 AND
|
|
json_extract(receipt_json, '$.uncoveredOverlayHeadCount') = 0 AND
|
|
json_extract(receipt_json, '$.coverageDigest') = coverage_digest AND
|
|
json_extract(receipt_json, '$.createdAtMs') = created_at_ms AND
|
|
json_extract(receipt_json, '$.receiptDigest') = receipt_digest
|
|
)
|
|
)
|
|
`,
|
|
`CREATE INDEX ql3_tool_result_key_retirement_catalog_idx ON "ToolResultKeyRetirementReceipts" (catalog_generation, key_id)`,
|
|
],
|
|
});
|