RomanNum3ral
/
paperclip
mirror of https://github.com/paperclipai/paperclip.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(db): prevent minting legacy board keys 

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
cryppadotta 2026-09-10 00:42:57 +00:00
parent 1b1af57fa5
commit ac809173ed
2 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
packages/db/src/board-api-key-scope-migration.test.ts
View File

@ -79,6 +79,12 @@ describeEmbeddedPostgres("board API key scope migration", () => {
await expect(
sql.unsafe(`INSERT INTO board_api_keys (id) VALUES ('00000000-0000-4000-8000-000000000003')`),
).rejects.toThrow();
await expect(
sql.unsafe(`
INSERT INTO board_api_keys (id, scope_config, legacy_unrestricted)
VALUES ('00000000-0000-4000-8000-000000000006', NULL, true)
`),
).rejects.toThrow("new board API keys cannot be legacy unrestricted");
await expect(
sql.unsafe(`
INSERT INTO board_api_keys (id, scope_config)
@ -91,6 +97,13 @@ describeEmbeddedPostgres("board API key scope migration", () => {
VALUES ('00000000-0000-4000-8000-000000000005', '{"version":1}'::jsonb, true)
`),
).rejects.toThrow();
await expect(
sql.unsafe(`
UPDATE board_api_keys
SET scope_config = NULL, legacy_unrestricted = true
WHERE id = '00000000-0000-4000-8000-000000000004'
`),
).rejects.toThrow("board API keys cannot become legacy unrestricted");
} finally {
await sql.end();
}

25
packages/db/src/migrations/0277_omniscient_darwin.sql
View File

@ -26,6 +26,31 @@ UPDATE "board_api_keys"
SET "legacy_unrestricted" = true
WHERE "scope_config" IS NULL;--> statement-breakpoint
CREATE OR REPLACE FUNCTION "prevent_new_legacy_unrestricted_board_api_key"()
RETURNS trigger
LANGUAGE plpgsql
AS $$
BEGIN
IF TG_OP = 'INSERT' AND NEW."legacy_unrestricted" = true THEN
RAISE EXCEPTION 'new board API keys cannot be legacy unrestricted'
USING ERRCODE = '23514';
END IF;
IF TG_OP = 'UPDATE'
AND NEW."legacy_unrestricted" = true
AND OLD."legacy_unrestricted" = false THEN
RAISE EXCEPTION 'board API keys cannot become legacy unrestricted'
USING ERRCODE = '23514';
END IF;
RETURN NEW;
END;
$$;--> statement-breakpoint
DROP TRIGGER IF EXISTS "board_api_keys_prevent_new_legacy_unrestricted" ON "board_api_keys";--> statement-breakpoint
CREATE TRIGGER "board_api_keys_prevent_new_legacy_unrestricted"
BEFORE INSERT OR UPDATE OF "legacy_unrestricted" ON "board_api_keys"
FOR EACH ROW
EXECUTE FUNCTION "prevent_new_legacy_unrestricted_board_api_key"();--> statement-breakpoint
DO $$
BEGIN
IF NOT EXISTS (