From ac809173ed4a694e616eb8ec48682ce495b27afb Mon Sep 17 00:00:00 2001 From: cryppadotta <34892728+cryppadotta@users.noreply.github.com> Date: Thu, 10 Sep 2026 00:42:57 +0000 Subject: [PATCH] fix(db): prevent minting legacy board keys Co-Authored-By: Paperclip --- .../src/board-api-key-scope-migration.test.ts | 13 ++++++++++ .../src/migrations/0277_omniscient_darwin.sql | 25 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/packages/db/src/board-api-key-scope-migration.test.ts b/packages/db/src/board-api-key-scope-migration.test.ts index 1a56cc6792..7b0bd432c2 100644 --- a/packages/db/src/board-api-key-scope-migration.test.ts +++ b/packages/db/src/board-api-key-scope-migration.test.ts @@ -79,6 +79,12 @@ describeEmbeddedPostgres("board API key scope migration", () => { await expect( sql.unsafe(`INSERT INTO board_api_keys (id) VALUES ('00000000-0000-4000-8000-000000000003')`), ).rejects.toThrow(); + await expect( + sql.unsafe(` + INSERT INTO board_api_keys (id, scope_config, legacy_unrestricted) + VALUES ('00000000-0000-4000-8000-000000000006', NULL, true) + `), + ).rejects.toThrow("new board API keys cannot be legacy unrestricted"); await expect( sql.unsafe(` INSERT INTO board_api_keys (id, scope_config) @@ -91,6 +97,13 @@ describeEmbeddedPostgres("board API key scope migration", () => { VALUES ('00000000-0000-4000-8000-000000000005', '{"version":1}'::jsonb, true) `), ).rejects.toThrow(); + await expect( + sql.unsafe(` + UPDATE board_api_keys + SET scope_config = NULL, legacy_unrestricted = true + WHERE id = '00000000-0000-4000-8000-000000000004' + `), + ).rejects.toThrow("board API keys cannot become legacy unrestricted"); } finally { await sql.end(); } diff --git a/packages/db/src/migrations/0277_omniscient_darwin.sql b/packages/db/src/migrations/0277_omniscient_darwin.sql index 89e9f36beb..cbf76457d9 100644 --- a/packages/db/src/migrations/0277_omniscient_darwin.sql +++ b/packages/db/src/migrations/0277_omniscient_darwin.sql @@ -26,6 +26,31 @@ UPDATE "board_api_keys" SET "legacy_unrestricted" = true WHERE "scope_config" IS NULL;--> statement-breakpoint +CREATE OR REPLACE FUNCTION "prevent_new_legacy_unrestricted_board_api_key"() +RETURNS trigger +LANGUAGE plpgsql +AS $$ +BEGIN + IF TG_OP = 'INSERT' AND NEW."legacy_unrestricted" = true THEN + RAISE EXCEPTION 'new board API keys cannot be legacy unrestricted' + USING ERRCODE = '23514'; + END IF; + IF TG_OP = 'UPDATE' + AND NEW."legacy_unrestricted" = true + AND OLD."legacy_unrestricted" = false THEN + RAISE EXCEPTION 'board API keys cannot become legacy unrestricted' + USING ERRCODE = '23514'; + END IF; + RETURN NEW; +END; +$$;--> statement-breakpoint + +DROP TRIGGER IF EXISTS "board_api_keys_prevent_new_legacy_unrestricted" ON "board_api_keys";--> statement-breakpoint +CREATE TRIGGER "board_api_keys_prevent_new_legacy_unrestricted" +BEFORE INSERT OR UPDATE OF "legacy_unrestricted" ON "board_api_keys" +FOR EACH ROW +EXECUTE FUNCTION "prevent_new_legacy_unrestricted_board_api_key"();--> statement-breakpoint + DO $$ BEGIN IF NOT EXISTS (