Files
nekonest-cloud/db/access-boundary.ts

49 lines
1.8 KiB
TypeScript

export type FreeBetaBoundaryOperation =
| "create_pairing"
| "claim_pairing"
| "cancel_pairing"
| "connect_device"
| "revoke_host";
export const FREE_BETA_ACCESS_BOUNDARY: ReadonlyArray<{
operation: FreeBetaBoundaryOperation;
requiresCurrentEntitlement: boolean;
preservesExistingHost: boolean;
}> = [
{ operation: "create_pairing", requiresCurrentEntitlement: true, preservesExistingHost: true },
{ operation: "claim_pairing", requiresCurrentEntitlement: true, preservesExistingHost: true },
{ operation: "cancel_pairing", requiresCurrentEntitlement: false, preservesExistingHost: true },
{ operation: "connect_device", requiresCurrentEntitlement: false, preservesExistingHost: true },
{ operation: "revoke_host", requiresCurrentEntitlement: false, preservesExistingHost: false },
] as const;
/**
* Existing claimed devices remain authenticated after a free policy or invite
* ends. Entitlement gates new pairing and claim operations instead of silently
* revoking an already issued device credential.
*/
export const AUTHENTICATE_ACTIVE_DEVICE_SQL = `
UPDATE device_credentials
SET last_used_at = ?1
WHERE host_id = ?2 AND token_hash = ?3 AND status = 'active'
AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?1)
AND EXISTS (
SELECT 1 FROM hosts
WHERE id = ?2 AND lifecycle = 'active' AND slot_state = 'active'
)
`;
/** Security exits intentionally have no entitlement predicate. */
export const REVOKE_ACTIVE_DEVICE_CREDENTIALS_SQL = `
UPDATE device_credentials
SET status = 'revoked', revoked_at = ?1
WHERE host_id = ?2 AND status = 'active'
`;
export const DEACTIVATE_OWNED_HOST_SQL = `
UPDATE hosts
SET lifecycle = 'deactivated', slot_state = 'released',
connection_state = 'offline', deactivated_at = ?1
WHERE id = ?2 AND account_id = ?3 AND lifecycle = 'active'
`;