hub v0.60.0: offsite continuity Part B — superseded-escrow retention (data-first)
- host_escrow_superseded table + SaveHostEscrow retains a different-sha old blob before overwrite (tx); same-sha idempotent (no supersede row); returns superseded bool. ACK/restore read the current row unchanged. CountSuperseded/ListSuperseded; DeleteHost drops retained rows. - escrow_superseded audit event + operator retained-count on host detail; register offbox_repo_orphaned/reset. Red-proof TestSaveHostEscrow_RetainsSuperseded.
This commit is contained in:
@@ -330,6 +330,25 @@ func (s *Store) migrate() error {
|
||||
updated_at DATETIME NOT NULL DEFAULT (datetime('now'))
|
||||
);
|
||||
|
||||
-- host_escrow_superseded (v0.60.0, offsite-continuity): RETAINED old escrow blobs. Viktor's
|
||||
-- ruling (data protection first): when a NEW escrow blob supersedes an old one whose sealed
|
||||
-- restic-password sha DIFFERS, the old row is COPIED here BEFORE host_escrow is overwritten —
|
||||
-- so the old passphrase stays customer-R-recoverable (turns the reinstall-orphan incident from
|
||||
-- "history destroyed" into "history recoverable with the recovery code"). Append-only; the hub
|
||||
-- never decrypts; NO pruning (the blobs are tiny + R-encrypted; custody unchanged). The ACK and
|
||||
-- restore-serving read host_escrow (the CURRENT row) — never this table.
|
||||
CREATE TABLE IF NOT EXISTS host_escrow_superseded (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
host_id TEXT NOT NULL,
|
||||
blob BLOB NOT NULL,
|
||||
key_fingerprint TEXT NOT NULL DEFAULT '',
|
||||
posture TEXT NOT NULL DEFAULT '',
|
||||
created_at DATETIME NOT NULL,
|
||||
restic_pw_sha256 TEXT NOT NULL DEFAULT '',
|
||||
superseded_at DATETIME NOT NULL DEFAULT (datetime('now'))
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_host_escrow_superseded_host ON host_escrow_superseded(host_id);
|
||||
|
||||
-- signed_jobs (slice 10A): the per-host queue of OPAQUE operator-signed destructive-op
|
||||
-- blobs. The hub STORES + SERVES them; it never forges one (there is no signing key
|
||||
-- hub-side) and never executes them (execution + signature verification is slice 10B).
|
||||
@@ -1990,6 +2009,7 @@ func (s *Store) DeleteHost(hostID string, deleteEscrow bool) error {
|
||||
}
|
||||
if deleteEscrow {
|
||||
stmts = append(stmts, `DELETE FROM host_escrow WHERE host_id = ?`)
|
||||
stmts = append(stmts, `DELETE FROM host_escrow_superseded WHERE host_id = ?`) // retained blobs go with the host
|
||||
}
|
||||
stmts = append(stmts, `DELETE FROM hosts WHERE host_id = ?`)
|
||||
for _, q := range stmts {
|
||||
@@ -2071,8 +2091,49 @@ type HostEscrow struct {
|
||||
// SaveHostEscrow stores (last-write-wins) the OPAQUE escrow blob for a host. The hub keeps the
|
||||
// bytes and NEVER decrypts them — there is no decrypt path. createdAt is the agent's timestamp.
|
||||
// resticPwSHA256 is "" when the ceremony sealed no staged password (stored as-is; never auto-confirms).
|
||||
func (s *Store) SaveHostEscrow(hostID string, blob []byte, keyFingerprint, posture, createdAt, resticPwSHA256 string) error {
|
||||
_, err := s.db.Exec(`
|
||||
// SaveHostEscrow returns superseded=true when it RETAINED a different-passphrase old blob into
|
||||
// host_escrow_superseded before overwriting the current row (Part B, v0.60.0). A same-sha re-upload
|
||||
// (idempotent re-ceremony of the same password) refreshes the current row and does NOT create a
|
||||
// superseded row.
|
||||
func (s *Store) SaveHostEscrow(hostID string, blob []byte, keyFingerprint, posture, createdAt, resticPwSHA256 string) (superseded bool, err error) {
|
||||
tx, err := s.db.Begin()
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
defer func() {
|
||||
if err != nil {
|
||||
tx.Rollback()
|
||||
}
|
||||
}()
|
||||
|
||||
// Retain the current row iff it exists AND seals a DIFFERENT restic password (the incident: a
|
||||
// recreated volume mints a new passphrase; the old must stay recoverable with its recovery code).
|
||||
var (
|
||||
curBlob []byte
|
||||
curFp, curPosture, curCreated, curSHA string
|
||||
exists bool
|
||||
)
|
||||
row := tx.QueryRow(`SELECT blob, key_fingerprint, posture, created_at, COALESCE(restic_pw_sha256,'') FROM host_escrow WHERE host_id = ?`, hostID)
|
||||
switch scanErr := row.Scan(&curBlob, &curFp, &curPosture, &curCreated, &curSHA); scanErr {
|
||||
case nil:
|
||||
exists = true
|
||||
case sql.ErrNoRows:
|
||||
exists = false
|
||||
default:
|
||||
err = scanErr
|
||||
return false, err
|
||||
}
|
||||
if exists && curSHA != resticPwSHA256 {
|
||||
if _, err = tx.Exec(`
|
||||
INSERT INTO host_escrow_superseded (host_id, blob, key_fingerprint, posture, created_at, restic_pw_sha256, superseded_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, datetime('now'))`,
|
||||
hostID, curBlob, curFp, curPosture, curCreated, curSHA); err != nil {
|
||||
return false, err
|
||||
}
|
||||
superseded = true
|
||||
}
|
||||
|
||||
if _, err = tx.Exec(`
|
||||
INSERT INTO host_escrow (host_id, blob, key_fingerprint, posture, created_at, restic_pw_sha256, updated_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, datetime('now'))
|
||||
ON CONFLICT(host_id) DO UPDATE SET
|
||||
@@ -2083,9 +2144,40 @@ func (s *Store) SaveHostEscrow(hostID string, blob []byte, keyFingerprint, postu
|
||||
restic_pw_sha256 = excluded.restic_pw_sha256,
|
||||
stale_at = NULL,
|
||||
updated_at = datetime('now')`,
|
||||
hostID, blob, keyFingerprint, posture, createdAt, resticPwSHA256,
|
||||
)
|
||||
return err
|
||||
hostID, blob, keyFingerprint, posture, createdAt, resticPwSHA256); err != nil {
|
||||
return false, err
|
||||
}
|
||||
err = tx.Commit()
|
||||
return superseded, err
|
||||
}
|
||||
|
||||
// CountSupersededEscrow returns how many retained (superseded) escrow blobs the hub holds for a host
|
||||
// (the operator "N superseded escrow blobs retained" surface). 0 on no rows.
|
||||
func (s *Store) CountSupersededEscrow(hostID string) (int, error) {
|
||||
var n int
|
||||
err := s.db.QueryRow(`SELECT COUNT(*) FROM host_escrow_superseded WHERE host_id = ?`, hostID).Scan(&n)
|
||||
return n, err
|
||||
}
|
||||
|
||||
// ListSupersededEscrow returns the retained (superseded) escrow blobs for a host, newest-superseded
|
||||
// first. Opaque bytes — the hub never decrypts. Seeds the future guided-recovery flow (R-26).
|
||||
func (s *Store) ListSupersededEscrow(hostID string) ([]HostEscrow, error) {
|
||||
rows, err := s.db.Query(`
|
||||
SELECT host_id, blob, key_fingerprint, posture, created_at, restic_pw_sha256, superseded_at
|
||||
FROM host_escrow_superseded WHERE host_id = ? ORDER BY id DESC`, hostID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []HostEscrow
|
||||
for rows.Next() {
|
||||
var e HostEscrow
|
||||
if err := rows.Scan(&e.HostID, &e.Blob, &e.KeyFingerprint, &e.Posture, &e.CreatedAt, &e.ResticPwSHA256, &e.UpdatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, e)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// MarkEscrowStale flags a host's escrow blob as stale (v0.57.0, 2.3) — called when the offsite repo
|
||||
|
||||
Reference in New Issue
Block a user