fix(persistence): store full capability token payload as JSONB#173
Open
ExpertVagabond wants to merge 1 commit intosint-ai:mainfrom
Open
fix(persistence): store full capability token payload as JSONB#173ExpertVagabond wants to merge 1 commit intosint-ai:mainfrom
ExpertVagabond wants to merge 1 commit intosint-ai:mainfrom
Conversation
…sint-ai#169) PgTokenStore previously materialized only 11 scalar/JSON columns, silently dropping every optional field added to SintCapabilityToken after the initial schema (modelConstraints, attestationRequirements, verifiableComputeRequirements, executionEnvelope, behavioralConstraints, passportId, delegationDepth, revocationEndpoint). After a store -> get roundtrip the reconstructed token no longer matched the canonical signing payload, so Ed25519 verification against the persisted copy would fail. Fix: persist the full canonical token as a single JSONB payload column and keep a small set of denormalized scalars (token_id, subject, issuer, resource, expires_at) for indexed lookup only. - migrations/003_tokens_payload.sql: forward migration with backfill - pg-schema.ts: emits new layout + self-heals legacy installs in place - pg-token-store.ts: reads/writes payload JSONB exclusively - pg-stores.test.ts: regression tests covering every optional field and nested constraint shapes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #169.
Problem
PgTokenStore.rowToTokenmaterialized only 11 scalar/JSON columns fromsint_tokens, silently dropping every optional field added toSintCapabilityTokenafter the initial 002 schema:After a `store → get` roundtrip, the reconstructed token no longer matched the canonical signing payload, so Ed25519 verification against the persisted copy would fail — exactly the class of bug #166 / PR #168 fixed at the canonicalization layer, now reappearing at the persistence boundary.
Fix
Persist the full canonical token as a single `payload` JSONB column and keep a small set of denormalized scalars (`token_id`, `subject`, `issuer`, `resource`, `expires_at`) for indexed lookup only. New optional fields on `SintCapabilityToken` now roundtrip without any schema churn.
Changes
Test plan