feat(evault): enforce company signing authority on writes with single-use grants and revoke cascade

infrastructure/evault-core/package.json

@@ -21,6 +21,7 @@
         "@fastify/formbody": "^8.0.2",
         "@fastify/swagger": "^8.14.0",
         "@fastify/swagger-ui": "^3.0.0",
+        "@metastate-foundation/delegation": "workspace:*",
         "@types/multer": "^1.4.13",
         "argon2": "^0.44.0",
         "axios": "^1.6.7",

infrastructure/evault-core/src/core/db/migrations/add-delegation-grant-constraint.ts

@@ -0,0 +1,21 @@
+import type { Driver } from "neo4j-driver";
+
+/**
+ * Each signed company-authority grant may be used for one record only. The
+ * constraint makes the delegation guard's claim (a MERGE) race-safe.
+ */
+export async function createDelegationGrantConstraint(
+    driver: Driver,
+): Promise<void> {
+    const session = driver.session();
+    try {
+        await session.run(
+            "CREATE CONSTRAINT delegation_grant_payload IF NOT EXISTS FOR (g:DelegationGrant) REQUIRE (g.eName, g.payloadSha256) IS UNIQUE",
+        );
+        await session.run(
+            "CREATE INDEX delegation_grant_claim IF NOT EXISTS FOR (g:DelegationGrant) ON (g.claimToken)",
+        );
+    } finally {
+        await session.close();
+    }
+}