popagent

Latest change 1ce5ab5f17eefb3cef070f9d98b28f2bb1e5c879 - Secure agent secrets behind origin-bound browser use by AkurAI Build

CREATE TABLE IF NOT EXISTS popagent_data_migrations (
  id TEXT PRIMARY KEY,
  applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

DO $migration$
BEGIN
  IF EXISTS (
    SELECT 1 FROM popagent_data_migrations
    WHERE id = '2026-08-14-agent-secret-bindings-v1'
  ) THEN
    RETURN;
  END IF;

  CREATE TABLE IF NOT EXISTS popagent_secret_bindings (
    resource_id TEXT NOT NULL,
    secret_name TEXT NOT NULL,
    allowed_origin TEXT,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    PRIMARY KEY (resource_id, secret_name),
    FOREIGN KEY (resource_id, secret_name)
      REFERENCES popagent_secrets(resource_id, name)
      ON DELETE CASCADE,
    CHECK (
      allowed_origin IS NULL
      OR (
        char_length(allowed_origin) BETWEEN 1 AND 2048
        AND allowed_origin LIKE 'https://%'
      )
    )
  );

  INSERT INTO popagent_secret_bindings (resource_id, secret_name, allowed_origin)
  SELECT resource_id, name, NULL
  FROM popagent_secrets
  WHERE resource_id = 'popagent-user'
  ON CONFLICT (resource_id, secret_name) DO NOTHING;

  INSERT INTO popagent_data_migrations (id)
  VALUES ('2026-08-14-agent-secret-bindings-v1')
  ON CONFLICT (id) DO NOTHING;
END;
$migration$;