57 lines
2.1 KiB
PL/PgSQL
57 lines
2.1 KiB
PL/PgSQL
   
|
begin;
|
||
|
|
|
||
|
|
create table session_credential_dynamic (
|
||
|
|
session_id wt_public_id not null
|
||
|
|
constraint session_fkey
|
||
|
|
references session (public_id)
|
||
|
|
on delete cascade
|
||
|
|
on update cascade,
|
||
|
|
library_id wt_public_id not null
|
||
|
|
constraint credential_library_fkey
|
||
|
|
references credential_library (public_id)
|
||
|
|
on delete cascade
|
||
|
|
on update cascade,
|
||
|
|
credential_id wt_public_id
|
||
|
|
constraint credential_dynamic_fkey
|
||
|
|
references credential_dynamic (public_id)
|
||
|
|
on delete cascade
|
||
|
|
on update cascade,
|
||
|
|
credential_purpose text not null
|
||
|
|
constraint credential_purpose_fkey
|
||
|
|
references credential_purpose_enm (name)
|
||
|
|
on delete restrict
|
||
|
|
on update cascade,
|
||
|
|
primary key(session_id, library_id, credential_purpose),
|
||
|
|
create_time wt_timestamp,
|
||
|
|
constraint session_credential_dynamic_credential_id_uq
|
||
|
|
unique(credential_id)
|
||
|
|
);
|
||
|
|
comment on table session_credential_dynamic is
|
||
|
|
'session_credential_dynamic is a join table between the session and dynamic credential tables. '
|
||
|
|
'It also contains the credential purpose the relationship represents.';
|
||
|
|
|
||
|
|
create trigger default_create_time_column before insert on session_credential_dynamic
|
||
|
|
for each row execute procedure default_create_time();
|
||
|
|
|
||
|
|
create trigger immutable_columns before update on session_credential_dynamic
|
||
|
|
for each row execute procedure immutable_columns('session_id', 'library_id', 'credential_purpose', 'create_time');
|
||
|
|
|
||
|
|
-- revoke_credentials revokes any active credentials for a session when the
|
||
|
|
-- session enters the canceling or terminated states.
|
||
|
|
create function revoke_credentials()
|
||
|
|
returns trigger
|
||
|
|
as $$
|
||
|
|
begin
|
||
|
|
if new.state in ('canceling', 'terminated') then
|
||
|
|
update credential_vault_credential
|
||
|
|
set status = 'revoke'
|
||
|
|
where session_id = new.session_id
|
||
|
|
and status = 'active';
|
||
|
|
end if;
|
||
|
|
return new;
|
||
|
|
end;
|
||
|
|
$$ language plpgsql;
|
||
|
|
create trigger revoke_credentials after insert on session_state
|
||
|
|
for each row execute procedure revoke_credentials();
|
||
|
|
|
||
|
|
commit;
|