diff --git a/internal/db/schema/migrations/postgres/0/01_domain_types.down.sql b/internal/db/schema/migrations/postgres/0/01_domain_types.down.sql deleted file mode 100644 index 08dab0bf7..000000000 --- a/internal/db/schema/migrations/postgres/0/01_domain_types.down.sql +++ /dev/null @@ -1,15 +0,0 @@ -begin; - -drop domain wt_timestamp; -drop domain wt_public_id; -drop domain wt_private_id; -drop domain wt_scope_id; -drop domain wt_user_id; -drop domain wt_version; - -drop function default_create_time; -drop function update_time_column; -drop function update_version_column; -drop function immutable_columns; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/02_oplog.down.sql b/internal/db/schema/migrations/postgres/0/02_oplog.down.sql deleted file mode 100644 index f855477a0..000000000 --- a/internal/db/schema/migrations/postgres/0/02_oplog.down.sql +++ /dev/null @@ -1,7 +0,0 @@ -begin; - -drop table oplog_metadata cascade; -drop table oplog_ticket cascade; -drop table oplog_entry cascade; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/03_db.down.sql b/internal/db/schema/migrations/postgres/0/03_db.down.sql deleted file mode 100644 index 4c8371967..000000000 --- a/internal/db/schema/migrations/postgres/0/03_db.down.sql +++ /dev/null @@ -1,8 +0,0 @@ -begin; - -drop table db_test_rental cascade; -drop table db_test_car cascade; -drop table db_test_user cascade; -drop table db_test_scooter cascade; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/06_iam.down.sql b/internal/db/schema/migrations/postgres/0/06_iam.down.sql deleted file mode 100644 index a8a7b5692..000000000 --- a/internal/db/schema/migrations/postgres/0/06_iam.down.sql +++ /dev/null @@ -1,34 +0,0 @@ -BEGIN; - -drop table iam_group cascade; -drop table iam_user cascade; -drop table iam_scope_project cascade; -drop table iam_scope_org cascade; -drop table iam_scope_global cascade; -drop table iam_scope cascade; -drop table iam_scope_type_enm cascade; -drop table iam_role cascade; -drop view iam_principal_role cascade; -drop table iam_group_role cascade; -drop table iam_user_role cascade; -drop table iam_group_member_user cascade; -drop view iam_group_member cascade; -drop table iam_role_grant cascade; - -drop function iam_sub_names cascade; -drop function iam_immutable_scope_type_func cascade; -drop function iam_sub_scopes_func cascade; -drop function iam_immutable_role_principal cascade; -drop function iam_user_role_scope_check cascade; -drop function iam_group_role_scope_check cascade; -drop function iam_group_member_scope_check cascade; -drop function iam_immutable_group_member cascade; -drop function get_scoped_member_id cascade; -drop function grant_scope_id_valid cascade; -drop function disallow_global_scope_deletion cascade; -drop function user_scope_id_valid cascade; -drop function iam_immutable_role_grant cascade; -drop function disallow_iam_predefined_user_deletion cascade; -drop function recovery_user_not_allowed cascade; - -COMMIT; diff --git a/internal/db/schema/migrations/postgres/0/07_auth.down.sql b/internal/db/schema/migrations/postgres/0/07_auth.down.sql deleted file mode 100644 index 8853c864a..000000000 --- a/internal/db/schema/migrations/postgres/0/07_auth.down.sql +++ /dev/null @@ -1,10 +0,0 @@ -begin; - - drop function update_iam_user_auth_account; - drop function insert_auth_account_subtype; - drop function insert_auth_method_subtype; - - drop table auth_account cascade; - drop table auth_method cascade; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/08_servers.down.sql b/internal/db/schema/migrations/postgres/0/08_servers.down.sql deleted file mode 100644 index 62468c0c0..000000000 --- a/internal/db/schema/migrations/postgres/0/08_servers.down.sql +++ /dev/null @@ -1,5 +0,0 @@ -begin; - - drop table server; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/11_auth_token.down.sql b/internal/db/schema/migrations/postgres/0/11_auth_token.down.sql deleted file mode 100644 index b4c9e77ee..000000000 --- a/internal/db/schema/migrations/postgres/0/11_auth_token.down.sql +++ /dev/null @@ -1,10 +0,0 @@ -begin; - - drop view auth_token_account cascade; - drop table auth_token cascade; - - drop function update_last_access_time cascade; - drop function immutable_auth_token_columns cascade; - drop function expire_time_not_older_than_token cascade; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/12_auth_password.down.sql b/internal/db/schema/migrations/postgres/0/12_auth_password.down.sql deleted file mode 100644 index 1e07b1af2..000000000 --- a/internal/db/schema/migrations/postgres/0/12_auth_password.down.sql +++ /dev/null @@ -1,11 +0,0 @@ -begin; - - drop table auth_password_credential; - drop table auth_password_conf cascade; - drop table if exists auth_password_account; - drop table if exists auth_password_method; - - drop function insert_auth_password_credential_subtype; - drop function insert_auth_password_conf_subtype; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/13_auth_password_argon.down.sql b/internal/db/schema/migrations/postgres/0/13_auth_password_argon.down.sql deleted file mode 100644 index 209506cca..000000000 --- a/internal/db/schema/migrations/postgres/0/13_auth_password_argon.down.sql +++ /dev/null @@ -1,6 +0,0 @@ -begin; - - drop table auth_password_argon2_cred; - drop table auth_password_argon2_conf; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/14_auth_password_views.down.sql b/internal/db/schema/migrations/postgres/0/14_auth_password_views.down.sql deleted file mode 100644 index 303ccd0bd..000000000 --- a/internal/db/schema/migrations/postgres/0/14_auth_password_views.down.sql +++ /dev/null @@ -1,6 +0,0 @@ -begin; - - drop view auth_password_current_conf; - drop view auth_password_conf_union; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/20_host.down.sql b/internal/db/schema/migrations/postgres/0/20_host.down.sql deleted file mode 100644 index 2a1e93a03..000000000 --- a/internal/db/schema/migrations/postgres/0/20_host.down.sql +++ /dev/null @@ -1,19 +0,0 @@ -begin; - - drop table host_set; - drop table host; - drop table host_catalog; - - drop function insert_host_set_subtype; - drop function insert_host_subtype; - drop function insert_host_catalog_subtype; - - delete - from oplog_ticket - where name in ( - 'host_catalog', - 'host', - 'host_set' - ); - -commit; diff --git a/internal/db/schema/migrations/postgres/0/22_static_host.down.sql b/internal/db/schema/migrations/postgres/0/22_static_host.down.sql deleted file mode 100644 index 94eb77106..000000000 --- a/internal/db/schema/migrations/postgres/0/22_static_host.down.sql +++ /dev/null @@ -1,17 +0,0 @@ -begin; - - drop table static_host_set_member cascade; - drop table static_host_set cascade; - drop table static_host cascade; - drop table static_host_catalog cascade; - - delete - from oplog_ticket - where name in ( - 'static_host_catalog', - 'static_host', - 'static_host_set', - 'static_host_set_member' - ); - -commit; diff --git a/internal/db/schema/migrations/postgres/0/30_keys.down.sql b/internal/db/schema/migrations/postgres/0/30_keys.down.sql deleted file mode 100644 index b87742fe4..000000000 --- a/internal/db/schema/migrations/postgres/0/30_keys.down.sql +++ /dev/null @@ -1,5 +0,0 @@ -begin; - -drop function kms_version_column cascade; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/31_keys.down.sql b/internal/db/schema/migrations/postgres/0/31_keys.down.sql deleted file mode 100644 index 18ae7b485..000000000 --- a/internal/db/schema/migrations/postgres/0/31_keys.down.sql +++ /dev/null @@ -1,12 +0,0 @@ -begin; - -drop table kms_root_key cascade; -drop table kms_root_key_version cascade; -drop table kms_database_key cascade; -drop table kms_database_key_version cascade; -drop table kms_oplog_key cascade; -drop table kms_oplog_key_version cascade; -drop table kms_session_key cascade; -drop table kms_session_key_version cascade; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/40_targets.down.sql b/internal/db/schema/migrations/postgres/0/40_targets.down.sql deleted file mode 100644 index 9b3dd1a01..000000000 --- a/internal/db/schema/migrations/postgres/0/40_targets.down.sql +++ /dev/null @@ -1,8 +0,0 @@ -begin; - -drop function insert_target_subtype; -drop function delete_target_subtype; -drop function target_scope_valid; -drop function target_host_set_scope_valid - -commit; diff --git a/internal/db/schema/migrations/postgres/0/41_targets.down.sql b/internal/db/schema/migrations/postgres/0/41_targets.down.sql deleted file mode 100644 index 2c220e685..000000000 --- a/internal/db/schema/migrations/postgres/0/41_targets.down.sql +++ /dev/null @@ -1,16 +0,0 @@ -begin; - -drop table target cascade; -drop table target_host_set cascade; -drop table target_tcp; -drop view target_all_subtypes; -drop view target_host_set_catalog; - - -delete -from oplog_ticket -where name in ( - 'target_tcp' - ); - -commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/0/50_session.down.sql b/internal/db/schema/migrations/postgres/0/50_session.down.sql deleted file mode 100644 index 69a43976f..000000000 --- a/internal/db/schema/migrations/postgres/0/50_session.down.sql +++ /dev/null @@ -1,20 +0,0 @@ -begin; - - drop table session_state; - drop table session_state_enm; - drop table session; - drop table session_termination_reason_enm; - drop function insert_session_state; - drop function insert_new_session_state; - drop function insert_session; - drop function update_session_state_on_termination_reason; - drop function insert_session_state; - - - delete - from oplog_ticket - where name in ( - 'session' - ); - -commit; diff --git a/internal/db/schema/migrations/postgres/0/51_connection.down.sql b/internal/db/schema/migrations/postgres/0/51_connection.down.sql deleted file mode 100644 index 9356a5674..000000000 --- a/internal/db/schema/migrations/postgres/0/51_connection.down.sql +++ /dev/null @@ -1,10 +0,0 @@ -begin; - - drop table session_connection_state; - drop table session_connection_state_enm; - drop table session_connection; - drop table session_connection_closed_reason_enm; - drop function insert_session_connection_state; - drop function insert_new_connection_state; - drop function update_connection_state_on_closed_reason; -commit; diff --git a/internal/db/schema/migrations/postgres/0/60_wh_domain_types.down.sql b/internal/db/schema/migrations/postgres/0/60_wh_domain_types.down.sql deleted file mode 100644 index 5c64ef604..000000000 --- a/internal/db/schema/migrations/postgres/0/60_wh_domain_types.down.sql +++ /dev/null @@ -1,15 +0,0 @@ -begin; - - drop function wh_current_time_id; - drop function wh_current_date_id; - drop function wh_time_id; - drop function wh_date_id; - drop domain wh_dim_text; - drop domain wh_timestamp; - drop domain wh_public_id; - drop domain wh_dim_id; - drop function wh_dim_id; - drop domain wh_bytes_transmitted; - drop domain wh_inet_port; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/62_wh_datetime.down.sql b/internal/db/schema/migrations/postgres/0/62_wh_datetime.down.sql deleted file mode 100644 index ef60e53fe..000000000 --- a/internal/db/schema/migrations/postgres/0/62_wh_datetime.down.sql +++ /dev/null @@ -1,6 +0,0 @@ -begin; - - drop table wh_time_of_day_dimension; - drop table wh_date_dimension; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/65_wh_session_dimensions.down.sql b/internal/db/schema/migrations/postgres/0/65_wh_session_dimensions.down.sql deleted file mode 100644 index b97d9c664..000000000 --- a/internal/db/schema/migrations/postgres/0/65_wh_session_dimensions.down.sql +++ /dev/null @@ -1,10 +0,0 @@ -begin; - - drop view whx_user_dimension_target; - drop view whx_user_dimension_source; - drop view whx_host_dimension_target; - drop view whx_host_dimension_source; - drop table wh_user_dimension; - drop table wh_host_dimension; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/66_wh_session_dimensions.down.sql b/internal/db/schema/migrations/postgres/0/66_wh_session_dimensions.down.sql deleted file mode 100644 index c923714be..000000000 --- a/internal/db/schema/migrations/postgres/0/66_wh_session_dimensions.down.sql +++ /dev/null @@ -1,6 +0,0 @@ -begin; - - drop function wh_upsert_user; - drop function wh_upsert_host; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/68_wh_session_facts.down.sql b/internal/db/schema/migrations/postgres/0/68_wh_session_facts.down.sql deleted file mode 100644 index 2908ff3fb..000000000 --- a/internal/db/schema/migrations/postgres/0/68_wh_session_facts.down.sql +++ /dev/null @@ -1,6 +0,0 @@ -begin; - - drop table wh_session_connection_accumulating_fact; - drop table wh_session_accumulating_fact; - -commit; diff --git a/internal/db/schema/migrations/postgres/0/69_wh_session_facts.down.sql b/internal/db/schema/migrations/postgres/0/69_wh_session_facts.down.sql deleted file mode 100644 index e03df7ed3..000000000 --- a/internal/db/schema/migrations/postgres/0/69_wh_session_facts.down.sql +++ /dev/null @@ -1,20 +0,0 @@ -begin; - - drop trigger wh_insert_session_connection_state on session_connection_state; - drop function wh_insert_session_connection_state; - - drop trigger wh_insert_session_state on session_state; - drop function wh_insert_session_state; - - drop trigger wh_update_session_connection on session_connection; - drop function wh_update_session_connection; - - drop trigger wh_insert_session_connection on session_connection; - drop function wh_insert_session_connection; - - drop trigger wh_insert_session on session; - drop function wh_insert_session; - - drop function wh_rollup_connections; - -commit; diff --git a/internal/db/schema/migrations/postgres/dev/01_server_tags_migrations.up.sql b/internal/db/schema/migrations/postgres/1/01_server_tags_migrations.up.sql similarity index 100% rename from internal/db/schema/migrations/postgres/dev/01_server_tags_migrations.up.sql rename to internal/db/schema/migrations/postgres/1/01_server_tags_migrations.up.sql diff --git a/internal/db/schema/migrations/postgres/dev/80_domains.up.sql b/internal/db/schema/migrations/postgres/1/02_domains.up.sql similarity index 100% rename from internal/db/schema/migrations/postgres/dev/80_domains.up.sql rename to internal/db/schema/migrations/postgres/1/02_domains.up.sql diff --git a/internal/db/schema/migrations/postgres/dev/82_kms.up.sql b/internal/db/schema/migrations/postgres/1/03_kms.up.sql similarity index 100% rename from internal/db/schema/migrations/postgres/dev/82_kms.up.sql rename to internal/db/schema/migrations/postgres/1/03_kms.up.sql diff --git a/internal/db/schema/migrations/postgres/dev/01_server_tags_migrations.down.sql b/internal/db/schema/migrations/postgres/dev/01_server_tags_migrations.down.sql deleted file mode 100644 index 71a055d92..000000000 --- a/internal/db/schema/migrations/postgres/dev/01_server_tags_migrations.down.sql +++ /dev/null @@ -1,8 +0,0 @@ -begin; - -drop domain wt_bexprfilter; - -drop table server_tag; -drop domain wt_tagpair; - -commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/dev/80_domains.down.sql b/internal/db/schema/migrations/postgres/dev/80_domains.down.sql deleted file mode 100644 index 019b6b36b..000000000 --- a/internal/db/schema/migrations/postgres/dev/80_domains.down.sql +++ /dev/null @@ -1,4 +0,0 @@ -begin; - - -commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/dev/82_kms.down.sql b/internal/db/schema/migrations/postgres/dev/82_kms.down.sql deleted file mode 100644 index 26104d89a..000000000 --- a/internal/db/schema/migrations/postgres/dev/82_kms.down.sql +++ /dev/null @@ -1,2 +0,0 @@ -begin; -commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/dev/83_oidc_enm.down.sql b/internal/db/schema/migrations/postgres/dev/83_oidc_enm.down.sql deleted file mode 100644 index c3a325565..000000000 --- a/internal/db/schema/migrations/postgres/dev/83_oidc_enm.down.sql +++ /dev/null @@ -1,3 +0,0 @@ -begin; - -commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/dev/83_oidc_enm.up.sql b/internal/db/schema/migrations/postgres/dev/83_oidc_enm.up.sql deleted file mode 100644 index d33072d86..000000000 --- a/internal/db/schema/migrations/postgres/dev/83_oidc_enm.up.sql +++ /dev/null @@ -1,71 +0,0 @@ -begin; - --- auth_oidc_method_state_enum entries define the possible oidc auth method --- states. -create table auth_oidc_method_state_enm ( - name text primary key - constraint only_predefined_oidc_method_states_allowed - check ( - name in ('inactive', 'active-private', 'active-public', 'stopping') - ) -); - --- populate the values of auth_oidc_method_state_enm -insert into auth_oidc_method_state_enm(name) - values - ('inactive'), - ('active-private'), - ('active-public'), - ('stopping'); - - -- define the immutable fields for auth_oidc_method_state_enm (all of them) -create trigger - immutable_columns -before -update on auth_oidc_method_state_enm - for each row execute procedure immutable_columns('name'); - - --- auth_oidc_signing_alg entries define the supported oidc auth method --- signing algorithms. -create table auth_oidc_signing_alg_enm ( - name text primary key - constraint only_predefined_auth_oidc_signing_algs_allowed - check ( - name in ( - 'RS256', - 'RS384', - 'RS512', - 'ES256', - 'ES384', - 'ES512', - 'PS256', - 'PS384', - 'PS512', - 'EdDSA') - ) -); - --- populate the values of auth_oidc_signing_alg -insert into auth_oidc_signing_alg_enm (name) - values - ('RS256'), - ('RS384'), - ('RS512'), - ('ES256'), - ('ES384'), - ('ES512'), - ('PS256'), - ('PS384'), - ('PS512'), - ('EdDSA') - ; - - -- define the immutable fields for auth_oidc_signing_alg (all of them) -create trigger - immutable_columns -before -update on auth_oidc_signing_alg_enm - for each row execute procedure immutable_columns('name'); - -commit; diff --git a/internal/db/schema/migrations/postgres/dev/84_oidc.down.sql b/internal/db/schema/migrations/postgres/dev/84_oidc.down.sql deleted file mode 100644 index e3090523a..000000000 --- a/internal/db/schema/migrations/postgres/dev/84_oidc.down.sql +++ /dev/null @@ -1,3 +0,0 @@ -begin; - -commit; diff --git a/internal/db/schema/migrations/postgres/dev/84_oidc.up.sql b/internal/db/schema/migrations/postgres/dev/84_oidc.up.sql deleted file mode 100644 index 2d7bacb86..000000000 --- a/internal/db/schema/migrations/postgres/dev/84_oidc.up.sql +++ /dev/null @@ -1,193 +0,0 @@ -begin; - --- auth_oidc_method entries are the current oidc auth methods configured for --- existing scopes. -create table auth_oidc_method ( - public_id wt_public_id - primary key, - scope_id wt_scope_id - not null, - name wt_name, - description wt_description, - create_time wt_timestamp, - update_time wt_timestamp, - version wt_version, - state text not null - references auth_oidc_method_state_enm(name) - on delete restrict - on update cascade, - discovery_url wt_url not null, -- oidc discovery URL without any .well-known component - client_id text not null -- oidc client identifier issued by the oidc provider. - constraint client_id_not_empty - check(length(trim(client_id)) > 0), - client_secret bytea not null, -- encrypted oidc client secret issued by the oidc provider. - key_id wt_private_id not null -- key used to encrypt entries via wrapping wrapper. - references kms_oidc_key_version(private_id) - on delete restrict - on update cascade, - max_age int not null -- the allowable elapsed time in secs since the last time the user was authenticated. zero is allowed and should force the user to be re-authenticated. - constraint max_age_equal_or_greater_than_zero - check(max_age >= 0), - foreign key (scope_id, public_id) - references auth_method (scope_id, public_id) - on delete cascade - on update cascade, - unique(scope_id, name), - unique(scope_id, public_id), - unique(scope_id, discovery_url, client_id) -- a client_id must be unique for a provider within a scope. -); - --- auth_oidc_signing_alg entries are the signing algorithms allowed for an oidc --- auth method. There must be at least one allowed alg for each oidc auth method. -create table auth_oidc_signing_alg ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - signing_alg_name text - references auth_oidc_signing_alg_enm(name) - on delete restrict - on update cascade, - primary key(oidc_method_id, signing_alg_name) -); - --- auth_oidc_callback_url entries are the callback URLs allowed for a specific --- oidc auth method. There must be at least one callback url for each oidc auth --- method. -create table auth_oidc_callback_url ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - callback_url wt_url not null -); - --- auth_oidc_aud_claim entries are the audience claims for a specific oidc auth --- method. There can be 0 or more for each parent oidc auth method. If an auth --- method has any aud claims, an ID token must contain one of them to be valid. -create table auth_oidc_aud_claim ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - aud_claim text not null - constraint aud_claim_must_not_be_empty - check(length(trim(aud_claim)) > 0) - constraint aud_claim_must_be_less_than_1024_chars - check(length(trim(aud_claim)) < 1024), - primary key(oidc_method_id, aud_claim) -); - --- auth_oidc_certificate entries are optional PEM encoded x509 certificates. --- Each entry is a single certificate. An oidc auth method may have 0 or more --- of these optional x509s. If an auth method has any cert entries, they are --- used as trust anchors when connecting to the auth method's oidc provider --- (instead of the host system's cert chain). -create table auth_oidc_certificate ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - certificate bytea not null, - primary key(oidc_method_id, certificate) -); - - -create table auth_oidc_account ( - public_id wt_public_id - primary key, - auth_method_id wt_public_id - not null, - -- NOTE(mgaffney): The scope_id type is not wt_scope_id because the domain - -- check is executed before the insert trigger which retrieves the scope_id - -- causing an insert to fail. - scope_id text not null, - name wt_name, - description wt_description, - create_time wt_timestamp, - update_time wt_timestamp, - version wt_version, - issuer_id wt_url not null, -- case-sensitive URL that maps to an id_token's iss claim - subject_id text not null -- case-senstive string that maps to an id_token's sub claim - constraint subject_id_must_not_be_empty - check ( - length(trim(subject_id)) > 0 - ) - constraint subject_id_must_be_less_than_256_chars - check( - length(trim(subject_id)) <= 255 -- length limit per OIDC spec - ), - full_name wt_full_name, -- may be null and maps to an id_token's name claim - email wt_email, -- may be null and maps to the id_token's email claim - foreign key (scope_id, auth_method_id) - references auth_oidc_method (scope_id, public_id) - on delete cascade - on update cascade, - foreign key (scope_id, auth_method_id, public_id) - references auth_account (scope_id, auth_method_id, public_id) - on delete cascade - on update cascade, - unique(auth_method_id, name), - unique(auth_method_id, issuer_id, subject_id), -- subject must be unique for a provider within specific auth method - unique(auth_method_id, public_id) -); - --- auth_oidc_method column triggers -create trigger - insert_auth_method_subtype -before insert on auth_oidc_method - for each row execute procedure insert_auth_method_subtype(); - -create trigger - update_time_column -before -update on auth_oidc_method - for each row execute procedure update_time_column(); - -create trigger - immutable_columns -before -update on auth_oidc_method - for each row execute procedure immutable_columns('public_id', 'scope_id', 'create_time'); - -create trigger - default_create_time_column -before -insert on auth_oidc_method - for each row execute procedure default_create_time(); - -create trigger - update_version_column -after update on auth_oidc_method - for each row execute procedure update_version_column(); - --- auth_oidc_account column triggers -create trigger - update_time_column -before -update on auth_oidc_account - for each row execute procedure update_time_column(); - -create trigger - immutable_columns -before -update on auth_oidc_account - for each row execute procedure immutable_columns('public_id', 'auth_method_id', 'scope_id', 'create_time', 'issuer_id', 'subject_id'); - -create trigger - default_create_time_column -before -insert on auth_oidc_account - for each row execute procedure default_create_time(); - -create trigger - update_version_column -after update on auth_oidc_account - for each row execute procedure update_version_column(); - -create trigger - insert_auth_account_subtype -before insert on auth_oidc_account - for each row execute procedure insert_auth_account_subtype(); - -commit; diff --git a/internal/db/schema/migrations/postgres/dev/85_authtoken.down.sql b/internal/db/schema/migrations/postgres/dev/85_authtoken.down.sql deleted file mode 100644 index e3090523a..000000000 --- a/internal/db/schema/migrations/postgres/dev/85_authtoken.down.sql +++ /dev/null @@ -1,3 +0,0 @@ -begin; - -commit; diff --git a/internal/db/schema/migrations/postgres/dev/85_authtoken.up.sql b/internal/db/schema/migrations/postgres/dev/85_authtoken.up.sql deleted file mode 100644 index edde6a6f9..000000000 --- a/internal/db/schema/migrations/postgres/dev/85_authtoken.up.sql +++ /dev/null @@ -1,31 +0,0 @@ -begin; - --- auth_token_status_enm entries define the possible auth token --- states. -create table auth_token_status_enm ( - name text primary key - constraint only_predefined_auth_token_states_allowed - check ( - name in ('auth token pending','token issued', 'authentication failed', 'system error') - ) -); - --- populate the values of auth_token_status_enm -insert into auth_token_status_enm(name) - values - ('auth token pending'), - ('token issued'), - ('authentication failed'), - ('system error'); - - --- add the state column with a default to the auth_token table. -alter table auth_token -add column status text -not null -default 'token issued' -- safest default -references auth_token_status_enm(name) - on update cascade - on delete restrict; - -commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/dev/86_iam.down.sql b/internal/db/schema/migrations/postgres/dev/86_iam.down.sql deleted file mode 100644 index c3a325565..000000000 --- a/internal/db/schema/migrations/postgres/dev/86_iam.down.sql +++ /dev/null @@ -1,3 +0,0 @@ -begin; - -commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/dev/86_iam.up.sql b/internal/db/schema/migrations/postgres/dev/86_iam.up.sql deleted file mode 100644 index a63fcc6f8..000000000 --- a/internal/db/schema/migrations/postgres/dev/86_iam.up.sql +++ /dev/null @@ -1,66 +0,0 @@ -begin; - --- add the account_info_auth_method_id which determines which auth_method is --- designated as for "account info" in the user's scope. -alter table iam_scope -add column account_info_auth_method_id wt_public_id -- allowed to be null and is mutable of course. -references auth_method(public_id) - on update cascade - on delete set null; - --- establish a compond fk, but there's no cascading of deletes or updates, since --- we only want to cascade changes to the account_info_auth_method_id portion of --- the compond fk and that is handled in a separate fk declaration. -alter table iam_scope -add foreign key (public_id, account_info_auth_method_id) references auth_method(scope_id, public_id); - --- iam_user_acct_info provides account info for users by determining which --- auth_method is designated as for "account info" in the user's scope via the --- scope's account_info_auth_method_id. Every sub-type of auth_account must be --- added to this view's union. -create view iam_acct_info as -select - aa.iam_user_id, - oa.subject_id as login_name, - oa.full_name as full_name, - oa.email as email -from - iam_scope s, - auth_account aa, - auth_oidc_account oa -where - aa.public_id = oa.public_id and - aa.auth_method_id = s.account_info_auth_method_id -union -select - aa.iam_user_id, - pa.login_name, - '' as full_name, - '' as email -from - iam_scope s, - auth_account aa, - auth_password_account pa -where - aa.public_id = pa.public_id and - aa.auth_method_id = s.account_info_auth_method_id; - --- iam_user_acct_info provides a simple way to retrieve entries that include --- both the iam_user fields with an outer join to the user's account info. -create view iam_user_acct_info as -select - u.public_id, - u.scope_id, - u.name, - u.description, - u.create_time, - u.update_time, - u.version, - i.login_name, - i.full_name, - i.email -from - iam_user u -left outer join iam_acct_info i on u.public_id = i.iam_user_id; - -commit; \ No newline at end of file diff --git a/internal/db/schema/postgres_migration.gen.go b/internal/db/schema/postgres_migration.gen.go index bfab61e89..94d31c6f4 100644 --- a/internal/db/schema/postgres_migration.gen.go +++ b/internal/db/schema/postgres_migration.gen.go @@ -4,8 +4,8 @@ package schema func init() { migrationStates["postgres"] = migrationState{ - devMigration: true, - binarySchemaVersion: 1086, + devMigration: false, + binarySchemaVersion: 1003, upMigrations: map[int][]byte{ 1: []byte(` create domain wt_public_id as text @@ -4865,7 +4865,7 @@ create table server_tag ( primary key(server_id, key, value) ); `), - 1080: []byte(` + 1002: []byte(` -- wt_email defines a type for email which must be less than 320 chars and only -- contain lower case values. The type is defined to allow nulls and not be -- unique, which can be overriden as needed when used in tables. @@ -4921,7 +4921,7 @@ create domain wt_description as text comment on domain wt_description is 'standard column for resource descriptions'; `), - 1082: []byte(` + 1003: []byte(` -- kms_oidc_key entries are DEKs for encrypting oidc entries. create table kms_oidc_key ( private_id wt_private_id primary key, @@ -4983,359 +4983,6 @@ create trigger kms_version_column before insert on kms_oidc_key_version for each row execute procedure kms_version_column('oidc_key_id'); -`), - 1083: []byte(` --- auth_oidc_method_state_enum entries define the possible oidc auth method --- states. -create table auth_oidc_method_state_enm ( - name text primary key - constraint only_predefined_oidc_method_states_allowed - check ( - name in ('inactive', 'active-private', 'active-public', 'stopping') - ) -); - --- populate the values of auth_oidc_method_state_enm -insert into auth_oidc_method_state_enm(name) - values - ('inactive'), - ('active-private'), - ('active-public'), - ('stopping'); - - -- define the immutable fields for auth_oidc_method_state_enm (all of them) -create trigger - immutable_columns -before -update on auth_oidc_method_state_enm - for each row execute procedure immutable_columns('name'); - - --- auth_oidc_signing_alg entries define the supported oidc auth method --- signing algorithms. -create table auth_oidc_signing_alg_enm ( - name text primary key - constraint only_predefined_auth_oidc_signing_algs_allowed - check ( - name in ( - 'RS256', - 'RS384', - 'RS512', - 'ES256', - 'ES384', - 'ES512', - 'PS256', - 'PS384', - 'PS512', - 'EdDSA') - ) -); - --- populate the values of auth_oidc_signing_alg -insert into auth_oidc_signing_alg_enm (name) - values - ('RS256'), - ('RS384'), - ('RS512'), - ('ES256'), - ('ES384'), - ('ES512'), - ('PS256'), - ('PS384'), - ('PS512'), - ('EdDSA') - ; - - -- define the immutable fields for auth_oidc_signing_alg (all of them) -create trigger - immutable_columns -before -update on auth_oidc_signing_alg_enm - for each row execute procedure immutable_columns('name'); -`), - 1084: []byte(` --- auth_oidc_method entries are the current oidc auth methods configured for --- existing scopes. -create table auth_oidc_method ( - public_id wt_public_id - primary key, - scope_id wt_scope_id - not null, - name wt_name, - description wt_description, - create_time wt_timestamp, - update_time wt_timestamp, - version wt_version, - state text not null - references auth_oidc_method_state_enm(name) - on delete restrict - on update cascade, - discovery_url wt_url not null, -- oidc discovery URL without any .well-known component - client_id text not null -- oidc client identifier issued by the oidc provider. - constraint client_id_not_empty - check(length(trim(client_id)) > 0), - client_secret bytea not null, -- encrypted oidc client secret issued by the oidc provider. - key_id wt_private_id not null -- key used to encrypt entries via wrapping wrapper. - references kms_oidc_key_version(private_id) - on delete restrict - on update cascade, - max_age int not null -- the allowable elapsed time in secs since the last time the user was authenticated. zero is allowed and should force the user to be re-authenticated. - constraint max_age_equal_or_greater_than_zero - check(max_age >= 0), - foreign key (scope_id, public_id) - references auth_method (scope_id, public_id) - on delete cascade - on update cascade, - unique(scope_id, name), - unique(scope_id, public_id), - unique(scope_id, discovery_url, client_id) -- a client_id must be unique for a provider within a scope. -); - --- auth_oidc_signing_alg entries are the signing algorithms allowed for an oidc --- auth method. There must be at least one allowed alg for each oidc auth method. -create table auth_oidc_signing_alg ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - signing_alg_name text - references auth_oidc_signing_alg_enm(name) - on delete restrict - on update cascade, - primary key(oidc_method_id, signing_alg_name) -); - --- auth_oidc_callback_url entries are the callback URLs allowed for a specific --- oidc auth method. There must be at least one callback url for each oidc auth --- method. -create table auth_oidc_callback_url ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - callback_url wt_url not null -); - --- auth_oidc_aud_claim entries are the audience claims for a specific oidc auth --- method. There can be 0 or more for each parent oidc auth method. If an auth --- method has any aud claims, an ID token must contain one of them to be valid. -create table auth_oidc_aud_claim ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - aud_claim text not null - constraint aud_claim_must_not_be_empty - check(length(trim(aud_claim)) > 0) - constraint aud_claim_must_be_less_than_1024_chars - check(length(trim(aud_claim)) < 1024), - primary key(oidc_method_id, aud_claim) -); - --- auth_oidc_certificate entries are optional PEM encoded x509 certificates. --- Each entry is a single certificate. An oidc auth method may have 0 or more --- of these optional x509s. If an auth method has any cert entries, they are --- used as trust anchors when connecting to the auth method's oidc provider --- (instead of the host system's cert chain). -create table auth_oidc_certificate ( - oidc_method_id wt_public_id - references auth_oidc_method(public_id) - on delete cascade - on update cascade, - certificate bytea not null, - primary key(oidc_method_id, certificate) -); - - -create table auth_oidc_account ( - public_id wt_public_id - primary key, - auth_method_id wt_public_id - not null, - -- NOTE(mgaffney): The scope_id type is not wt_scope_id because the domain - -- check is executed before the insert trigger which retrieves the scope_id - -- causing an insert to fail. - scope_id text not null, - name wt_name, - description wt_description, - create_time wt_timestamp, - update_time wt_timestamp, - version wt_version, - issuer_id wt_url not null, -- case-sensitive URL that maps to an id_token's iss claim - subject_id text not null -- case-senstive string that maps to an id_token's sub claim - constraint subject_id_must_not_be_empty - check ( - length(trim(subject_id)) > 0 - ) - constraint subject_id_must_be_less_than_256_chars - check( - length(trim(subject_id)) <= 255 -- length limit per OIDC spec - ), - full_name wt_full_name, -- may be null and maps to an id_token's name claim - email wt_email, -- may be null and maps to the id_token's email claim - foreign key (scope_id, auth_method_id) - references auth_oidc_method (scope_id, public_id) - on delete cascade - on update cascade, - foreign key (scope_id, auth_method_id, public_id) - references auth_account (scope_id, auth_method_id, public_id) - on delete cascade - on update cascade, - unique(auth_method_id, name), - unique(auth_method_id, issuer_id, subject_id), -- subject must be unique for a provider within specific auth method - unique(auth_method_id, public_id) -); - --- auth_oidc_method column triggers -create trigger - insert_auth_method_subtype -before insert on auth_oidc_method - for each row execute procedure insert_auth_method_subtype(); - -create trigger - update_time_column -before -update on auth_oidc_method - for each row execute procedure update_time_column(); - -create trigger - immutable_columns -before -update on auth_oidc_method - for each row execute procedure immutable_columns('public_id', 'scope_id', 'create_time'); - -create trigger - default_create_time_column -before -insert on auth_oidc_method - for each row execute procedure default_create_time(); - -create trigger - update_version_column -after update on auth_oidc_method - for each row execute procedure update_version_column(); - --- auth_oidc_account column triggers -create trigger - update_time_column -before -update on auth_oidc_account - for each row execute procedure update_time_column(); - -create trigger - immutable_columns -before -update on auth_oidc_account - for each row execute procedure immutable_columns('public_id', 'auth_method_id', 'scope_id', 'create_time', 'issuer_id', 'subject_id'); - -create trigger - default_create_time_column -before -insert on auth_oidc_account - for each row execute procedure default_create_time(); - -create trigger - update_version_column -after update on auth_oidc_account - for each row execute procedure update_version_column(); - -create trigger - insert_auth_account_subtype -before insert on auth_oidc_account - for each row execute procedure insert_auth_account_subtype(); -`), - 1085: []byte(` --- auth_token_status_enm entries define the possible auth token --- states. -create table auth_token_status_enm ( - name text primary key - constraint only_predefined_auth_token_states_allowed - check ( - name in ('auth token pending','token issued', 'authentication failed', 'system error') - ) -); - --- populate the values of auth_token_status_enm -insert into auth_token_status_enm(name) - values - ('auth token pending'), - ('token issued'), - ('authentication failed'), - ('system error'); - - --- add the state column with a default to the auth_token table. -alter table auth_token -add column status text -not null -default 'token issued' -- safest default -references auth_token_status_enm(name) - on update cascade - on delete restrict; -`), - 1086: []byte(` --- add the account_info_auth_method_id which determines which auth_method is --- designated as for "account info" in the user's scope. -alter table iam_scope -add column account_info_auth_method_id wt_public_id -- allowed to be null and is mutable of course. -references auth_method(public_id) - on update cascade - on delete set null; - --- establish a compond fk, but there's no cascading of deletes or updates, since --- we only want to cascade changes to the account_info_auth_method_id portion of --- the compond fk and that is handled in a separate fk declaration. -alter table iam_scope -add foreign key (public_id, account_info_auth_method_id) references auth_method(scope_id, public_id); - --- iam_user_acct_info provides account info for users by determining which --- auth_method is designated as for "account info" in the user's scope via the --- scope's account_info_auth_method_id. Every sub-type of auth_account must be --- added to this view's union. -create view iam_acct_info as -select - aa.iam_user_id, - oa.subject_id as login_name, - oa.full_name as full_name, - oa.email as email -from - iam_scope s, - auth_account aa, - auth_oidc_account oa -where - aa.public_id = oa.public_id and - aa.auth_method_id = s.account_info_auth_method_id -union -select - aa.iam_user_id, - pa.login_name, - '' as full_name, - '' as email -from - iam_scope s, - auth_account aa, - auth_password_account pa -where - aa.public_id = pa.public_id and - aa.auth_method_id = s.account_info_auth_method_id; - --- iam_user_acct_info provides a simple way to retrieve entries that include --- both the iam_user fields with an outer join to the user's account info. -create view iam_user_acct_info as -select - u.public_id, - u.scope_id, - u.name, - u.description, - u.create_time, - u.update_time, - u.version, - i.login_name, - i.full_name, - i.email -from - iam_user u -left outer join iam_acct_info i on u.public_id = i.iam_user_id; `), }, }