Upsert creates a new KMS and Updates PKI workers (#2187)

internal/db/schema/migrations/oss/postgres/99/02_worker_controller_tables.up.sql

@@ -120,6 +120,7 @@ begin
       table = tg_table_name,
       column = 'name';
   end if;
+  return new;
 end;
 $$ language plpgsql;
 comment on function immutable_kms_name is
@@ -134,8 +135,8 @@ as $$
 begin
   if new.type = 'kms' then 
     new.last_status_time = now();
-    return new;
   end if;
+  return new;
 end;
 $$ language plpgsql;
 comment on function update_kms_server_worker_update_last_status_time_column is
@@ -150,8 +151,8 @@ as $$
 begin
   if new.type = 'pki' then
     new.last_status_time = now();
-    return new;
   end if;
+  return new;
 end;
 $$ language plpgsql;
 comment on function update_pki_server_worker_update_last_status_time_column is
@@ -166,8 +167,8 @@ as $$
 begin
   if new.type = 'kms' then
     new.last_status_time = now();
-    return new;
   end if;
+  return new;
 end;
 $$ language plpgsql;
 comment on function insert_kms_server_worker_update_last_status_time_column is
@@ -176,26 +177,6 @@ comment on function insert_kms_server_worker_update_last_status_time_column is
 create trigger insert_server_worker_last_update_time_column before insert on server_worker
   for each row execute procedure insert_kms_server_worker_update_last_status_time_column();
 
-create function insert_server_worker_type_column()
-  returns trigger
-as $$
-begin
-  perform from worker_auth_authorized where worker_id = new.public_id;
-  case 
-    when new.type = 'pki' and not found then
-        raise exception 'invalid type: pki worker is not authorized in worker_auth_authorized table';
-    when new.type = 'kms' and found then
-        raise exception 'invalid type: kms worker cannot authorized in worker_auth_authorized table';
-  end case;
-  return new;
-end;
-$$ language plpgsql;
-comment on function insert_server_worker_type_column is
-  'function used to constraint the type column in server_worker';
-
-create trigger insert_server_worker_type_column before insert on server_worker
-  for each row execute procedure insert_server_worker_type_column();
-
 -- Create table worker tag
 create table server_worker_tag_enm (
   source text primary key

internal/db/schema/migrations/oss/postgres/99/03_worker_authentication.up.sql

@@ -112,6 +112,8 @@ create table worker_auth_authorized(
       on update cascade,
   nonce bytea -- encrypted value
 );
+comment on table worker_auth_authorized is
+  'worker_auth_authorized is a table where each row represents key and cert data associated with an authorized worker.';
 
 create trigger
   immutable_columns
@@ -120,8 +122,22 @@ create trigger
   for each row execute procedure immutable_columns('worker_key_identifier', 'worker_id', 'worker_signing_pub_key',
     'worker_encryption_pub_key', 'controller_encryption_priv_key', 'key_id', 'nonce');
 
-comment on table worker_auth_authorized is
-  'worker_auth_authorized is a table where each row represents key and cert data associated with an authorized worker.';
+create function insert_worker_auth_authorized_type_check()
+  returns trigger
+as $$
+begin
+  perform from server_worker where type = 'pki' and public_id = new.worker_id;
+  if not found then
+    raise exception 'invalid type: non pki worker cannot be authorized in worker_auth_authorized table';
+  end if;
+  return new;
+end;
+$$ language plpgsql;
+comment on function insert_worker_auth_authorized_type_check is
+  'function used to only allow workers of type pki to be authorized';
+
+create trigger insert_worker_auth_authorized_type_check before insert on worker_auth_authorized
+  for each row execute procedure insert_worker_auth_authorized_type_check();
 
 create table worker_auth_certificate_bundle(
  root_certificate_public_key bytea not null

internal/db/schema/migrations/oss/postgres/99/04_views.up.sql

@@ -30,6 +30,7 @@ select
   w.update_time,
   w.version,
   w.last_status_time,
+  w.type,
   cc.count as active_connection_count,
   -- keys and tags can be any lowercase printable character so use uppercase characters as delimitors.
   wt.tags as api_tags,
@@ -44,7 +45,6 @@ from server_worker w
 comment on view server_worker_aggregate is
   'server_worker_aggregate contains the worker resource with its worker provided config values and its configuration and api provided tags.';
 
-
 -- Replaces the view created in 9/01.
 -- Remove the worker id from this view.  In actuality this is almost a no-op
 -- because no server information was ever getting populated here due to a bug