Timothy Messier
8caaf3e076
This refactors the schema package and subpackages to support editions.
An Edition is a collection of sql migrations. A given boundary binary
can have multiple migration editions. The `schema.Manager` is updated to
apply the necessary migrations in the correct order, leveraging an
Edition's priority to determine the order in which the separate Editions
are applied.
The sql migration files are now nested under a directory for the
edition.
This also switches from the generated code to using embed, which
eliminates the need for the `make migrations` target and the generated
code. As such this commit removes the target and generated code.
See:
https://pkg.go.dev/embed
86 lines
3.5 KiB
PL/PgSQL
86 lines
3.5 KiB
PL/PgSQL
begin;
|
|
|
|
|
|
-- auth_oidc_scope entries are the optional scopes for a specific oidc auth
|
|
-- method. There can be 0 or more for each parent oidc auth method. If an auth
|
|
-- method has any scopes, they will be added to provider requests along with the
|
|
-- default of "openid".
|
|
create table auth_oidc_scope (
|
|
create_time wt_timestamp,
|
|
oidc_method_id wt_public_id
|
|
constraint auth_oidc_method_fkey
|
|
references auth_oidc_method(public_id)
|
|
on delete cascade
|
|
on update cascade,
|
|
scope text not null
|
|
constraint scope_must_not_be_empty
|
|
check(length(trim(scope)) > 0)
|
|
constraint scope_must_be_less_than_1024_chars
|
|
check(length(trim(scope)) < 1024)
|
|
constraint scope_must_not_be_openid -- the default scope is not allowed, since it's redundant
|
|
check(lower(trim(scope)) != 'openid'),
|
|
primary key(oidc_method_id, scope)
|
|
);
|
|
comment on table auth_oidc_scope is
|
|
'auth_oidc_scope entries are the optional scopes for a specific oidc auth method. There can be 0 or more for each parent oidc auth method. If an auth method has any scopes, they will be added to provider requests along with the openid default.';
|
|
|
|
|
|
create trigger
|
|
default_create_time_column
|
|
before
|
|
insert on auth_oidc_scope
|
|
for each row execute procedure default_create_time();
|
|
|
|
|
|
-- we will drop the oidc_auth_method_with_value_obj view, so we can recreate it
|
|
-- and add the oidc claim's scopes to the returned set.
|
|
drop view oidc_auth_method_with_value_obj;
|
|
|
|
-- oidc_auth_method_with_value_obj is useful for reading an oidc auth method
|
|
-- with its associated value objects (algs, auds, certs) as columns
|
|
-- with | delimited values. The use of the postgres string_agg(...) to
|
|
-- aggregate the value objects into a column works because we are only pulling
|
|
-- in one column from the associated tables and that value is part of the
|
|
-- primary key and unique. This view will make things like recursive listing of
|
|
-- oidc auth methods fairly straightforward to implement for the oidc repo.
|
|
-- The view also includes an is_primary_auth_method bool
|
|
create view oidc_auth_method_with_value_obj as
|
|
select
|
|
case when s.primary_auth_method_id is not null then
|
|
true
|
|
else false end
|
|
as is_primary_auth_method,
|
|
am.public_id,
|
|
am.scope_id,
|
|
am.name,
|
|
am.description,
|
|
am.create_time,
|
|
am.update_time,
|
|
am.version,
|
|
am.state,
|
|
am.api_url,
|
|
am.disable_discovered_config_validation,
|
|
am.issuer,
|
|
am.client_id,
|
|
am.client_secret,
|
|
am.client_secret_hmac,
|
|
am.key_id,
|
|
am.max_age,
|
|
-- the string_agg(..) column will be null if there are no associated value objects
|
|
string_agg(distinct alg.signing_alg_name, '|') as algs,
|
|
string_agg(distinct aud.aud_claim, '|') as auds,
|
|
string_agg(distinct cert.certificate, '|') as certs,
|
|
string_agg(distinct cs.scope, '|') as claims_scopes
|
|
from
|
|
auth_oidc_method am
|
|
left outer join iam_scope s on am.public_id = s.primary_auth_method_id
|
|
left outer join auth_oidc_signing_alg alg on am.public_id = alg.oidc_method_id
|
|
left outer join auth_oidc_aud_claim aud on am.public_id = aud.oidc_method_id
|
|
left outer join auth_oidc_certificate cert on am.public_id = cert.oidc_method_id
|
|
left outer join auth_oidc_scope cs on am.public_id = cs.oidc_method_id
|
|
group by am.public_id, is_primary_auth_method; -- there can be only one public_id + is_primary_auth_method, so group by isn't a problem.
|
|
comment on view oidc_auth_method_with_value_obj is
|
|
'oidc auth method with its associated value objects (algs, auds, certs, scopes) as columns with | delimited values';
|
|
|
|
commit;
|