chengcheng
4426eeccf7
All checks were successful
ci / verify (pull_request) Successful in 12m18s
合并远端生产 CI、依赖与 API 文档改动，保留统一认证和 SSF 能力。由于远端生产基线已占用 0062，将尚未发布的身份迁移整理为 0063 至 0068 的最终增量 Schema，移除仅用于开发期草稿升级的破坏性迁移步骤。 验证：go test ./...。其余生产门禁在合并提交后继续执行。
57 lines
2.5 KiB
SQL
57 lines
2.5 KiB
SQL
CREATE TABLE IF NOT EXISTS gateway_identity_configuration_revisions (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
state text NOT NULL DEFAULT 'draft' CHECK (state IN ('draft','validated','active','superseded','failed')),
|
|
schema_version integer NOT NULL DEFAULT 1 CHECK (schema_version = 1),
|
|
auth_center_url text NOT NULL,
|
|
issuer text,
|
|
tenant_id text,
|
|
application_id text,
|
|
audience text,
|
|
browser_client_id text,
|
|
machine_client_id text,
|
|
scopes jsonb NOT NULL DEFAULT '[]'::jsonb CHECK (jsonb_typeof(scopes) = 'array'),
|
|
capabilities jsonb NOT NULL DEFAULT '[]'::jsonb CHECK (jsonb_typeof(capabilities) = 'array'),
|
|
role_prefix text NOT NULL DEFAULT 'gateway.',
|
|
local_tenant_key text NOT NULL,
|
|
public_base_url text NOT NULL,
|
|
web_base_url text NOT NULL,
|
|
jit_enabled boolean NOT NULL DEFAULT true,
|
|
legacy_jwt_enabled boolean NOT NULL DEFAULT false,
|
|
token_introspection boolean NOT NULL DEFAULT false,
|
|
session_revocation boolean NOT NULL DEFAULT false,
|
|
security_event_issuer text,
|
|
security_event_configuration_url text,
|
|
security_event_audience text,
|
|
machine_credential_ref text,
|
|
session_encryption_key_ref text,
|
|
session_idle_seconds integer NOT NULL DEFAULT 1800 CHECK (session_idle_seconds > 0),
|
|
session_absolute_seconds integer NOT NULL DEFAULT 28800 CHECK (session_absolute_seconds > session_idle_seconds),
|
|
session_refresh_seconds integer NOT NULL DEFAULT 60 CHECK (session_refresh_seconds > 0 AND session_refresh_seconds < session_idle_seconds),
|
|
version bigint NOT NULL DEFAULT 1 CHECK (version > 0),
|
|
last_error_category text,
|
|
last_trace_id text,
|
|
last_audit_id text,
|
|
validated_at timestamptz,
|
|
activated_at timestamptz,
|
|
superseded_at timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
CHECK (machine_credential_ref IS NULL OR machine_credential_ref ~ '^[a-z0-9][a-z0-9-]{0,127}$'),
|
|
CHECK (session_encryption_key_ref IS NULL OR session_encryption_key_ref ~ '^[a-z0-9][a-z0-9-]{0,127}$')
|
|
);
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_gateway_identity_configuration_single_active
|
|
ON gateway_identity_configuration_revisions ((true)) WHERE state = 'active';
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_identity_configuration_revisions_created
|
|
ON gateway_identity_configuration_revisions(created_at DESC);
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway_identity_management_requests (
|
|
operation text NOT NULL,
|
|
idempotency_key text NOT NULL,
|
|
request_hash text NOT NULL,
|
|
response jsonb NOT NULL,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY (operation, idempotency_key)
|
|
);
|