chengcheng
d345c070ae
使用 AES-256-GCM 保存认证中心令牌，并以随机 Cookie 哈希关联 PostgreSQL 会话。加入闲置与绝对期限、Refresh Token 轮换以及多实例刷新锁。
25 lines
1.1 KiB
SQL
25 lines
1.1 KiB
SQL
CREATE TABLE IF NOT EXISTS gateway_oidc_sessions (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
session_token_hash bytea NOT NULL UNIQUE,
|
|
gateway_user_id uuid NOT NULL REFERENCES gateway_users(id) ON DELETE CASCADE,
|
|
gateway_tenant_id uuid NOT NULL REFERENCES gateway_tenants(id) ON DELETE CASCADE,
|
|
token_ciphertext bytea NOT NULL,
|
|
access_token_expires_at timestamptz NOT NULL,
|
|
last_seen_at timestamptz NOT NULL,
|
|
idle_expires_at timestamptz NOT NULL,
|
|
absolute_expires_at timestamptz NOT NULL,
|
|
refresh_version bigint NOT NULL DEFAULT 1,
|
|
refresh_lock_id uuid,
|
|
refresh_lock_until timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
CONSTRAINT gateway_oidc_sessions_hash_length CHECK (octet_length(session_token_hash) = 32),
|
|
CONSTRAINT gateway_oidc_sessions_expiry_order CHECK (idle_expires_at <= absolute_expires_at)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_oidc_sessions_expiry
|
|
ON gateway_oidc_sessions(absolute_expires_at, idle_expires_at);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_oidc_sessions_user
|
|
ON gateway_oidc_sessions(gateway_user_id, created_at DESC);
|