71 lines
2.6 KiB
SQL
71 lines
2.6 KiB
SQL
CREATE TABLE IF NOT EXISTS gateway_security_event_receipts (
|
|
issuer text NOT NULL,
|
|
jti uuid NOT NULL,
|
|
audience text NOT NULL,
|
|
event_type text NOT NULL,
|
|
transaction_id text,
|
|
tenant_id text,
|
|
subject_hash text,
|
|
event_timestamp timestamptz,
|
|
received_at timestamptz NOT NULL DEFAULT now(),
|
|
processed_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY (issuer, jti)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_security_event_receipts_received
|
|
ON gateway_security_event_receipts(received_at DESC);
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway_oidc_revocation_watermarks (
|
|
issuer text NOT NULL,
|
|
tenant_id text NOT NULL,
|
|
subject text NOT NULL,
|
|
revoked_at timestamptz NOT NULL,
|
|
source_jti uuid NOT NULL,
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY (issuer, tenant_id, subject)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_oidc_revocation_watermarks_lookup
|
|
ON gateway_oidc_revocation_watermarks(issuer, tenant_id, subject, revoked_at);
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway_security_event_stream_state (
|
|
issuer text NOT NULL,
|
|
audience text NOT NULL,
|
|
stream_id uuid NOT NULL,
|
|
stream_status text NOT NULL DEFAULT 'unknown',
|
|
mode text NOT NULL DEFAULT 'bootstrap',
|
|
last_verification_at timestamptz,
|
|
bootstrap_until timestamptz,
|
|
consecutive_verifications integer NOT NULL DEFAULT 0,
|
|
pending_state_hash bytea,
|
|
pending_state_created_at timestamptz,
|
|
fallback_since timestamptz,
|
|
last_error_category text,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY (issuer, audience),
|
|
UNIQUE (stream_id),
|
|
CONSTRAINT gateway_security_event_stream_state_mode
|
|
CHECK (mode IN ('bootstrap','push_healthy','introspection_fallback')),
|
|
CONSTRAINT gateway_security_event_stream_state_status
|
|
CHECK (stream_status IN ('unknown','enabled','paused','disabled')),
|
|
CONSTRAINT gateway_security_event_stream_state_pending_hash
|
|
CHECK (pending_state_hash IS NULL OR octet_length(pending_state_hash) = 32)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway_security_event_verification_challenges (
|
|
issuer text NOT NULL,
|
|
audience text NOT NULL,
|
|
state_hash bytea NOT NULL,
|
|
created_at timestamptz NOT NULL,
|
|
expires_at timestamptz NOT NULL,
|
|
PRIMARY KEY (issuer, audience, state_hash),
|
|
FOREIGN KEY (issuer, audience)
|
|
REFERENCES gateway_security_event_stream_state(issuer, audience) ON DELETE CASCADE,
|
|
CONSTRAINT gateway_security_event_verification_challenge_hash
|
|
CHECK (octet_length(state_hash) = 32)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_security_event_challenges_expiry
|
|
ON gateway_security_event_verification_challenges(expires_at);
|