57 lines
1.8 KiB
SQL
57 lines
1.8 KiB
SQL
-- name: KeyByHash :one
|
|
-- The authentication hot path. Joins owners so one round trip settles both the
|
|
-- key's status and the account's.
|
|
--
|
|
-- No filter on status here: the middleware needs to distinguish "revoked" from
|
|
-- "expired" from "unknown" to give a useful error, and it cannot do that if the
|
|
-- query has already hidden the row.
|
|
SELECT
|
|
k.id,
|
|
k.owner_id,
|
|
k.scopes,
|
|
k.quota_tier,
|
|
k.status,
|
|
k.expires_at,
|
|
o.status AS owner_status
|
|
FROM api.keys k
|
|
JOIN api.owners o ON o.id = k.owner_id
|
|
WHERE k.key_hash = $1;
|
|
|
|
-- name: TouchKeyLastUsed :exec
|
|
-- Debounced by the caller: writing on every request would be one UPDATE per
|
|
-- request for a field nobody reads in real time.
|
|
UPDATE api.keys
|
|
SET last_used_at = now()
|
|
WHERE id = $1
|
|
AND (last_used_at IS NULL OR last_used_at < now() - interval '5 minutes');
|
|
|
|
-- name: CreateOwner :one
|
|
INSERT INTO api.owners (email, callsign)
|
|
VALUES ($1, $2)
|
|
RETURNING id, email, callsign, status, created_at;
|
|
|
|
-- name: OwnerByEmail :one
|
|
SELECT id, email, email_verified_at, callsign, callsign_verified_at, status, created_at
|
|
FROM api.owners
|
|
WHERE email = $1;
|
|
|
|
-- name: CreateKey :one
|
|
INSERT INTO api.keys (owner_id, key_hash, key_prefix, label, scopes, quota_tier, expires_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7)
|
|
RETURNING id, key_prefix, scopes, quota_tier, status, created_at, expires_at;
|
|
|
|
-- name: ListKeysForOwner :many
|
|
SELECT id, key_prefix, label, scopes, quota_tier, status,
|
|
created_at, expires_at, last_used_at, revoked_at
|
|
FROM api.keys
|
|
WHERE owner_id = $1
|
|
ORDER BY created_at DESC;
|
|
|
|
-- name: RevokeKey :exec
|
|
-- The keys_revoked_consistent CHECK requires status and revoked_at to move
|
|
-- together, so both are set here.
|
|
UPDATE api.keys
|
|
SET status = 'revoked', revoked_at = now(), revoked_reason = $2
|
|
WHERE id = $1
|
|
AND status <> 'revoked';
|
|
|