31 lines
1.4 KiB
SQL
31 lines
1.4 KiB
SQL
-- ==========================================
|
|
-- Chat Switchboard — 019 Auth Providers
|
|
-- ==========================================
|
|
-- OIDC authorization state tracking.
|
|
-- Group source column for OIDC-synced groups.
|
|
-- ICD §1 (Users), §2 (Groups) — v0.24.1
|
|
-- ==========================================
|
|
|
|
-- ── OIDC authorization state (short-lived) ───────────────────────
|
|
-- Stores state + nonce for the authorization code flow.
|
|
-- Rows deleted after callback completes. Stale rows cleaned by age.
|
|
CREATE TABLE IF NOT EXISTS oidc_auth_state (
|
|
state TEXT PRIMARY KEY,
|
|
nonce TEXT NOT NULL,
|
|
redirect_to TEXT,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_oidc_state_created
|
|
ON oidc_auth_state(created_at);
|
|
|
|
-- ── Group source tracking ────────────────────────────────────────
|
|
-- Distinguishes manually-created groups from OIDC-synced groups.
|
|
-- OIDC groups are managed exclusively by the sync process.
|
|
ALTER TABLE groups
|
|
ADD COLUMN IF NOT EXISTS source VARCHAR(20) NOT NULL DEFAULT 'manual'
|
|
CHECK (source IN ('manual', 'oidc'));
|
|
|
|
COMMENT ON TABLE oidc_auth_state IS 'Ephemeral OIDC authorization code flow state. Rows deleted after callback.';
|
|
COMMENT ON COLUMN groups.source IS 'manual=admin-created, oidc=synced from IdP groups claim';
|