Joseph Doherty
70 lines
3.2 KiB
SQL
70 lines
3.2 KiB
SQL
-- ZB.MOM.WW.Auth.ApiKeys.SqlServer — shared API-key schema, version 1.
|
|
--
|
|
-- For DBAs whose application login lacks DDL rights. The host normally provisions this itself at
|
|
-- startup (SqlServerApiKeyStoreMigrator, which runs the identical statements and is safe to run
|
|
-- concurrently from every node); where the app login may only read and write rows, run this script
|
|
-- once against the target database instead. The migrator then finds the version row already at the
|
|
-- version it supports and does nothing further beyond re-stamping applied_utc.
|
|
--
|
|
-- The schema name is hard-coded to zbauth here — the default of SqlServerApiKeyOptions.Schema. If a
|
|
-- deployment overrides that option, substitute the name in every bracketed identifier below.
|
|
--
|
|
-- Kept byte-for-byte consistent with SqlServerAuthSchema.CreateSchemaDdl apart from that
|
|
-- substitution and the literal version row at the end; change both together.
|
|
|
|
IF NOT EXISTS (SELECT 1 FROM sys.schemas WHERE name = N'zbauth')
|
|
EXEC(N'CREATE SCHEMA [zbauth]');
|
|
|
|
IF OBJECT_ID(N'[zbauth].[schema_version]', N'U') IS NULL
|
|
CREATE TABLE [zbauth].[schema_version] (
|
|
id INT NOT NULL CONSTRAINT PK_zbauth_schema_version PRIMARY KEY CHECK (id = 1),
|
|
version INT NOT NULL,
|
|
applied_utc DATETIMEOFFSET(7) NOT NULL
|
|
);
|
|
|
|
IF OBJECT_ID(N'[zbauth].[api_keys]', N'U') IS NULL
|
|
CREATE TABLE [zbauth].[api_keys] (
|
|
key_id NVARCHAR(64) NOT NULL CONSTRAINT PK_zbauth_api_keys PRIMARY KEY,
|
|
key_prefix NVARCHAR(16) NOT NULL,
|
|
secret_hash VARBINARY(64) NOT NULL,
|
|
display_name NVARCHAR(256) NOT NULL,
|
|
scopes NVARCHAR(MAX) NOT NULL,
|
|
constraints NVARCHAR(MAX) NULL,
|
|
created_utc DATETIMEOFFSET(7) NOT NULL,
|
|
last_used_utc DATETIMEOFFSET(7) NULL,
|
|
revoked_utc DATETIMEOFFSET(7) NULL,
|
|
expires_utc DATETIMEOFFSET(7) NULL
|
|
);
|
|
|
|
IF OBJECT_ID(N'[zbauth].[api_key_audit]', N'U') IS NULL
|
|
CREATE TABLE [zbauth].[api_key_audit] (
|
|
audit_id BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_zbauth_api_key_audit PRIMARY KEY,
|
|
key_id NVARCHAR(64) NULL,
|
|
event_type NVARCHAR(64) NOT NULL,
|
|
remote_address NVARCHAR(64) NULL,
|
|
created_utc DATETIMEOFFSET(7) NOT NULL,
|
|
details NVARCHAR(MAX) NULL
|
|
);
|
|
|
|
IF NOT EXISTS (
|
|
SELECT 1 FROM sys.indexes
|
|
WHERE name = N'ix_api_keys_revoked_utc'
|
|
AND object_id = OBJECT_ID(N'[zbauth].[api_keys]'))
|
|
CREATE INDEX ix_api_keys_revoked_utc
|
|
ON [zbauth].[api_keys] (revoked_utc);
|
|
|
|
IF NOT EXISTS (
|
|
SELECT 1 FROM sys.indexes
|
|
WHERE name = N'ix_api_key_audit_key_id_created_utc'
|
|
AND object_id = OBJECT_ID(N'[zbauth].[api_key_audit]'))
|
|
CREATE INDEX ix_api_key_audit_key_id_created_utc
|
|
ON [zbauth].[api_key_audit] (key_id, created_utc);
|
|
|
|
MERGE [zbauth].[schema_version] AS target
|
|
USING (SELECT 1 AS id, 1 AS version, SYSDATETIMEOFFSET() AS applied_utc) AS source
|
|
ON target.id = source.id
|
|
WHEN MATCHED THEN
|
|
UPDATE SET version = source.version, applied_utc = source.applied_utc
|
|
WHEN NOT MATCHED THEN
|
|
INSERT (id, version, applied_utc) VALUES (1, source.version, source.applied_utc);
|