Joseph Doherty
117 lines
6.0 KiB
C#
117 lines
6.0 KiB
C#
namespace ZB.MOM.WW.Auth.ApiKeys.SqlServer;
|
|
|
|
/// <summary>
|
|
/// Schema constants and DDL for the shared SQL Server API-key store. Mirrors
|
|
/// <c>ZB.MOM.WW.Auth.ApiKeys.Sqlite.SqliteAuthSchema</c> column-for-column so a row means exactly
|
|
/// the same thing in either store.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para>
|
|
/// <b>Timestamps are <c>DATETIMEOFFSET(7)</c>, not ISO-8601 text.</b> The sibling
|
|
/// <c>ZB.MOM.WW.Secrets</c> SQL Server store deliberately stores its timestamps as
|
|
/// <c>nvarchar</c> because its rows <em>replicate</em> with a SQLite store and last-writer-wins
|
|
/// compares those timestamps for equality, where a sub-tick round-trip difference would turn a tie
|
|
/// into a spurious "newer". No such rationale applies here: this store never replicates with the
|
|
/// SQLite one — a host picks exactly one provider, and the one-shot SQLite import is a copy, not an
|
|
/// ongoing sync — so the native type is used, which sorts and range-scans correctly and keeps the
|
|
/// tables readable to a DBA.
|
|
/// </para>
|
|
/// <para>
|
|
/// <c>SqliteAuthSchema.CurrentVersion</c> is 3 only because that store carries the donor
|
|
/// MxAccessGateway's version history (v1/v2 were byte-identical; v3 added <c>expires_utc</c>). This
|
|
/// schema is created whole, with <c>expires_utc</c> present from the start, so its own version line
|
|
/// starts at 1.
|
|
/// </para>
|
|
/// </remarks>
|
|
public static class SqlServerAuthSchema
|
|
{
|
|
/// <summary>
|
|
/// The schema version this build creates and supports. The migrator refuses a database whose
|
|
/// recorded version is <em>newer</em> than this.
|
|
/// </summary>
|
|
public const int CurrentVersion = 1;
|
|
|
|
/// <summary>Default schema the API-key tables live in.</summary>
|
|
public const string DefaultSchemaName = "zbauth";
|
|
|
|
/// <summary>Name of the single-row table tracking the applied schema version.</summary>
|
|
public const string SchemaVersionTable = "schema_version";
|
|
|
|
/// <summary>Name of the table storing API-key records.</summary>
|
|
public const string ApiKeysTable = "api_keys";
|
|
|
|
/// <summary>Name of the append-only audit table.</summary>
|
|
public const string ApiKeyAuditTable = "api_key_audit";
|
|
|
|
/// <summary>
|
|
/// Returns the idempotent DDL that provisions the schema, the three tables and the two
|
|
/// supporting indexes in <paramref name="schemaName"/>.
|
|
/// </summary>
|
|
/// <param name="schemaName">The SQL schema name to create the objects in.</param>
|
|
/// <returns>The DDL batch.</returns>
|
|
/// <remarks>
|
|
/// <paramref name="schemaName"/> is interpolated, not parameterized — T-SQL has no parameter
|
|
/// form for an object name. It is re-validated here against the same strict identifier
|
|
/// allow-list <see cref="SqlServerApiKeyOptions.Validate"/> enforces, and bracket-quoted below.
|
|
/// The duplicate check is deliberate: this method is <c>public</c>, so it must defend itself
|
|
/// rather than trust that every caller routed through the options type. The version row is NOT
|
|
/// written here — <see cref="SqlServerApiKeyStoreMigrator"/> writes it with a MERGE that also
|
|
/// updates on match, so a future upgrade re-stamps the stored version.
|
|
/// </remarks>
|
|
/// <exception cref="InvalidOperationException"><paramref name="schemaName"/> is not a plain identifier.</exception>
|
|
public static string CreateSchemaDdl(string schemaName)
|
|
{
|
|
SqlServerApiKeyOptions.ValidateIdentifier(schemaName);
|
|
|
|
return $"""
|
|
IF NOT EXISTS (SELECT 1 FROM sys.schemas WHERE name = N'{schemaName}')
|
|
EXEC(N'CREATE SCHEMA [{schemaName}]');
|
|
|
|
IF OBJECT_ID(N'[{schemaName}].[{SchemaVersionTable}]', N'U') IS NULL
|
|
CREATE TABLE [{schemaName}].[{SchemaVersionTable}] (
|
|
id INT NOT NULL CONSTRAINT PK_{schemaName}_{SchemaVersionTable} PRIMARY KEY CHECK (id = 1),
|
|
version INT NOT NULL,
|
|
applied_utc DATETIMEOFFSET(7) NOT NULL
|
|
);
|
|
|
|
IF OBJECT_ID(N'[{schemaName}].[{ApiKeysTable}]', N'U') IS NULL
|
|
CREATE TABLE [{schemaName}].[{ApiKeysTable}] (
|
|
key_id NVARCHAR(64) NOT NULL CONSTRAINT PK_{schemaName}_{ApiKeysTable} PRIMARY KEY,
|
|
key_prefix NVARCHAR(16) NOT NULL,
|
|
secret_hash VARBINARY(64) NOT NULL,
|
|
display_name NVARCHAR(256) NOT NULL,
|
|
scopes NVARCHAR(MAX) NOT NULL,
|
|
constraints NVARCHAR(MAX) NULL,
|
|
created_utc DATETIMEOFFSET(7) NOT NULL,
|
|
last_used_utc DATETIMEOFFSET(7) NULL,
|
|
revoked_utc DATETIMEOFFSET(7) NULL,
|
|
expires_utc DATETIMEOFFSET(7) NULL
|
|
);
|
|
|
|
IF OBJECT_ID(N'[{schemaName}].[{ApiKeyAuditTable}]', N'U') IS NULL
|
|
CREATE TABLE [{schemaName}].[{ApiKeyAuditTable}] (
|
|
audit_id BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_{schemaName}_{ApiKeyAuditTable} PRIMARY KEY,
|
|
key_id NVARCHAR(64) NULL,
|
|
event_type NVARCHAR(64) NOT NULL,
|
|
remote_address NVARCHAR(64) NULL,
|
|
created_utc DATETIMEOFFSET(7) NOT NULL,
|
|
details NVARCHAR(MAX) NULL
|
|
);
|
|
|
|
IF NOT EXISTS (
|
|
SELECT 1 FROM sys.indexes
|
|
WHERE name = N'ix_api_keys_revoked_utc'
|
|
AND object_id = OBJECT_ID(N'[{schemaName}].[{ApiKeysTable}]'))
|
|
CREATE INDEX ix_api_keys_revoked_utc
|
|
ON [{schemaName}].[{ApiKeysTable}] (revoked_utc);
|
|
|
|
IF NOT EXISTS (
|
|
SELECT 1 FROM sys.indexes
|
|
WHERE name = N'ix_api_key_audit_key_id_created_utc'
|
|
AND object_id = OBJECT_ID(N'[{schemaName}].[{ApiKeyAuditTable}]'))
|
|
CREATE INDEX ix_api_key_audit_key_id_created_utc
|
|
ON [{schemaName}].[{ApiKeyAuditTable}] (key_id, created_utc);
|
|
""";
|
|
}
|
|
}
|