-- The state of the router's OpenID Provider (vpnrouter_oidc) in the database of web.database.
-- Codes, tokens and sessions are kept as the SHA-256 of their values; expired rows are purged when new ones are saved.
-- The whole file runs as one transaction, serialized by an advisory lock, so that two processes can load it at once.

SELECT pg_advisory_xact_lock(hashtext('vpn-router oidc schema'));

-- An authorization code, valid until it is exchanged for tokens or expires.
CREATE TABLE IF NOT EXISTS oidc_codes (
    hash text PRIMARY KEY,
    client_id text NOT NULL,
    name text NOT NULL,
    redirect_uri text NOT NULL,
    scopes text[] NOT NULL,
    nonce text,
    code_challenge text NOT NULL,
    code_challenge_method text NOT NULL,
    auth_time timestamptz NOT NULL,
    amr text[] NOT NULL,
    expires timestamptz NOT NULL
);

-- An access token or a refresh token (kind) a client was issued for a user.
CREATE TABLE IF NOT EXISTS oidc_tokens (
    hash text PRIMARY KEY,
    kind text NOT NULL CHECK (kind IN ('access', 'refresh')),
    client_id text NOT NULL,
    name text NOT NULL,
    scopes text[] NOT NULL,
    auth_time timestamptz NOT NULL,
    amr text[] NOT NULL,
    expires timestamptz NOT NULL
);
CREATE INDEX IF NOT EXISTS oidc_tokens_name ON oidc_tokens (name);

-- A user's sign-in at the OpenID Provider, which the session cookie names.
CREATE TABLE IF NOT EXISTS oidc_sessions (
    hash text PRIMARY KEY,
    name text NOT NULL,
    auth_time timestamptz NOT NULL,
    amr text[] NOT NULL,
    expires timestamptz NOT NULL
);

CREATE OR REPLACE PROCEDURE oidc_code_save(p_hash text, p_client_id text, p_name text, p_redirect_uri text,
                                           p_scopes text[], p_nonce text, p_code_challenge text,
                                           p_code_challenge_method text, p_auth_time timestamptz, p_amr text[],
                                           p_seconds integer)
LANGUAGE sql AS $$
    DELETE FROM oidc_codes WHERE expires < now();
    INSERT INTO oidc_codes VALUES (p_hash, p_client_id, p_name, p_redirect_uri, p_scopes, p_nonce, p_code_challenge,
                                   p_code_challenge_method, p_auth_time, p_amr, now() + make_interval(secs => p_seconds));
$$;

-- The unexpired code.
CREATE OR REPLACE FUNCTION oidc_code_get(p_hash text)
RETURNS TABLE (client_id text, name text, redirect_uri text, scopes text[], nonce text, code_challenge text,
               code_challenge_method text, auth_time timestamptz, amr text[])
LANGUAGE sql STABLE AS $$
    SELECT client_id, name, redirect_uri, scopes, nonce, code_challenge, code_challenge_method, auth_time, amr
    FROM oidc_codes WHERE hash = p_hash AND expires > now();
$$;

CREATE OR REPLACE PROCEDURE oidc_code_delete(p_hash text)
LANGUAGE sql AS $$
    DELETE FROM oidc_codes WHERE hash = p_hash;
$$;

CREATE OR REPLACE PROCEDURE oidc_token_save(p_hash text, p_kind text, p_client_id text, p_name text, p_scopes text[],
                                            p_auth_time timestamptz, p_amr text[], p_seconds integer)
LANGUAGE sql AS $$
    DELETE FROM oidc_tokens WHERE expires < now();
    INSERT INTO oidc_tokens VALUES (p_hash, p_kind, p_client_id, p_name, p_scopes, p_auth_time, p_amr,
                                    now() + make_interval(secs => p_seconds));
$$;

-- The unexpired token of the kind.
CREATE OR REPLACE FUNCTION oidc_token_get(p_hash text, p_kind text)
RETURNS TABLE (client_id text, name text, scopes text[], auth_time timestamptz, amr text[])
LANGUAGE sql STABLE AS $$
    SELECT client_id, name, scopes, auth_time, amr FROM oidc_tokens
    WHERE hash = p_hash AND kind = p_kind AND expires > now();
$$;

CREATE OR REPLACE PROCEDURE oidc_token_delete(p_hash text)
LANGUAGE sql AS $$
    DELETE FROM oidc_tokens WHERE hash = p_hash;
$$;

CREATE OR REPLACE PROCEDURE oidc_session_save(p_hash text, p_name text, p_amr text[], p_seconds integer)
LANGUAGE sql AS $$
    DELETE FROM oidc_sessions WHERE expires < now();
    INSERT INTO oidc_sessions VALUES (p_hash, p_name, now(), p_amr, now() + make_interval(secs => p_seconds));
$$;

-- The unexpired session.
CREATE OR REPLACE FUNCTION oidc_session_get(p_hash text)
RETURNS TABLE (name text, auth_time timestamptz, amr text[])
LANGUAGE sql STABLE AS $$
    SELECT name, auth_time, amr FROM oidc_sessions WHERE hash = p_hash AND expires > now();
$$;

CREATE OR REPLACE PROCEDURE oidc_session_delete(p_hash text)
LANGUAGE sql AS $$
    DELETE FROM oidc_sessions WHERE hash = p_hash;
$$;

-- Remove every code, token and session of the user.
CREATE OR REPLACE PROCEDURE oidc_revoke(p_name text)
LANGUAGE sql AS $$
    DELETE FROM oidc_codes WHERE name = p_name;
    DELETE FROM oidc_tokens WHERE name = p_name;
    DELETE FROM oidc_sessions WHERE name = p_name;
$$;