114 lines
4.7 KiB
PL/PgSQL
114 lines
4.7 KiB
PL/PgSQL
-- The state of the router's OpenID Provider (vpnrouter_oidc) in the database of web.database.
|
|
-- Codes, tokens and sessions are kept as the SHA-256 of their values; expired rows are purged when new ones are saved.
|
|
-- The whole file runs as one transaction, serialized by an advisory lock, so that two processes can load it at once.
|
|
|
|
SELECT pg_advisory_xact_lock(hashtext('vpn-router oidc schema'));
|
|
|
|
-- An authorization code, valid until it is exchanged for tokens or expires.
|
|
CREATE TABLE IF NOT EXISTS oidc_codes (
|
|
hash text PRIMARY KEY,
|
|
client_id text NOT NULL,
|
|
name text NOT NULL,
|
|
redirect_uri text NOT NULL,
|
|
scopes text[] NOT NULL,
|
|
nonce text,
|
|
code_challenge text NOT NULL,
|
|
code_challenge_method text NOT NULL,
|
|
auth_time timestamptz NOT NULL,
|
|
amr text[] NOT NULL,
|
|
expires timestamptz NOT NULL
|
|
);
|
|
|
|
-- An access token or a refresh token (kind) a client was issued for a user.
|
|
CREATE TABLE IF NOT EXISTS oidc_tokens (
|
|
hash text PRIMARY KEY,
|
|
kind text NOT NULL CHECK (kind IN ('access', 'refresh')),
|
|
client_id text NOT NULL,
|
|
name text NOT NULL,
|
|
scopes text[] NOT NULL,
|
|
auth_time timestamptz NOT NULL,
|
|
amr text[] NOT NULL,
|
|
expires timestamptz NOT NULL
|
|
);
|
|
CREATE INDEX IF NOT EXISTS oidc_tokens_name ON oidc_tokens (name);
|
|
|
|
-- A user's sign-in at the OpenID Provider, which the session cookie names.
|
|
CREATE TABLE IF NOT EXISTS oidc_sessions (
|
|
hash text PRIMARY KEY,
|
|
name text NOT NULL,
|
|
auth_time timestamptz NOT NULL,
|
|
amr text[] NOT NULL,
|
|
expires timestamptz NOT NULL
|
|
);
|
|
|
|
CREATE OR REPLACE PROCEDURE oidc_code_save(p_hash text, p_client_id text, p_name text, p_redirect_uri text,
|
|
p_scopes text[], p_nonce text, p_code_challenge text,
|
|
p_code_challenge_method text, p_auth_time timestamptz, p_amr text[],
|
|
p_seconds integer)
|
|
LANGUAGE sql AS $$
|
|
DELETE FROM oidc_codes WHERE expires < now();
|
|
INSERT INTO oidc_codes VALUES (p_hash, p_client_id, p_name, p_redirect_uri, p_scopes, p_nonce, p_code_challenge,
|
|
p_code_challenge_method, p_auth_time, p_amr, now() + make_interval(secs => p_seconds));
|
|
$$;
|
|
|
|
-- The unexpired code.
|
|
CREATE OR REPLACE FUNCTION oidc_code_get(p_hash text)
|
|
RETURNS TABLE (client_id text, name text, redirect_uri text, scopes text[], nonce text, code_challenge text,
|
|
code_challenge_method text, auth_time timestamptz, amr text[])
|
|
LANGUAGE sql STABLE AS $$
|
|
SELECT client_id, name, redirect_uri, scopes, nonce, code_challenge, code_challenge_method, auth_time, amr
|
|
FROM oidc_codes WHERE hash = p_hash AND expires > now();
|
|
$$;
|
|
|
|
CREATE OR REPLACE PROCEDURE oidc_code_delete(p_hash text)
|
|
LANGUAGE sql AS $$
|
|
DELETE FROM oidc_codes WHERE hash = p_hash;
|
|
$$;
|
|
|
|
CREATE OR REPLACE PROCEDURE oidc_token_save(p_hash text, p_kind text, p_client_id text, p_name text, p_scopes text[],
|
|
p_auth_time timestamptz, p_amr text[], p_seconds integer)
|
|
LANGUAGE sql AS $$
|
|
DELETE FROM oidc_tokens WHERE expires < now();
|
|
INSERT INTO oidc_tokens VALUES (p_hash, p_kind, p_client_id, p_name, p_scopes, p_auth_time, p_amr,
|
|
now() + make_interval(secs => p_seconds));
|
|
$$;
|
|
|
|
-- The unexpired token of the kind.
|
|
CREATE OR REPLACE FUNCTION oidc_token_get(p_hash text, p_kind text)
|
|
RETURNS TABLE (client_id text, name text, scopes text[], auth_time timestamptz, amr text[])
|
|
LANGUAGE sql STABLE AS $$
|
|
SELECT client_id, name, scopes, auth_time, amr FROM oidc_tokens
|
|
WHERE hash = p_hash AND kind = p_kind AND expires > now();
|
|
$$;
|
|
|
|
CREATE OR REPLACE PROCEDURE oidc_token_delete(p_hash text)
|
|
LANGUAGE sql AS $$
|
|
DELETE FROM oidc_tokens WHERE hash = p_hash;
|
|
$$;
|
|
|
|
CREATE OR REPLACE PROCEDURE oidc_session_save(p_hash text, p_name text, p_amr text[], p_seconds integer)
|
|
LANGUAGE sql AS $$
|
|
DELETE FROM oidc_sessions WHERE expires < now();
|
|
INSERT INTO oidc_sessions VALUES (p_hash, p_name, now(), p_amr, now() + make_interval(secs => p_seconds));
|
|
$$;
|
|
|
|
-- The unexpired session.
|
|
CREATE OR REPLACE FUNCTION oidc_session_get(p_hash text)
|
|
RETURNS TABLE (name text, auth_time timestamptz, amr text[])
|
|
LANGUAGE sql STABLE AS $$
|
|
SELECT name, auth_time, amr FROM oidc_sessions WHERE hash = p_hash AND expires > now();
|
|
$$;
|
|
|
|
CREATE OR REPLACE PROCEDURE oidc_session_delete(p_hash text)
|
|
LANGUAGE sql AS $$
|
|
DELETE FROM oidc_sessions WHERE hash = p_hash;
|
|
$$;
|
|
|
|
-- Remove every code, token and session of the user.
|
|
CREATE OR REPLACE PROCEDURE oidc_revoke(p_name text)
|
|
LANGUAGE sql AS $$
|
|
DELETE FROM oidc_codes WHERE name = p_name;
|
|
DELETE FROM oidc_tokens WHERE name = p_name;
|
|
DELETE FROM oidc_sessions WHERE name = p_name;
|
|
$$;
|