30 lines
1.2 KiB
PL/PgSQL
30 lines
1.2 KiB
PL/PgSQL
|
BEGIN;
|
||
|
|
|
||
|
|
CREATE TABLE device_credential (
|
||
|
|
device_id uuid PRIMARY KEY,
|
||
|
|
tenant_id uuid NOT NULL,
|
||
|
|
credential_ref varchar(500) NOT NULL UNIQUE,
|
||
|
|
key_version bigint NOT NULL DEFAULT 1 CHECK (key_version > 0),
|
||
|
|
algorithm varchar(32) NOT NULL DEFAULT 'HMAC-SHA256'
|
||
|
|
CHECK (algorithm = 'HMAC-SHA256'),
|
||
|
|
encryption varchar(32) NOT NULL DEFAULT 'AES-256-GCM'
|
||
|
|
CHECK (encryption = 'AES-256-GCM'),
|
||
|
|
encrypted_secret bytea NOT NULL,
|
||
|
|
nonce bytea NOT NULL CHECK (octet_length(nonce) = 12),
|
||
|
|
status varchar(24) NOT NULL DEFAULT 'active'
|
||
|
|
CHECK (status IN ('active', 'revoked')),
|
||
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
||
|
|
rotated_at timestamptz,
|
||
|
|
revoked_at timestamptz,
|
||
|
|
CONSTRAINT device_credential_device_tenant_fk
|
||
|
|
FOREIGN KEY (device_id, tenant_id) REFERENCES device(id, tenant_id)
|
||
|
|
);
|
||
|
|
|
||
|
|
CREATE INDEX device_credential_tenant_status_idx
|
||
|
|
ON device_credential (tenant_id, status);
|
||
|
|
|
||
|
|
COMMENT ON TABLE device_credential IS
|
||
|
|
'Recoverable device HMAC credentials encrypted with the API credential master key; plaintext is never stored.';
|
||
|
|
|
||
|
|
COMMIT;
|