chore: checkpoint 第一版

2026-09-06 17:04:11 +08:00
parent a8cdec98d1
commit 0c2151ace9
659 changed files with 185855 additions and 554 deletions
@@ -0,0 +1,40 @@
+BEGIN;
+
+CREATE TABLE hardware_agent_provider_credential (
+    id                    uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    public_id             uuid NOT NULL UNIQUE DEFAULT gen_random_uuid(),
+    tenant_id             uuid NOT NULL REFERENCES tenant(id),
+    device_id             uuid NOT NULL,
+    provider              varchar(40) NOT NULL DEFAULT 'volcengine',
+    credential_ref        varchar(500) NOT NULL UNIQUE,
+    instance_id           varchar(200) NOT NULL,
+    product_key           varchar(200) NOT NULL,
+    provider_device_name  varchar(128) NOT NULL,
+    hardware_id           varchar(200) NOT NULL,
+    key_version           bigint NOT NULL DEFAULT 1 CHECK (key_version > 0),
+    encrypted_secret      bytea NOT NULL,
+    nonce                 bytea NOT NULL,
+    status                varchar(24) NOT NULL DEFAULT 'ACTIVE'
+                          CHECK (status IN ('ACTIVE', 'REVOKED')),
+    issued_at             timestamptz NOT NULL DEFAULT now(),
+    rotated_at            timestamptz,
+    revoked_at            timestamptz,
+    created_at            timestamptz NOT NULL DEFAULT now(),
+    updated_at            timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT hardware_agent_provider_credential_device_tenant_fk
+        FOREIGN KEY (device_id, tenant_id) REFERENCES device (id, tenant_id),
+    CONSTRAINT hardware_agent_provider_credential_device_key UNIQUE (device_id),
+    CONSTRAINT hardware_agent_provider_credential_provider_name_key
+        UNIQUE (provider, instance_id, product_key, provider_device_name)
+);
+
+CREATE INDEX hardware_agent_provider_credential_tenant_status_idx
+    ON hardware_agent_provider_credential (tenant_id, status, updated_at DESC);
+
+COMMENT ON TABLE hardware_agent_provider_credential IS
+    'Platform-managed per-device provider credentials. Product secrets remain outside the database; device secrets are AEAD-encrypted with a dedicated platform master key.';
+
+COMMENT ON COLUMN hardware_agent_provider_credential.encrypted_secret IS
+    'Volcengine device_secret encrypted with VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY; never returned in logs or audit detail.';
+
+COMMIT;