41 lines
2.1 KiB
PL/PgSQL
41 lines
2.1 KiB
PL/PgSQL
BEGIN;
|
|
|
|
CREATE TABLE hardware_agent_provider_credential (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
public_id uuid NOT NULL UNIQUE DEFAULT gen_random_uuid(),
|
|
tenant_id uuid NOT NULL REFERENCES tenant(id),
|
|
device_id uuid NOT NULL,
|
|
provider varchar(40) NOT NULL DEFAULT 'volcengine',
|
|
credential_ref varchar(500) NOT NULL UNIQUE,
|
|
instance_id varchar(200) NOT NULL,
|
|
product_key varchar(200) NOT NULL,
|
|
provider_device_name varchar(128) NOT NULL,
|
|
hardware_id varchar(200) NOT NULL,
|
|
key_version bigint NOT NULL DEFAULT 1 CHECK (key_version > 0),
|
|
encrypted_secret bytea NOT NULL,
|
|
nonce bytea NOT NULL,
|
|
status varchar(24) NOT NULL DEFAULT 'ACTIVE'
|
|
CHECK (status IN ('ACTIVE', 'REVOKED')),
|
|
issued_at timestamptz NOT NULL DEFAULT now(),
|
|
rotated_at timestamptz,
|
|
revoked_at timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
CONSTRAINT hardware_agent_provider_credential_device_tenant_fk
|
|
FOREIGN KEY (device_id, tenant_id) REFERENCES device (id, tenant_id),
|
|
CONSTRAINT hardware_agent_provider_credential_device_key UNIQUE (device_id),
|
|
CONSTRAINT hardware_agent_provider_credential_provider_name_key
|
|
UNIQUE (provider, instance_id, product_key, provider_device_name)
|
|
);
|
|
|
|
CREATE INDEX hardware_agent_provider_credential_tenant_status_idx
|
|
ON hardware_agent_provider_credential (tenant_id, status, updated_at DESC);
|
|
|
|
COMMENT ON TABLE hardware_agent_provider_credential IS
|
|
'Platform-managed per-device provider credentials. Product secrets remain outside the database; device secrets are AEAD-encrypted with a dedicated platform master key.';
|
|
|
|
COMMENT ON COLUMN hardware_agent_provider_credential.encrypted_secret IS
|
|
'Volcengine device_secret encrypted with VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY; never returned in logs or audit detail.';
|
|
|
|
COMMIT;
|