ekklesiaandClaude Opus 5
80189c8ae2
ADR 0033 gave Ekklesia a display host and ADR 0034 gave it a login page. Together, the only way to light a television in a foyer was to sign a human being into it and leave that session running on a screen anyone can walk up to: a person's credentials on a wall, a person's session as the thing signage depends on, and the display going dark when they are revoked or their session simply expires. A screen is not a person. Ekklesia now recognizes three principal classes — anonymous, authenticated human, and managed device — and a device is a first-class principal with its own credential and its own explicit permissions. It has no email, no password, and no row in the identity tables, and it satisfies the `authenticated` baseline never, so every route that settles for "somebody is signed in" stays closed to it. Device permissions live in their own table because ekklesia_core_grant.user_id is a non-null foreign key into the user table and making it polymorphic would rewrite the platform's central authorization record to serve one narrow case. That is a schema decision, not a second decision point: the evaluator gained one branch, so a device is allowed or denied by the same function, with the same deny-by-default, as anyone else — with no owner path it could reach and no baseline that stands in for a grant. The six-digit code is not the credential. It is printed across a screen in a public hallway, so it is treated as public: it identifies a request to an administrator and is worth nothing alone. Collecting the credential also requires a 256-bit claim secret held only in the requesting browser's HttpOnly cookie, and approving requires the restricted core.devices.manage permission. Without that split, reading a code off a wall would hand over the screen's identity. The permission a pairing asks for is read from the module's validated display declaration, never from the request, so a browser cannot ask to be granted core.devices.manage or another module's permission. Approval grants exactly that one permission. Credentials are stored only as SHA-256; the raw value exists in the Set-Cookie that issues it and the device's own cookie jar, and is never logged, returned in JSON, or placed in a URL. The cookie is HttpOnly, so the module display code running in that same page cannot read it. Revocation is a server-side column checked on every principal resolution, and re-pairing mints a new identity so an old credential can never come back. State transitions are conditional updates, so one code cannot be approved twice or claimed into two credentials under a race. /api/v1/principal still reports a device as anonymous: it is what the Dashboard uses to decide whether a person is signed in. Displays read their viewer from the descriptor instead, which already performed the authorization — so displays are descriptor-first while the Dashboard stays principal-first, and neither infers an identity by elimination. Proven end to end against real PostgreSQL and real HTTP: an unpaired screen shows a code, an owner approves it, the device opens the display descriptor and a realtime stream, and revocation closes both while the device still holds its cookie. An already-open SSE stream is bounded by realtime's existing five-minute reconnect rather than closed instantly, and that bound is documented rather than called immediate. Co-Authored-By: Claude Opus 5 <[email protected]>
1371 lines
40 KiB
JSON
1371 lines
40 KiB
JSON
{
|
|
"id": "2b1ddb4b-3185-417b-9920-100e35fedb36",
|
|
"prevId": "d41e490c-dbe1-4d73-9e11-6e79baa91908",
|
|
"version": "7",
|
|
"dialect": "postgresql",
|
|
"tables": {
|
|
"public.ekklesia_core_account": {
|
|
"name": "ekklesia_core_account",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"account_id": {
|
|
"name": "account_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"provider_id": {
|
|
"name": "provider_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"access_token": {
|
|
"name": "access_token",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"refresh_token": {
|
|
"name": "refresh_token",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"id_token": {
|
|
"name": "id_token",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"access_token_expires_at": {
|
|
"name": "access_token_expires_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"refresh_token_expires_at": {
|
|
"name": "refresh_token_expires_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"scope": {
|
|
"name": "scope",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"password": {
|
|
"name": "password",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_account_user_id_idx": {
|
|
"name": "ekklesia_core_account_user_id_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "user_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"ekklesia_core_account_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_account_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_account",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_session": {
|
|
"name": "ekklesia_core_session",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"expires_at": {
|
|
"name": "expires_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"token": {
|
|
"name": "token",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"ip_address": {
|
|
"name": "ip_address",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"user_agent": {
|
|
"name": "user_agent",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_session_user_id_idx": {
|
|
"name": "ekklesia_core_session_user_id_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "user_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"ekklesia_core_session_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_session_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_session",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {
|
|
"ekklesia_core_session_token_unique": {
|
|
"name": "ekklesia_core_session_token_unique",
|
|
"nullsNotDistinct": false,
|
|
"columns": ["token"]
|
|
}
|
|
},
|
|
"policies": {},
|
|
"checkConstraints": {},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_user": {
|
|
"name": "ekklesia_core_user",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"name": {
|
|
"name": "name",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"email": {
|
|
"name": "email",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"email_verified": {
|
|
"name": "email_verified",
|
|
"type": "boolean",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": false
|
|
},
|
|
"image": {
|
|
"name": "image",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
}
|
|
},
|
|
"indexes": {},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {
|
|
"ekklesia_core_user_email_unique": {
|
|
"name": "ekklesia_core_user_email_unique",
|
|
"nullsNotDistinct": false,
|
|
"columns": ["email"]
|
|
}
|
|
},
|
|
"policies": {},
|
|
"checkConstraints": {},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_verification": {
|
|
"name": "ekklesia_core_verification",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"identifier": {
|
|
"name": "identifier",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"value": {
|
|
"name": "value",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"expires_at": {
|
|
"name": "expires_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_verification_identifier_idx": {
|
|
"name": "ekklesia_core_verification_identifier_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "identifier",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_authorization_audit": {
|
|
"name": "ekklesia_core_authorization_audit",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "uuid",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"default": "gen_random_uuid()"
|
|
},
|
|
"action": {
|
|
"name": "action",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"actor_type": {
|
|
"name": "actor_type",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"actor_id": {
|
|
"name": "actor_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"subject_user_id": {
|
|
"name": "subject_user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"permission_id": {
|
|
"name": "permission_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"scope": {
|
|
"name": "scope",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"grant_id": {
|
|
"name": "grant_id",
|
|
"type": "uuid",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_authorization_audit_subject_idx": {
|
|
"name": "ekklesia_core_authorization_audit_subject_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "subject_user_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_authorization_audit_action_check": {
|
|
"name": "ekklesia_core_authorization_audit_action_check",
|
|
"value": "\"ekklesia_core_authorization_audit\".\"action\" in ('grant.create', 'grant.revoke', 'platform_owner.grant', 'platform_owner.revoke')"
|
|
},
|
|
"ekklesia_core_authorization_audit_actor_type_check": {
|
|
"name": "ekklesia_core_authorization_audit_actor_type_check",
|
|
"value": "\"ekklesia_core_authorization_audit\".\"actor_type\" in ('user', 'system')"
|
|
},
|
|
"ekklesia_core_authorization_audit_scope_check": {
|
|
"name": "ekklesia_core_authorization_audit_scope_check",
|
|
"value": "\"ekklesia_core_authorization_audit\".\"scope\" is null or length(\"ekklesia_core_authorization_audit\".\"scope\") > 0"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_grant": {
|
|
"name": "ekklesia_core_grant",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "uuid",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"default": "gen_random_uuid()"
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"permission_id": {
|
|
"name": "permission_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"scope": {
|
|
"name": "scope",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"source_kind": {
|
|
"name": "source_kind",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"source_ref": {
|
|
"name": "source_ref",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"created_by_actor_type": {
|
|
"name": "created_by_actor_type",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"created_by_actor_id": {
|
|
"name": "created_by_actor_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"expires_at": {
|
|
"name": "expires_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_at": {
|
|
"name": "revoked_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_by_actor_type": {
|
|
"name": "revoked_by_actor_type",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_by_actor_id": {
|
|
"name": "revoked_by_actor_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_grant_user_permission_idx": {
|
|
"name": "ekklesia_core_grant_user_permission_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "user_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
},
|
|
{
|
|
"expression": "permission_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"ekklesia_core_grant_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_grant_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_grant",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_grant_source_kind_check": {
|
|
"name": "ekklesia_core_grant_source_kind_check",
|
|
"value": "\"ekklesia_core_grant\".\"source_kind\" in ('explicit', 'relationship')"
|
|
},
|
|
"ekklesia_core_grant_created_actor_type_check": {
|
|
"name": "ekklesia_core_grant_created_actor_type_check",
|
|
"value": "\"ekklesia_core_grant\".\"created_by_actor_type\" in ('user', 'system')"
|
|
},
|
|
"ekklesia_core_grant_revoked_actor_type_check": {
|
|
"name": "ekklesia_core_grant_revoked_actor_type_check",
|
|
"value": "\"ekklesia_core_grant\".\"revoked_by_actor_type\" is null or \"ekklesia_core_grant\".\"revoked_by_actor_type\" in ('user', 'system')"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_platform_owner": {
|
|
"name": "ekklesia_core_platform_owner",
|
|
"schema": "",
|
|
"columns": {
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"granted_at": {
|
|
"name": "granted_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"granted_by_actor_type": {
|
|
"name": "granted_by_actor_type",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"granted_by_actor_id": {
|
|
"name": "granted_by_actor_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_at": {
|
|
"name": "revoked_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_by_actor_type": {
|
|
"name": "revoked_by_actor_type",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_by_actor_id": {
|
|
"name": "revoked_by_actor_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
}
|
|
},
|
|
"indexes": {},
|
|
"foreignKeys": {
|
|
"ekklesia_core_platform_owner_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_platform_owner_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_platform_owner",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_platform_owner_granted_actor_type_check": {
|
|
"name": "ekklesia_core_platform_owner_granted_actor_type_check",
|
|
"value": "\"ekklesia_core_platform_owner\".\"granted_by_actor_type\" in ('user', 'system')"
|
|
},
|
|
"ekklesia_core_platform_owner_revoked_actor_type_check": {
|
|
"name": "ekklesia_core_platform_owner_revoked_actor_type_check",
|
|
"value": "\"ekklesia_core_platform_owner\".\"revoked_by_actor_type\" is null or \"ekklesia_core_platform_owner\".\"revoked_by_actor_type\" in ('user', 'system')"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_platform_owner_bootstrap": {
|
|
"name": "ekklesia_core_platform_owner_bootstrap",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"consumed_at": {
|
|
"name": "consumed_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"consumed_for_user_id": {
|
|
"name": "consumed_for_user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
}
|
|
},
|
|
"indexes": {},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_platform_owner_bootstrap_singleton_check": {
|
|
"name": "ekklesia_core_platform_owner_bootstrap_singleton_check",
|
|
"value": "\"ekklesia_core_platform_owner_bootstrap\".\"id\" = 'singleton'"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_dashboard_group": {
|
|
"name": "ekklesia_core_dashboard_group",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"label": {
|
|
"name": "label",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"sort_order": {
|
|
"name": "sort_order",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": 0
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_dashboard_group_order_idx": {
|
|
"name": "ekklesia_core_dashboard_group_order_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "sort_order",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
},
|
|
{
|
|
"expression": "id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_dashboard_group_id_check": {
|
|
"name": "ekklesia_core_dashboard_group_id_check",
|
|
"value": "length(\"ekklesia_core_dashboard_group\".\"id\") > 0"
|
|
},
|
|
"ekklesia_core_dashboard_group_label_check": {
|
|
"name": "ekklesia_core_dashboard_group_label_check",
|
|
"value": "length(btrim(\"ekklesia_core_dashboard_group\".\"label\")) > 0"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_dashboard_placement": {
|
|
"name": "ekklesia_core_dashboard_placement",
|
|
"schema": "",
|
|
"columns": {
|
|
"module_id": {
|
|
"name": "module_id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"group_id": {
|
|
"name": "group_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"sort_order": {
|
|
"name": "sort_order",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": 0
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_dashboard_placement_group_idx": {
|
|
"name": "ekklesia_core_dashboard_placement_group_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "group_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
},
|
|
{
|
|
"expression": "sort_order",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"ekklesia_core_dashboard_placement_group_id_ekklesia_core_dashboard_group_id_fk": {
|
|
"name": "ekklesia_core_dashboard_placement_group_id_ekklesia_core_dashboard_group_id_fk",
|
|
"tableFrom": "ekklesia_core_dashboard_placement",
|
|
"tableTo": "ekklesia_core_dashboard_group",
|
|
"columnsFrom": ["group_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "set null",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_dashboard_placement_module_check": {
|
|
"name": "ekklesia_core_dashboard_placement_module_check",
|
|
"value": "length(\"ekklesia_core_dashboard_placement\".\"module_id\") > 0"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_module_state": {
|
|
"name": "ekklesia_core_module_state",
|
|
"schema": "",
|
|
"columns": {
|
|
"module_id": {
|
|
"name": "module_id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true
|
|
},
|
|
"enabled": {
|
|
"name": "enabled",
|
|
"type": "boolean",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
}
|
|
},
|
|
"indexes": {},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_module_state_module_check": {
|
|
"name": "ekklesia_core_module_state_module_check",
|
|
"value": "length(\"ekklesia_core_module_state\".\"module_id\") > 0"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_module_configuration": {
|
|
"name": "ekklesia_core_module_configuration",
|
|
"schema": "",
|
|
"columns": {
|
|
"module_id": {
|
|
"name": "module_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"key": {
|
|
"name": "key",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"value": {
|
|
"name": "value",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_module_configuration_module_idx": {
|
|
"name": "ekklesia_core_module_configuration_module_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "module_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {
|
|
"ekklesia_core_module_configuration_module_id_key_pk": {
|
|
"name": "ekklesia_core_module_configuration_module_id_key_pk",
|
|
"columns": ["module_id", "key"]
|
|
}
|
|
},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_module_configuration_module_check": {
|
|
"name": "ekklesia_core_module_configuration_module_check",
|
|
"value": "length(\"ekklesia_core_module_configuration\".\"module_id\") > 0"
|
|
},
|
|
"ekklesia_core_module_configuration_key_check": {
|
|
"name": "ekklesia_core_module_configuration_key_check",
|
|
"value": "length(\"ekklesia_core_module_configuration\".\"key\") > 0"
|
|
},
|
|
"ekklesia_core_module_configuration_value_check": {
|
|
"name": "ekklesia_core_module_configuration_value_check",
|
|
"value": "length(\"ekklesia_core_module_configuration\".\"value\") <= 2048"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_device": {
|
|
"name": "ekklesia_core_device",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "uuid",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"default": "gen_random_uuid()"
|
|
},
|
|
"name": {
|
|
"name": "name",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"credential_hash": {
|
|
"name": "credential_hash",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"created_by_user_id": {
|
|
"name": "created_by_user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"last_seen_at": {
|
|
"name": "last_seen_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_at": {
|
|
"name": "revoked_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_by_user_id": {
|
|
"name": "revoked_by_user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_device_credential_hash_idx": {
|
|
"name": "ekklesia_core_device_credential_hash_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "credential_hash",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": true,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
},
|
|
"ekklesia_core_device_revoked_idx": {
|
|
"name": "ekklesia_core_device_revoked_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "revoked_at",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"ekklesia_core_device_created_by_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_device_created_by_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_device",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["created_by_user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "set null",
|
|
"onUpdate": "no action"
|
|
},
|
|
"ekklesia_core_device_revoked_by_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_device_revoked_by_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_device",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["revoked_by_user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "set null",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_device_name_check": {
|
|
"name": "ekklesia_core_device_name_check",
|
|
"value": "length(\"ekklesia_core_device\".\"name\") between 1 and 128"
|
|
},
|
|
"ekklesia_core_device_credential_hash_check": {
|
|
"name": "ekklesia_core_device_credential_hash_check",
|
|
"value": "length(\"ekklesia_core_device\".\"credential_hash\") = 64"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_device_pairing_request": {
|
|
"name": "ekklesia_core_device_pairing_request",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "uuid",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"default": "gen_random_uuid()"
|
|
},
|
|
"code": {
|
|
"name": "code",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"claim_secret_hash": {
|
|
"name": "claim_secret_hash",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"module_id": {
|
|
"name": "module_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"permission_id": {
|
|
"name": "permission_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"state": {
|
|
"name": "state",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "'pending'"
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"expires_at": {
|
|
"name": "expires_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"device_name": {
|
|
"name": "device_name",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"approved_at": {
|
|
"name": "approved_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"approved_by_user_id": {
|
|
"name": "approved_by_user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"consumed_at": {
|
|
"name": "consumed_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"device_id": {
|
|
"name": "device_id",
|
|
"type": "uuid",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_device_pairing_code_idx": {
|
|
"name": "ekklesia_core_device_pairing_code_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "code",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": true,
|
|
"where": "\"ekklesia_core_device_pairing_request\".\"state\" <> 'consumed'",
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
},
|
|
"ekklesia_core_device_pairing_claim_idx": {
|
|
"name": "ekklesia_core_device_pairing_claim_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "claim_secret_hash",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"ekklesia_core_device_pairing_request_approved_by_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_device_pairing_request_approved_by_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_device_pairing_request",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["approved_by_user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "set null",
|
|
"onUpdate": "no action"
|
|
},
|
|
"ekklesia_core_device_pairing_request_device_id_ekklesia_core_device_id_fk": {
|
|
"name": "ekklesia_core_device_pairing_request_device_id_ekklesia_core_device_id_fk",
|
|
"tableFrom": "ekklesia_core_device_pairing_request",
|
|
"tableTo": "ekklesia_core_device",
|
|
"columnsFrom": ["device_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "set null",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_device_pairing_code_check": {
|
|
"name": "ekklesia_core_device_pairing_code_check",
|
|
"value": "\"ekklesia_core_device_pairing_request\".\"code\" ~ '^[0-9]{6}$'"
|
|
},
|
|
"ekklesia_core_device_pairing_claim_hash_check": {
|
|
"name": "ekklesia_core_device_pairing_claim_hash_check",
|
|
"value": "length(\"ekklesia_core_device_pairing_request\".\"claim_secret_hash\") = 64"
|
|
},
|
|
"ekklesia_core_device_pairing_state_check": {
|
|
"name": "ekklesia_core_device_pairing_state_check",
|
|
"value": "\"ekklesia_core_device_pairing_request\".\"state\" in ('pending', 'approved', 'consumed')"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
},
|
|
"public.ekklesia_core_device_permission": {
|
|
"name": "ekklesia_core_device_permission",
|
|
"schema": "",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "uuid",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"default": "gen_random_uuid()"
|
|
},
|
|
"device_id": {
|
|
"name": "device_id",
|
|
"type": "uuid",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"permission_id": {
|
|
"name": "permission_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true
|
|
},
|
|
"granted_at": {
|
|
"name": "granted_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"default": "now()"
|
|
},
|
|
"granted_by_user_id": {
|
|
"name": "granted_by_user_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
},
|
|
"revoked_at": {
|
|
"name": "revoked_at",
|
|
"type": "timestamp with time zone",
|
|
"primaryKey": false,
|
|
"notNull": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"ekklesia_core_device_permission_lookup_idx": {
|
|
"name": "ekklesia_core_device_permission_lookup_idx",
|
|
"columns": [
|
|
{
|
|
"expression": "device_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
},
|
|
{
|
|
"expression": "permission_id",
|
|
"isExpression": false,
|
|
"asc": true,
|
|
"nulls": "last"
|
|
}
|
|
],
|
|
"isUnique": false,
|
|
"concurrently": false,
|
|
"method": "btree",
|
|
"with": {}
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"ekklesia_core_device_permission_device_id_ekklesia_core_device_id_fk": {
|
|
"name": "ekklesia_core_device_permission_device_id_ekklesia_core_device_id_fk",
|
|
"tableFrom": "ekklesia_core_device_permission",
|
|
"tableTo": "ekklesia_core_device",
|
|
"columnsFrom": ["device_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
},
|
|
"ekklesia_core_device_permission_granted_by_user_id_ekklesia_core_user_id_fk": {
|
|
"name": "ekklesia_core_device_permission_granted_by_user_id_ekklesia_core_user_id_fk",
|
|
"tableFrom": "ekklesia_core_device_permission",
|
|
"tableTo": "ekklesia_core_user",
|
|
"columnsFrom": ["granted_by_user_id"],
|
|
"columnsTo": ["id"],
|
|
"onDelete": "set null",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"policies": {},
|
|
"checkConstraints": {
|
|
"ekklesia_core_device_permission_id_check": {
|
|
"name": "ekklesia_core_device_permission_id_check",
|
|
"value": "length(\"ekklesia_core_device_permission\".\"permission_id\") between 1 and 128"
|
|
}
|
|
},
|
|
"isRLSEnabled": false
|
|
}
|
|
},
|
|
"enums": {},
|
|
"schemas": {},
|
|
"sequences": {},
|
|
"roles": {},
|
|
"policies": {},
|
|
"views": {},
|
|
"_meta": {
|
|
"columns": {},
|
|
"schemas": {},
|
|
"tables": {}
|
|
}
|
|
}
|