mahmoodandCursor
15adbb7fe1
Nginx 502 Host-not-found meant the API never stayed listening. Stamp all migrations when tracking is empty but a late table exists, apply DDL statement-by-statement skipping already-exists, harden remaining CREATE TYPE/TABLE files, and never let seed crash the process. Co-authored-by: Cursor <cursoragent@cursor.com>
43 lines
1.8 KiB
SQL
43 lines
1.8 KiB
SQL
-- Revocable admin sessions.
|
|
--
|
|
-- Until now an admin-panel token was purely self-contained: once signed it was
|
|
-- valid for its full 12h and nothing could cut it short — not deactivating the
|
|
-- account, not a central "sign out everywhere". Connecting the central IAM made
|
|
-- that gap concrete, because an IAM session revocation had no effect on a token
|
|
-- this API had already issued.
|
|
--
|
|
-- Each issued token now carries a `jti` recorded here, and JwtStrategy rejects a
|
|
-- token whose row is revoked. Rows are only written (and only enforced) while
|
|
-- session tracking is enabled, so a deployment that leaves it off keeps exactly
|
|
-- the previous behaviour and the previous query count.
|
|
CREATE TABLE IF NOT EXISTS "AdminSession" (
|
|
"id" TEXT NOT NULL,
|
|
"jti" TEXT NOT NULL,
|
|
"adminUserId" TEXT NOT NULL,
|
|
"iamSessionId" TEXT,
|
|
"iamSub" TEXT,
|
|
"ipAddress" TEXT,
|
|
"userAgent" TEXT,
|
|
"createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"expiresAt" TIMESTAMP(3),
|
|
"lastSeenAt" TIMESTAMP(3),
|
|
"revokedAt" TIMESTAMP(3),
|
|
"revokedReason" TEXT,
|
|
|
|
CONSTRAINT "AdminSession_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS "AdminSession_jti_key" ON "AdminSession"("jti");
|
|
CREATE INDEX IF NOT EXISTS "AdminSession_adminUserId_idx" ON "AdminSession"("adminUserId");
|
|
CREATE INDEX IF NOT EXISTS "AdminSession_iamSessionId_idx" ON "AdminSession"("iamSessionId");
|
|
CREATE INDEX IF NOT EXISTS "AdminSession_iamSub_idx" ON "AdminSession"("iamSub");
|
|
CREATE INDEX IF NOT EXISTS "AdminSession_expiresAt_idx" ON "AdminSession"("expiresAt");
|
|
|
|
DO $$ BEGIN
|
|
ALTER TABLE "AdminSession"
|
|
ADD CONSTRAINT "AdminSession_adminUserId_fkey"
|
|
FOREIGN KEY ("adminUserId") REFERENCES "AdminUser"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
EXCEPTION
|
|
WHEN duplicate_object THEN NULL;
|
|
END $$;
|