root
32 lines
1.7 KiB
SQL
32 lines
1.7 KiB
SQL
CREATE TYPE "RefreshTokenStatus" AS ENUM ('ACTIVE', 'USED');
|
|
|
|
CREATE TABLE "refresh_tokens" (
|
|
"id" UUID NOT NULL,
|
|
"token_hash" VARCHAR(255) NOT NULL,
|
|
"session_id" UUID NOT NULL,
|
|
"generation" INTEGER NOT NULL,
|
|
"status" "RefreshTokenStatus" NOT NULL DEFAULT 'ACTIVE',
|
|
"used_at" TIMESTAMPTZ(3),
|
|
"replaced_by_hash" VARCHAR(255),
|
|
"created_at" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"expires_at" TIMESTAMPTZ(3) NOT NULL,
|
|
CONSTRAINT "refresh_tokens_pkey" PRIMARY KEY ("id"),
|
|
CONSTRAINT "refresh_tokens_generation_nonnegative" CHECK ("generation" >= 0),
|
|
CONSTRAINT "refresh_tokens_used_state_consistent" CHECK (
|
|
("status" = 'ACTIVE' AND "used_at" IS NULL AND "replaced_by_hash" IS NULL)
|
|
OR ("status" = 'USED' AND "used_at" IS NOT NULL AND "replaced_by_hash" IS NOT NULL)
|
|
)
|
|
);
|
|
|
|
-- Legacy refresh values exposed the session id and cannot be upgraded client-side.
|
|
-- Revoke those families; subsequent logins create opaque token history rows.
|
|
UPDATE "sessions" SET "revoked_at" = COALESCE("revoked_at", CURRENT_TIMESTAMP);
|
|
|
|
CREATE UNIQUE INDEX "refresh_tokens_token_hash_key" ON "refresh_tokens"("token_hash");
|
|
CREATE UNIQUE INDEX "refresh_tokens_replaced_by_hash_key" ON "refresh_tokens"("replaced_by_hash");
|
|
CREATE UNIQUE INDEX "refresh_tokens_session_id_generation_key" ON "refresh_tokens"("session_id", "generation");
|
|
CREATE INDEX "refresh_tokens_session_id_status_idx" ON "refresh_tokens"("session_id", "status");
|
|
CREATE INDEX "refresh_tokens_expires_at_idx" ON "refresh_tokens"("expires_at");
|
|
ALTER TABLE "refresh_tokens" ADD CONSTRAINT "refresh_tokens_session_id_fkey"
|
|
FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|