Reworked encryption to use less heap allocated buffers for secrets.
Also some work on plugin system.
This commit is contained in:
eelke
parent
8782ef39c6
commit
054754f553
42 changed files with 1452 additions and 242 deletions
171
IdentityShroud.Migrations/Migrations/20260412083710_Initial.cs
Normal file
171
IdentityShroud.Migrations/Migrations/20260412083710_Initial.cs
Normal file
|
|
@ -0,0 +1,171 @@
|
|||
using System;
|
||||
using Microsoft.EntityFrameworkCore.Migrations;
|
||||
using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
|
||||
|
||||
#nullable disable
|
||||
|
||||
namespace IdentityShroud.Migrations.Migrations
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public partial class Initial : Migration
|
||||
{
|
||||
/// <inheritdoc />
|
||||
protected override void Up(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.CreateTable(
|
||||
name: "realm",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
slug = table.Column<string>(type: "character varying(40)", maxLength: 40, nullable: false),
|
||||
name = table.Column<string>(type: "character varying(128)", maxLength: 128, nullable: false),
|
||||
default_signature_algorithm = table.Column<string>(type: "text", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_realm", x => x.id);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "client",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<int>(type: "integer", nullable: false)
|
||||
.Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
|
||||
realm_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
client_id = table.Column<string>(type: "character varying(40)", maxLength: 40, nullable: false),
|
||||
name = table.Column<string>(type: "character varying(80)", maxLength: 80, nullable: true),
|
||||
description = table.Column<string>(type: "character varying(2048)", maxLength: 2048, nullable: true),
|
||||
signature_algorithm = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: true),
|
||||
confidential = table.Column<bool>(type: "boolean", nullable: false),
|
||||
allow_client_credentials_flow = table.Column<bool>(type: "boolean", nullable: false),
|
||||
created_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_client", x => x.id);
|
||||
table.ForeignKey(
|
||||
name: "fk_client_realm_realm_id",
|
||||
column: x => x.realm_id,
|
||||
principalTable: "realm",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "realm_dek",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
active = table.Column<bool>(type: "boolean", nullable: false),
|
||||
algorithm = table.Column<string>(type: "text", nullable: false),
|
||||
realm_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
key_data_kek_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
key_data_value = table.Column<byte[]>(type: "bytea", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_realm_dek", x => x.id);
|
||||
table.ForeignKey(
|
||||
name: "fk_realm_dek_realm_realm_id",
|
||||
column: x => x.realm_id,
|
||||
principalTable: "realm",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "realm_key",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
key_type = table.Column<string>(type: "text", nullable: false),
|
||||
created_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
|
||||
revoked_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
|
||||
priority = table.Column<int>(type: "integer", nullable: false),
|
||||
public_key_parameters = table.Column<string>(type: "jsonb", nullable: true),
|
||||
realm_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
key_kek_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
key_value = table.Column<byte[]>(type: "bytea", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_realm_key", x => x.id);
|
||||
table.ForeignKey(
|
||||
name: "fk_realm_key_realm_realm_id",
|
||||
column: x => x.realm_id,
|
||||
principalTable: "realm",
|
||||
principalColumn: "id");
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "client_secret",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<int>(type: "integer", nullable: false)
|
||||
.Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
|
||||
client_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
created_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
|
||||
expires = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
|
||||
revoked_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
|
||||
client_id1 = table.Column<int>(type: "integer", nullable: true),
|
||||
secret_dek_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
secret_value = table.Column<byte[]>(type: "bytea", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_client_secret", x => x.id);
|
||||
table.ForeignKey(
|
||||
name: "fk_client_secret_client_client_id1",
|
||||
column: x => x.client_id1,
|
||||
principalTable: "client",
|
||||
principalColumn: "id");
|
||||
});
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_client_client_id",
|
||||
table: "client",
|
||||
column: "client_id",
|
||||
unique: true);
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_client_realm_id",
|
||||
table: "client",
|
||||
column: "realm_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_client_secret_client_id1",
|
||||
table: "client_secret",
|
||||
column: "client_id1");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_realm_dek_realm_id",
|
||||
table: "realm_dek",
|
||||
column: "realm_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_realm_key_realm_id",
|
||||
table: "realm_key",
|
||||
column: "realm_id");
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void Down(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.DropTable(
|
||||
name: "client_secret");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "realm_dek");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "realm_key");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "client");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "realm");
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue