22 lines
1006 B
SQL
22 lines
1006 B
SQL
-- 006_pair_tokens.sql — pairing tokens for agent mTLS onboarding.
|
|
--
|
|
-- An operator generates a token, hands it to a new agent, the agent uses
|
|
-- it exactly once to fetch a signed client cert. Tokens expire fast
|
|
-- (default 15 min) to limit damage from leaked tokens. token_hash is
|
|
-- sha256 of the raw token — we never store the raw value.
|
|
|
|
CREATE TABLE pair_tokens (
|
|
id TEXT PRIMARY KEY, -- pt_<hex16>
|
|
token_hash TEXT NOT NULL UNIQUE, -- sha256 hex of the raw token
|
|
description TEXT NOT NULL DEFAULT '',
|
|
created_by BIGINT NOT NULL REFERENCES users(id) ON DELETE SET NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
expires_at TIMESTAMPTZ NOT NULL,
|
|
used_at TIMESTAMPTZ,
|
|
used_by_agent TEXT, -- agent_id that consumed it
|
|
issued_cert_fingerprint TEXT
|
|
);
|
|
|
|
CREATE INDEX idx_pair_tokens_hash ON pair_tokens(token_hash);
|
|
CREATE INDEX idx_pair_tokens_expires ON pair_tokens(expires_at);
|