mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
Tomas DvorakandDevin
aab785afc1
Per-node onboarding tokens replace the placeholder <token> in the agent connect command: raw cagt_ tokens are returned once at issuance, only sha256 hashes persist in agent_auth_tokens, and listing exposes metadata only. Public agent routes accept env-configured shared tokens or any active DB-issued token; successful validation stamps last_used_at and revoked tokens are rejected — verified end-to-end against a real stack (register, heartbeat, revoke → 401, bogus → 401). Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
21 lines
791 B
SQL
21 lines
791 B
SQL
-- +goose Up
|
|
-- Per-agent onboarding tokens. Hash (sha256 hex) is stored, never the raw token;
|
|
-- the raw value is shown once at creation time.
|
|
CREATE TABLE IF NOT EXISTS public.agent_auth_tokens (
|
|
id uuid DEFAULT gen_random_uuid() NOT NULL,
|
|
token_hash text NOT NULL,
|
|
label character varying(255) DEFAULT '' NOT NULL,
|
|
created_at timestamp with time zone DEFAULT now(),
|
|
last_used_at timestamp with time zone,
|
|
revoked_at timestamp with time zone,
|
|
CONSTRAINT agent_auth_tokens_pkey PRIMARY KEY (id),
|
|
CONSTRAINT agent_auth_tokens_token_hash_key UNIQUE (token_hash)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_agent_auth_tokens_active
|
|
ON public.agent_auth_tokens (token_hash)
|
|
WHERE revoked_at IS NULL;
|
|
|
|
-- +goose Down
|
|
DROP TABLE IF EXISTS public.agent_auth_tokens;
|