mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
Tomas DvorakandDevin
aab785afc1
Per-node onboarding tokens replace the placeholder <token> in the agent connect command: raw cagt_ tokens are returned once at issuance, only sha256 hashes persist in agent_auth_tokens, and listing exposes metadata only. Public agent routes accept env-configured shared tokens or any active DB-issued token; successful validation stamps last_used_at and revoked tokens are rejected — verified end-to-end against a real stack (register, heartbeat, revoke → 401, bogus → 401). Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
123 lines
3.0 KiB
Go
123 lines
3.0 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.31.1
|
|
// source: agent_tokens.sql
|
|
|
|
package sqlcdb
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
const createAgentAuthToken = `-- name: CreateAgentAuthToken :one
|
|
INSERT INTO agent_auth_tokens (token_hash, label)
|
|
VALUES ($1, $2)
|
|
RETURNING id, token_hash, label, created_at, last_used_at, revoked_at
|
|
`
|
|
|
|
type CreateAgentAuthTokenParams struct {
|
|
TokenHash string `json:"token_hash"`
|
|
Label string `json:"label"`
|
|
}
|
|
|
|
func (q *Queries) CreateAgentAuthToken(ctx context.Context, arg CreateAgentAuthTokenParams) (AgentAuthToken, error) {
|
|
row := q.db.QueryRowContext(ctx, createAgentAuthToken, arg.TokenHash, arg.Label)
|
|
var i AgentAuthToken
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.TokenHash,
|
|
&i.Label,
|
|
&i.CreatedAt,
|
|
&i.LastUsedAt,
|
|
&i.RevokedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const getActiveAgentAuthTokenByHash = `-- name: GetActiveAgentAuthTokenByHash :one
|
|
SELECT id, token_hash, label, created_at, last_used_at, revoked_at FROM agent_auth_tokens
|
|
WHERE token_hash = $1 AND revoked_at IS NULL
|
|
LIMIT 1
|
|
`
|
|
|
|
func (q *Queries) GetActiveAgentAuthTokenByHash(ctx context.Context, tokenHash string) (AgentAuthToken, error) {
|
|
row := q.db.QueryRowContext(ctx, getActiveAgentAuthTokenByHash, tokenHash)
|
|
var i AgentAuthToken
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.TokenHash,
|
|
&i.Label,
|
|
&i.CreatedAt,
|
|
&i.LastUsedAt,
|
|
&i.RevokedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const listAgentAuthTokens = `-- name: ListAgentAuthTokens :many
|
|
SELECT id, token_hash, label, created_at, last_used_at, revoked_at FROM agent_auth_tokens
|
|
ORDER BY created_at DESC
|
|
`
|
|
|
|
func (q *Queries) ListAgentAuthTokens(ctx context.Context) ([]AgentAuthToken, error) {
|
|
rows, err := q.db.QueryContext(ctx, listAgentAuthTokens)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
items := []AgentAuthToken{}
|
|
for rows.Next() {
|
|
var i AgentAuthToken
|
|
if err := rows.Scan(
|
|
&i.ID,
|
|
&i.TokenHash,
|
|
&i.Label,
|
|
&i.CreatedAt,
|
|
&i.LastUsedAt,
|
|
&i.RevokedAt,
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
items = append(items, i)
|
|
}
|
|
if err := rows.Close(); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return items, nil
|
|
}
|
|
|
|
const revokeAgentAuthToken = `-- name: RevokeAgentAuthToken :one
|
|
UPDATE agent_auth_tokens SET revoked_at = NOW()
|
|
WHERE id = $1 AND revoked_at IS NULL
|
|
RETURNING id, token_hash, label, created_at, last_used_at, revoked_at
|
|
`
|
|
|
|
func (q *Queries) RevokeAgentAuthToken(ctx context.Context, id uuid.UUID) (AgentAuthToken, error) {
|
|
row := q.db.QueryRowContext(ctx, revokeAgentAuthToken, id)
|
|
var i AgentAuthToken
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.TokenHash,
|
|
&i.Label,
|
|
&i.CreatedAt,
|
|
&i.LastUsedAt,
|
|
&i.RevokedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const touchAgentAuthToken = `-- name: TouchAgentAuthToken :exec
|
|
UPDATE agent_auth_tokens SET last_used_at = NOW()
|
|
WHERE token_hash = $1 AND revoked_at IS NULL
|
|
`
|
|
|
|
func (q *Queries) TouchAgentAuthToken(ctx context.Context, tokenHash string) error {
|
|
_, err := q.db.ExecContext(ctx, touchAgentAuthToken, tokenHash)
|
|
return err
|
|
}
|