mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
Tomas DvorakandDevin
aab785afc1
Per-node onboarding tokens replace the placeholder <token> in the agent connect command: raw cagt_ tokens are returned once at issuance, only sha256 hashes persist in agent_auth_tokens, and listing exposes metadata only. Public agent routes accept env-configured shared tokens or any active DB-issued token; successful validation stamps last_used_at and revoked tokens are rejected — verified end-to-end against a real stack (register, heartbeat, revoke → 401, bogus → 401). Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
23 lines
605 B
SQL
23 lines
605 B
SQL
-- name: CreateAgentAuthToken :one
|
|
INSERT INTO agent_auth_tokens (token_hash, label)
|
|
VALUES ($1, $2)
|
|
RETURNING *;
|
|
|
|
-- name: ListAgentAuthTokens :many
|
|
SELECT * FROM agent_auth_tokens
|
|
ORDER BY created_at DESC;
|
|
|
|
-- name: GetActiveAgentAuthTokenByHash :one
|
|
SELECT * FROM agent_auth_tokens
|
|
WHERE token_hash = $1 AND revoked_at IS NULL
|
|
LIMIT 1;
|
|
|
|
-- name: TouchAgentAuthToken :exec
|
|
UPDATE agent_auth_tokens SET last_used_at = NOW()
|
|
WHERE token_hash = $1 AND revoked_at IS NULL;
|
|
|
|
-- name: RevokeAgentAuthToken :one
|
|
UPDATE agent_auth_tokens SET revoked_at = NOW()
|
|
WHERE id = $1 AND revoked_at IS NULL
|
|
RETURNING *;
|