56 lines
1.9 KiB
SQL
56 lines
1.9 KiB
SQL
-- ============================================================================
|
|
-- Auth Database Schema (auth.db)
|
|
-- ============================================================================
|
|
-- Separate from medical data (inou.db). Volatile/ephemeral data.
|
|
-- ============================================================================
|
|
|
|
-- Sessions table for secure session management
|
|
-- Tokens are random 32-byte base64url-encoded strings
|
|
CREATE TABLE IF NOT EXISTS sessions (
|
|
token TEXT PRIMARY KEY,
|
|
dossier_id TEXT NOT NULL,
|
|
created_at INTEGER NOT NULL,
|
|
expires_at INTEGER NOT NULL
|
|
);
|
|
|
|
-- Index for fast session lookup and cleanup
|
|
CREATE INDEX IF NOT EXISTS idx_sessions_dossier ON sessions(dossier_id);
|
|
CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);
|
|
|
|
-- OAuth authorization codes (PKCE, 10 min expiry)
|
|
CREATE TABLE IF NOT EXISTS oauth_codes (
|
|
code TEXT PRIMARY KEY,
|
|
client_id TEXT NOT NULL,
|
|
dossier_id TEXT NOT NULL,
|
|
redirect_uri TEXT NOT NULL,
|
|
code_challenge TEXT,
|
|
code_challenge_method TEXT,
|
|
expires_at INTEGER NOT NULL,
|
|
used INTEGER DEFAULT 0
|
|
);
|
|
|
|
-- OAuth refresh tokens (30 day expiry)
|
|
CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
|
|
token_id TEXT PRIMARY KEY,
|
|
client_id TEXT NOT NULL,
|
|
dossier_id TEXT NOT NULL,
|
|
created_at INTEGER NOT NULL,
|
|
expires_at INTEGER NOT NULL,
|
|
revoked INTEGER DEFAULT 0
|
|
);
|
|
|
|
-- OAuth clients (registered applications)
|
|
CREATE TABLE IF NOT EXISTS oauth_clients (
|
|
client_id TEXT PRIMARY KEY,
|
|
client_secret TEXT,
|
|
name TEXT NOT NULL,
|
|
redirect_uris TEXT NOT NULL, -- JSON array
|
|
allowed_scopes TEXT, -- JSON array
|
|
created_at INTEGER NOT NULL
|
|
);
|
|
|
|
-- Cleanup old sessions periodically
|
|
DELETE FROM sessions WHERE expires_at < strftime('%s', 'now');
|
|
DELETE FROM oauth_codes WHERE expires_at < strftime('%s', 'now');
|
|
DELETE FROM oauth_refresh_tokens WHERE expires_at < strftime('%s', 'now');
|