Public Access
Add data model, DbContext and initial migration (M1)
Schema for identity, vaults, grants, hosts and the sync change log, verified against a real PostgreSQL 18 container rather than an in-memory provider: partial unique indexes, CHECK constraints, citext and identity-always columns are all provider behaviour that an in-memory fake would not exercise. Invariants pushed into the database, so they hold even when application code has a bug: - ck_host_relay_target is a security boundary, not tidiness. A host may carry a plaintext hostname and port ONLY when relay is deliberately enabled. Both directions are tested; the important one is that relay-disabled hosts cannot carry an address, since otherwise a bug would silently give the server infrastructure visibility it was never granted. - ck_vault_owner: exactly one of owner_user_id or team_id, or permission resolution would have no defined answer. - ck_vault_key_grant_recipient: member grants name a user; recovery and escrow grants are wrapped to a key and must not. - ck_user_key_wrap_kdf: a password-derived wrap without its parameters is permanently unopenable, so a partial write is rejected outright. Present from the first migration on purpose: - GrantKind (Member/Recovery/Escrow). Recovery cannot be bolted on later — every vault created before it existed would be unrecoverable by design. - team and team_membership, though team features are M3. Adding them later would mean introducing a foreign key on a live vault table. - Host.ContentKeyId, reserved for per-item content keys wrapped to individual users. - user_key as its own table, so key rotation does not require altering the user row. Two things verified rather than assumed: - Npgsql's UseXminAsConcurrencyToken helper no longer exists in EF 10, so xmin is mapped directly in XminConcurrency. The generated migration *looks* like it creates an xmin column; it does not. Confirmed by inspecting pg_attribute (attnum -2, a system column) and by grepping the emitted DDL. A test pins both, because had it created a real column PostgreSQL would have rejected the name. - EF Core is now pinned centrally. The Npgsql provider asks for 10.0.4 while EntityFrameworkCore.Design pulls 10.0.10, and because Design is PrivateAssets=all that higher version does not flow to referencing projects — producing a CS1705 in any test project referencing Infrastructure. Also commits artifacts/schema/v0.1.sql, the idempotent script, as the baseline for future upgrade tests. Verified: 0 warnings, 122 tests pass (27 new against Postgres), format clean.
This commit is contained in:
@@ -0,0 +1,165 @@
|
||||
namespace DodoSSH.Domain;
|
||||
|
||||
/// <summary>Lifecycle state of a user account.</summary>
|
||||
public enum UserStatus
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Normal, active account.</summary>
|
||||
Active = 1,
|
||||
|
||||
/// <summary>Sign-in blocked, data retained.</summary>
|
||||
Suspended = 2,
|
||||
|
||||
/// <summary>Offboarded. Grants revoked; audit history retained.</summary>
|
||||
Deprovisioned = 3,
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Which key the user's secret bundle is wrapped under.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Every kind wraps the <em>same</em> bundle, which is what makes a passphrase change a
|
||||
/// single-row update instead of a re-encryption of the whole vault. See docs/crypto.md §3.
|
||||
/// </remarks>
|
||||
public enum UserKeyWrapKind
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Wrapped under a key derived from the vault passphrase.</summary>
|
||||
Passphrase = 1,
|
||||
|
||||
/// <summary>Sealed to one enrolled device's public key.</summary>
|
||||
Device = 2,
|
||||
|
||||
/// <summary>Wrapped under a key derived from the printable recovery code.</summary>
|
||||
Recovery = 3,
|
||||
|
||||
/// <summary>Sealed to a team break-glass key. Opt-in; M5.</summary>
|
||||
Escrow = 4,
|
||||
}
|
||||
|
||||
/// <summary>Operating system family of an enrolled device, for display only.</summary>
|
||||
public enum DevicePlatform
|
||||
{
|
||||
/// <summary>Unknown or unreported.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Windows.</summary>
|
||||
Windows = 1,
|
||||
|
||||
/// <summary>macOS.</summary>
|
||||
MacOs = 2,
|
||||
|
||||
/// <summary>Linux.</summary>
|
||||
Linux = 3,
|
||||
}
|
||||
|
||||
/// <summary>A member's role within a team.</summary>
|
||||
public enum TeamRole
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Read-only.</summary>
|
||||
Viewer = 10,
|
||||
|
||||
/// <summary>Ordinary member.</summary>
|
||||
Member = 20,
|
||||
|
||||
/// <summary>May manage members and create vaults.</summary>
|
||||
Admin = 30,
|
||||
|
||||
/// <summary>Sole owner. Transferable.</summary>
|
||||
Owner = 40,
|
||||
}
|
||||
|
||||
/// <summary>State of a team membership.</summary>
|
||||
public enum MembershipStatus
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Invited but not yet accepted.</summary>
|
||||
Invited = 1,
|
||||
|
||||
/// <summary>Active member.</summary>
|
||||
Active = 2,
|
||||
|
||||
/// <summary>Revoked. Retained so audit history stays resolvable.</summary>
|
||||
Revoked = 3,
|
||||
}
|
||||
|
||||
/// <summary>Whether a vault belongs to one user or to a team.</summary>
|
||||
public enum VaultOwnerKind
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Owned by a single user.</summary>
|
||||
Personal = 1,
|
||||
|
||||
/// <summary>Owned by a team.</summary>
|
||||
Team = 2,
|
||||
}
|
||||
|
||||
/// <summary>Why a vault key grant exists.</summary>
|
||||
/// <remarks>
|
||||
/// Present from the first migration on purpose. Recovery is not a feature that can be bolted on
|
||||
/// later: the schema has to allow a vault key to be wrapped to something other than a member
|
||||
/// from the outset, or every existing vault becomes unrecoverable by design.
|
||||
/// </remarks>
|
||||
public enum GrantKind
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Wrapped to a member's identity key.</summary>
|
||||
Member = 1,
|
||||
|
||||
/// <summary>Wrapped to a recovery key held by the vault owner.</summary>
|
||||
Recovery = 2,
|
||||
|
||||
/// <summary>Wrapped to a team break-glass key. Opt-in; M5.</summary>
|
||||
Escrow = 3,
|
||||
}
|
||||
|
||||
/// <summary>State of a vault key grant.</summary>
|
||||
public enum GrantState
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Usable.</summary>
|
||||
Active = 1,
|
||||
|
||||
/// <summary>
|
||||
/// The recipient's identity key changed or the vault was rekeyed, so this grant must be
|
||||
/// re-wrapped by a member holding Share before the recipient can read the vault again.
|
||||
/// </summary>
|
||||
AwaitingRewrap = 2,
|
||||
|
||||
/// <summary>
|
||||
/// Revoked. Blocks future reads only; anything already downloaded is already gone. See
|
||||
/// ADR 0001.
|
||||
/// </summary>
|
||||
Revoked = 3,
|
||||
}
|
||||
|
||||
/// <summary>Why a vault needs rekeying.</summary>
|
||||
public enum RekeyReason
|
||||
{
|
||||
/// <summary>No rekey pending.</summary>
|
||||
None = 0,
|
||||
|
||||
/// <summary>A member was removed.</summary>
|
||||
MemberRemoved = 1,
|
||||
|
||||
/// <summary>A member's identity key was rotated.</summary>
|
||||
KeyRotated = 2,
|
||||
|
||||
/// <summary>An operator or member requested it.</summary>
|
||||
Requested = 3,
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
namespace DodoSSH.Domain;
|
||||
|
||||
/// <summary>
|
||||
/// An SSH host.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The only vault item type in M1. Everything sensitive — username, notes, jump chain, SSH
|
||||
/// options — lives inside <see cref="Payload"/>. There is deliberately no plaintext label:
|
||||
/// access-control administration happens in the client, which can decrypt names, so the server
|
||||
/// never needs a searchable title.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <see cref="Hostname"/> and <see cref="Port"/> are the one deliberate plaintext concession, and
|
||||
/// only when <see cref="RelayEnabled"/> is set. The relay must resolve its target server-side or
|
||||
/// it becomes an authenticated open TCP proxy into the operator's own network. A database CHECK
|
||||
/// constraint enforces the pairing so it cannot drift. See ADR 0004.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class Host
|
||||
{
|
||||
/// <summary>Primary key. UUIDv7, generated by the client so items can be created offline.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>Owning vault.</summary>
|
||||
public Guid VaultId { get; set; }
|
||||
|
||||
/// <summary>Owning vault.</summary>
|
||||
public Vault? Vault { get; set; }
|
||||
|
||||
/// <summary>The encrypted item: a DSH1 envelope. Opaque to the server.</summary>
|
||||
public byte[] Payload { get; set; } = [];
|
||||
|
||||
/// <summary>The item's data key, wrapped under the vault key. Opaque.</summary>
|
||||
public byte[]? DataKeyWrap { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// Reserved for per-item content keys wrapped to individual users, which is what will make
|
||||
/// per-item access control cryptographic rather than server-enforced. Present from the first
|
||||
/// migration so that lands without a migration; see docs/crypto.md §3.
|
||||
/// </summary>
|
||||
public Guid? ContentKeyId { get; set; }
|
||||
|
||||
/// <summary>Vault key generation this payload was encrypted under.</summary>
|
||||
public int KeyGeneration { get; set; }
|
||||
|
||||
/// <summary>AAD rule version, enabling a lazy re-encrypt-on-write migration later.</summary>
|
||||
public short PayloadAadVersion { get; set; }
|
||||
|
||||
/// <summary>Whether this host may be dialled through the server relay.</summary>
|
||||
public bool RelayEnabled { get; set; }
|
||||
|
||||
/// <summary>Target hostname. Permitted only when <see cref="RelayEnabled"/> is set.</summary>
|
||||
public string? Hostname { get; set; }
|
||||
|
||||
/// <summary>Target port. Permitted only when <see cref="RelayEnabled"/> is set.</summary>
|
||||
public int? Port { get; set; }
|
||||
|
||||
/// <summary>Owning group, for tree placement. Groups arrive in M2.</summary>
|
||||
public Guid? GroupId { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// Client-visible, monotonic item version. Used for optimistic concurrency on push, and
|
||||
/// deliberately distinct from the internal <c>xmin</c> guard, which is never exposed because
|
||||
/// it is not stable across VACUUM FREEZE.
|
||||
/// </summary>
|
||||
public int Version { get; set; }
|
||||
|
||||
/// <summary>Latest change-log sequence touching this row, so a delta pull can join directly.</summary>
|
||||
public long ChangeSequence { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Last modification timestamp.</summary>
|
||||
public DateTimeOffset UpdatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// Soft-delete marker. Deletes are tombstones: a client that has been offline must be able to
|
||||
/// learn an item went away, and a vanished row is indistinguishable from one never seen.
|
||||
/// </summary>
|
||||
public DateTimeOffset? DeletedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Who created it.</summary>
|
||||
public Guid CreatedByUserId { get; set; }
|
||||
|
||||
/// <summary>Who last modified it.</summary>
|
||||
public Guid UpdatedByUserId { get; set; }
|
||||
}
|
||||
@@ -0,0 +1,242 @@
|
||||
namespace DodoSSH.Domain;
|
||||
|
||||
/// <summary>
|
||||
/// A user, keyed on their identity-provider subject.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Provisioned just-in-time on first authenticated request. Matching an existing account by
|
||||
/// email is an account-takeover vector and is therefore opt-in configuration, never the default.
|
||||
/// </remarks>
|
||||
public sealed class UserAccount
|
||||
{
|
||||
/// <summary>Primary key. UUIDv7, generated by the application.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>OIDC issuer. Part of the natural key, so multiple providers can coexist.</summary>
|
||||
public string Issuer { get; set; } = string.Empty;
|
||||
|
||||
/// <summary>OIDC subject.</summary>
|
||||
public string Subject { get; set; } = string.Empty;
|
||||
|
||||
/// <summary>Email, for display and invitations. Case-insensitive.</summary>
|
||||
public string? Email { get; set; }
|
||||
|
||||
/// <summary>Display name.</summary>
|
||||
public string? DisplayName { get; set; }
|
||||
|
||||
/// <summary>Lifecycle state.</summary>
|
||||
public UserStatus Status { get; set; } = UserStatus.Active;
|
||||
|
||||
/// <summary>When the identity key was first enrolled; null until then.</summary>
|
||||
public DateTimeOffset? EnrolledAtUtc { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Last modification timestamp.</summary>
|
||||
public DateTimeOffset UpdatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Last authenticated request.</summary>
|
||||
public DateTimeOffset? LastSeenAtUtc { get; set; }
|
||||
|
||||
/// <summary>Soft-delete marker.</summary>
|
||||
public DateTimeOffset? DeletedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Identity key generations, current and historic.</summary>
|
||||
public ICollection<UserKey> Keys { get; } = [];
|
||||
|
||||
/// <summary>Wraps of this user's secret bundle.</summary>
|
||||
public ICollection<UserKeyWrap> KeyWraps { get; } = [];
|
||||
|
||||
/// <summary>Enrolled devices.</summary>
|
||||
public ICollection<Device> Devices { get; } = [];
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// One generation of a user's identity key pair. Public halves only.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// A separate table from the first migration, because retrofitting key rotation onto columns
|
||||
/// hanging off the user row is painful.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Encryption and signing keys are distinct: reusing one key for both agreement and signatures
|
||||
/// is a standing cryptographic mistake, and the signing key is what gives grants attribution
|
||||
/// that the server cannot forge.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class UserKey
|
||||
{
|
||||
/// <summary>Primary key.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>Owning user.</summary>
|
||||
public Guid UserId { get; set; }
|
||||
|
||||
/// <summary>Owning user.</summary>
|
||||
public UserAccount? User { get; set; }
|
||||
|
||||
/// <summary>Generation number, starting at 1.</summary>
|
||||
public int Generation { get; set; }
|
||||
|
||||
/// <summary>X25519 public key, 32 bytes. Used for wrapping.</summary>
|
||||
public byte[] EncryptionPublicKey { get; set; } = [];
|
||||
|
||||
/// <summary>Ed25519 public key, 32 bytes. Used for signatures.</summary>
|
||||
public byte[] SigningPublicKey { get; set; } = [];
|
||||
|
||||
/// <summary>SHA-256 fingerprint over both public keys. See docs/crypto.md §8.</summary>
|
||||
public byte[] FingerprintSha256 { get; set; } = [];
|
||||
|
||||
/// <summary>The signed key statement, verbatim, as JSON.</summary>
|
||||
public string Statement { get; set; } = string.Empty;
|
||||
|
||||
/// <summary>Ed25519 self-signature over the statement.</summary>
|
||||
public byte[] StatementSignature { get; set; } = [];
|
||||
|
||||
/// <summary>
|
||||
/// Evidence that the identity provider signed over this statement's hash: the verified
|
||||
/// claims of the binding ID token, as JSON. Retained so a client can audit the binding
|
||||
/// rather than trusting our word for it.
|
||||
/// </summary>
|
||||
public string? IdentityProviderBinding { get; set; }
|
||||
|
||||
/// <summary>Whether this is the user's current generation.</summary>
|
||||
public bool IsCurrent { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>When this generation was superseded or revoked.</summary>
|
||||
public DateTimeOffset? RevokedAtUtc { get; set; }
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// One wrap of a user's secret bundle.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// KDF parameters are stored in plaintext beside the wrap. Salts are not secrets, and keeping
|
||||
/// the parameters with the wrap makes raising them later a per-user, unlock-time migration
|
||||
/// rather than a breaking change.
|
||||
/// </remarks>
|
||||
public sealed class UserKeyWrap
|
||||
{
|
||||
/// <summary>Primary key.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>Owning user.</summary>
|
||||
public Guid UserId { get; set; }
|
||||
|
||||
/// <summary>Owning user.</summary>
|
||||
public UserAccount? User { get; set; }
|
||||
|
||||
/// <summary>Which key this wrap is under.</summary>
|
||||
public UserKeyWrapKind Kind { get; set; }
|
||||
|
||||
/// <summary>The device, for <see cref="UserKeyWrapKind.Device"/> wraps.</summary>
|
||||
public Guid? DeviceId { get; set; }
|
||||
|
||||
/// <summary>The device, for <see cref="UserKeyWrapKind.Device"/> wraps.</summary>
|
||||
public Device? Device { get; set; }
|
||||
|
||||
/// <summary>The wrapped bundle: an opaque DSH1 envelope.</summary>
|
||||
public byte[] Wrap { get; set; } = [];
|
||||
|
||||
/// <summary>Optimistic concurrency guard against two devices racing a passphrase change.</summary>
|
||||
public int WrapVersion { get; set; }
|
||||
|
||||
/// <summary>KDF identifier, for password-derived wraps.</summary>
|
||||
public string? KdfAlgorithm { get; set; }
|
||||
|
||||
/// <summary>KDF salt. Not a secret.</summary>
|
||||
public byte[]? KdfSalt { get; set; }
|
||||
|
||||
/// <summary>Argon2id memory cost, in kibibytes.</summary>
|
||||
public int? KdfMemoryKibibytes { get; set; }
|
||||
|
||||
/// <summary>Argon2id pass count.</summary>
|
||||
public int? KdfPasses { get; set; }
|
||||
|
||||
/// <summary>Argon2id lanes. Always 1; libsodium supports no other value.</summary>
|
||||
public int? KdfParallelism { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Last successful unlock through this wrap.</summary>
|
||||
public DateTimeOffset? LastUsedAtUtc { get; set; }
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A device enrolled for unlock without re-entering the passphrase.
|
||||
/// </summary>
|
||||
public sealed class Device
|
||||
{
|
||||
/// <summary>Primary key.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>Owning user.</summary>
|
||||
public Guid UserId { get; set; }
|
||||
|
||||
/// <summary>Owning user.</summary>
|
||||
public UserAccount? User { get; set; }
|
||||
|
||||
/// <summary>Human-readable name.</summary>
|
||||
public string Name { get; set; } = string.Empty;
|
||||
|
||||
/// <summary>Operating system family.</summary>
|
||||
public DevicePlatform Platform { get; set; }
|
||||
|
||||
/// <summary>The device's X25519 public key. Its private half lives in the OS keystore.</summary>
|
||||
public byte[] PublicKey { get; set; } = [];
|
||||
|
||||
/// <summary>Enrollment timestamp.</summary>
|
||||
public DateTimeOffset EnrolledAtUtc { get; set; }
|
||||
|
||||
/// <summary>Last activity.</summary>
|
||||
public DateTimeOffset? LastSeenAtUtc { get; set; }
|
||||
|
||||
/// <summary>Revocation timestamp.</summary>
|
||||
public DateTimeOffset? RevokedAtUtc { get; set; }
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// An append-only log of every identity key statement ever published.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Cheap key transparency. Every signed grant records the log head its signer observed, so for
|
||||
/// the server to show two clients divergent views of a user's keys it must keep both forks
|
||||
/// consistent across every subsequent shared operation. Any two clients touching the same vault
|
||||
/// will then surface the mismatch. This converts an otherwise undetectable key-substitution
|
||||
/// attack into a detectable one; it does not prevent it. See ADR 0001.
|
||||
/// </remarks>
|
||||
public sealed class KeyLogEntry
|
||||
{
|
||||
/// <summary>Monotonic sequence. Database-generated.</summary>
|
||||
public long Sequence { get; set; }
|
||||
|
||||
/// <summary>The user whose key this is.</summary>
|
||||
public Guid UserId { get; set; }
|
||||
|
||||
/// <summary>Generation published.</summary>
|
||||
public int Generation { get; set; }
|
||||
|
||||
/// <summary>X25519 public key.</summary>
|
||||
public byte[] EncryptionPublicKey { get; set; } = [];
|
||||
|
||||
/// <summary>Ed25519 public key.</summary>
|
||||
public byte[] SigningPublicKey { get; set; } = [];
|
||||
|
||||
/// <summary>Ed25519 self-signature over the key statement.</summary>
|
||||
public byte[] StatementSignature { get; set; } = [];
|
||||
|
||||
/// <summary>Hash of the preceding entry, forming the chain.</summary>
|
||||
public byte[] PreviousHash { get; set; } = [];
|
||||
|
||||
/// <summary>Hash of this entry, over the previous hash and this entry's contents.</summary>
|
||||
public byte[] Hash { get; set; } = [];
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
}
|
||||
@@ -0,0 +1,120 @@
|
||||
namespace DodoSSH.Domain;
|
||||
|
||||
/// <summary>What a change did to an entity.</summary>
|
||||
public enum ChangeOperation
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>Created or modified.</summary>
|
||||
Upsert = 1,
|
||||
|
||||
/// <summary>Soft-deleted, leaving a tombstone.</summary>
|
||||
Delete = 2,
|
||||
}
|
||||
|
||||
/// <summary>The kind of item a change refers to. Mirrors the contract enum; append only.</summary>
|
||||
public enum ChangeEntityType
|
||||
{
|
||||
/// <summary>Not a legal value.</summary>
|
||||
Unspecified = 0,
|
||||
|
||||
/// <summary>An SSH host.</summary>
|
||||
Host = 1,
|
||||
|
||||
/// <summary>A credential. M2.</summary>
|
||||
Credential = 2,
|
||||
|
||||
/// <summary>An SSH key pair. M2.</summary>
|
||||
SshKey = 3,
|
||||
|
||||
/// <summary>A host group. M2.</summary>
|
||||
HostGroup = 4,
|
||||
|
||||
/// <summary>A tag. M2.</summary>
|
||||
Tag = 5,
|
||||
|
||||
/// <summary>A host-to-tag association. M2.</summary>
|
||||
HostTag = 6,
|
||||
|
||||
/// <summary>A host-to-credential association. M2.</summary>
|
||||
HostCredential = 7,
|
||||
|
||||
/// <summary>A snippet. M2.</summary>
|
||||
Snippet = 8,
|
||||
|
||||
/// <summary>A port forward. M2.</summary>
|
||||
PortForward = 9,
|
||||
|
||||
/// <summary>A known SSH host key. M2.</summary>
|
||||
KnownHostKey = 10,
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// One entry in a vault's change log, which is what delta sync reads.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <see cref="Sequence"/> comes from a <c>bigserial</c>, and that carries a trap worth stating
|
||||
/// where the code lives: sequence values are handed out <em>before</em> commit. If transaction A
|
||||
/// takes 5 and B takes 6 but B commits first, a reader that advances its cursor to 6 permanently
|
||||
/// misses 5 — silent sync corruption that only appears under concurrent writes to one vault.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Every push therefore takes a per-vault transaction-scoped advisory lock as its first
|
||||
/// statement, so sequence order equals commit order. See ADR 0003.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class SyncChange
|
||||
{
|
||||
/// <summary>Monotonic sequence. Database-generated.</summary>
|
||||
public long Sequence { get; set; }
|
||||
|
||||
/// <summary>Owning vault. Cursors are scoped per vault.</summary>
|
||||
public Guid VaultId { get; set; }
|
||||
|
||||
/// <summary>Kind of item.</summary>
|
||||
public ChangeEntityType EntityType { get; set; }
|
||||
|
||||
/// <summary>The item.</summary>
|
||||
public Guid EntityId { get; set; }
|
||||
|
||||
/// <summary>What happened.</summary>
|
||||
public ChangeOperation Operation { get; set; }
|
||||
|
||||
/// <summary>The item's version after the change.</summary>
|
||||
public int Revision { get; set; }
|
||||
|
||||
/// <summary>Who made the change.</summary>
|
||||
public Guid ActorUserId { get; set; }
|
||||
|
||||
/// <summary>When it was recorded.</summary>
|
||||
public DateTimeOffset OccurredAtUtc { get; set; }
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Records that a client operation was applied, so a retry is a no-op.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Keyed on the client-generated operation id, which makes retries exactly-once at
|
||||
/// <em>operation</em> granularity. A batch-level idempotency key alone would not: a client that
|
||||
/// times out mid-push and retries with a partially overlapping batch would otherwise double-apply
|
||||
/// the operations that did land.
|
||||
/// </remarks>
|
||||
public sealed class SyncOperationReceipt
|
||||
{
|
||||
/// <summary>The client-generated operation id. Primary key.</summary>
|
||||
public Guid OperationId { get; set; }
|
||||
|
||||
/// <summary>Vault the operation targeted.</summary>
|
||||
public Guid VaultId { get; set; }
|
||||
|
||||
/// <summary>Change-log sequence produced, when the operation was applied.</summary>
|
||||
public long? AppliedChangeSequence { get; set; }
|
||||
|
||||
/// <summary>The item's version after the operation.</summary>
|
||||
public int? ResultVersion { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
namespace DodoSSH.Domain;
|
||||
|
||||
/// <summary>
|
||||
/// A group of users who can share vaults.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The tables exist from the first migration although team features ship in M3. Adding them
|
||||
/// later would mean altering <see cref="Vault"/> to introduce a foreign key on a live table, and
|
||||
/// the cost of carrying two unused tables is far lower than that.
|
||||
/// </remarks>
|
||||
public sealed class Team
|
||||
{
|
||||
/// <summary>Primary key.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>Display name.</summary>
|
||||
public string Name { get; set; } = string.Empty;
|
||||
|
||||
/// <summary>URL-safe unique identifier.</summary>
|
||||
public string Slug { get; set; } = string.Empty;
|
||||
|
||||
/// <summary>Optional description.</summary>
|
||||
public string? Description { get; set; }
|
||||
|
||||
/// <summary>Who created it.</summary>
|
||||
public Guid CreatedByUserId { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Soft-delete marker.</summary>
|
||||
public DateTimeOffset? DeletedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Members.</summary>
|
||||
public ICollection<TeamMembership> Memberships { get; } = [];
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A user's membership of a team.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Revoked memberships are retained rather than deleted, so historic audit entries remain
|
||||
/// resolvable to a person.
|
||||
/// </remarks>
|
||||
public sealed class TeamMembership
|
||||
{
|
||||
/// <summary>Primary key.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>The team.</summary>
|
||||
public Guid TeamId { get; set; }
|
||||
|
||||
/// <summary>The team.</summary>
|
||||
public Team? Team { get; set; }
|
||||
|
||||
/// <summary>The member.</summary>
|
||||
public Guid UserId { get; set; }
|
||||
|
||||
/// <summary>The member.</summary>
|
||||
public UserAccount? User { get; set; }
|
||||
|
||||
/// <summary>Role within the team.</summary>
|
||||
public TeamRole Role { get; set; }
|
||||
|
||||
/// <summary>Membership state.</summary>
|
||||
public MembershipStatus Status { get; set; }
|
||||
|
||||
/// <summary>Who invited them.</summary>
|
||||
public Guid? InvitedByUserId { get; set; }
|
||||
|
||||
/// <summary>When the invitation was accepted.</summary>
|
||||
public DateTimeOffset? JoinedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Soft-delete marker.</summary>
|
||||
public DateTimeOffset? DeletedAtUtc { get; set; }
|
||||
}
|
||||
@@ -0,0 +1,133 @@
|
||||
namespace DodoSSH.Domain;
|
||||
|
||||
/// <summary>
|
||||
/// A container of encrypted items sharing one vault key.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The vault name is plaintext, unlike item names. A user has to be able to pick a vault before
|
||||
/// anything is decrypted, and vault names are few and low-signal compared with a full host
|
||||
/// inventory.
|
||||
/// </remarks>
|
||||
public sealed class Vault
|
||||
{
|
||||
/// <summary>Primary key.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>Display name.</summary>
|
||||
public string Name { get; set; } = string.Empty;
|
||||
|
||||
/// <summary>Whether this belongs to a user or a team.</summary>
|
||||
public VaultOwnerKind OwnerKind { get; set; }
|
||||
|
||||
/// <summary>Owning user, for a personal vault.</summary>
|
||||
public Guid? OwnerUserId { get; set; }
|
||||
|
||||
/// <summary>Owning user, for a personal vault.</summary>
|
||||
public UserAccount? OwnerUser { get; set; }
|
||||
|
||||
/// <summary>Owning team, for a team vault.</summary>
|
||||
public Guid? TeamId { get; set; }
|
||||
|
||||
/// <summary>Owning team, for a team vault.</summary>
|
||||
public Team? Team { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// Current key generation. Bumped on rekey, and part of every item's AAD, so a server cannot
|
||||
/// roll a row back to a superseded generation.
|
||||
/// </summary>
|
||||
public int KeyGeneration { get; set; } = 1;
|
||||
|
||||
/// <summary>Whether a membership or key change has left this vault needing a rekey.</summary>
|
||||
public bool RekeyRequired { get; set; }
|
||||
|
||||
/// <summary>Why a rekey is pending.</summary>
|
||||
public RekeyReason RekeyReason { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Last modification timestamp.</summary>
|
||||
public DateTimeOffset UpdatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Soft-delete marker.</summary>
|
||||
public DateTimeOffset? DeletedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Wrapped vault keys, one per recipient per generation.</summary>
|
||||
public ICollection<VaultKeyGrant> KeyGrants { get; } = [];
|
||||
|
||||
/// <summary>Hosts in this vault.</summary>
|
||||
public ICollection<Host> Hosts { get; } = [];
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A vault key wrapped to one recipient, for one key generation.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The server stores <see cref="WrappedKey"/> verbatim and cannot verify that it is the correct
|
||||
/// vault key. A malicious granter can seal garbage; the recipient detects it on first unwrap as a
|
||||
/// tag failure, and <see cref="Signature"/> names who did it. Detectable and attributable is the
|
||||
/// right failure mode here — silent is not achievable, since verification would require the
|
||||
/// server to hold the key.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <see cref="GranterKeyFingerprint"/> and <see cref="KeyLogHead"/> are recorded so a recipient
|
||||
/// can check both who wrapped this and what view of the key log they held at the time.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class VaultKeyGrant
|
||||
{
|
||||
/// <summary>Primary key.</summary>
|
||||
public Guid Id { get; set; }
|
||||
|
||||
/// <summary>The vault.</summary>
|
||||
public Guid VaultId { get; set; }
|
||||
|
||||
/// <summary>The vault.</summary>
|
||||
public Vault? Vault { get; set; }
|
||||
|
||||
/// <summary>Key generation this grant is for.</summary>
|
||||
public int KeyGeneration { get; set; }
|
||||
|
||||
/// <summary>Why this grant exists: a member, a recovery key, or escrow.</summary>
|
||||
public GrantKind Kind { get; set; }
|
||||
|
||||
/// <summary>Recipient, for a member grant.</summary>
|
||||
public Guid? RecipientUserId { get; set; }
|
||||
|
||||
/// <summary>Recipient, for a member grant.</summary>
|
||||
public UserAccount? RecipientUser { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// Fingerprint of the exact public key this was wrapped to, so a later key rotation
|
||||
/// invalidates the grant explicitly rather than silently.
|
||||
/// </summary>
|
||||
public byte[] RecipientKeyFingerprint { get; set; } = [];
|
||||
|
||||
/// <summary>The vault key, sealed to the recipient. Opaque.</summary>
|
||||
public byte[] WrappedKey { get; set; } = [];
|
||||
|
||||
/// <summary>Who created this grant.</summary>
|
||||
public Guid GranterUserId { get; set; }
|
||||
|
||||
/// <summary>Fingerprint of the granter's identity key.</summary>
|
||||
public byte[] GranterKeyFingerprint { get; set; } = [];
|
||||
|
||||
/// <summary>Key log head the granter observed. Enables fork detection.</summary>
|
||||
public byte[]? KeyLogHead { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// Ed25519 signature by the granter over the canonical grant tuple. Verified by clients, not
|
||||
/// by the server: server-side verification would be a convenience, never the boundary.
|
||||
/// </summary>
|
||||
public byte[] Signature { get; set; } = [];
|
||||
|
||||
/// <summary>Grant state.</summary>
|
||||
public GrantState State { get; set; }
|
||||
|
||||
/// <summary>Creation timestamp.</summary>
|
||||
public DateTimeOffset CreatedAtUtc { get; set; }
|
||||
|
||||
/// <summary>Revocation timestamp.</summary>
|
||||
public DateTimeOffset? RevokedAtUtc { get; set; }
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
using DodoSSH.Domain;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Metadata.Builders;
|
||||
|
||||
namespace DodoSSH.Infrastructure.Configurations;
|
||||
|
||||
/// <summary>Maps <see cref="Host"/>.</summary>
|
||||
public sealed class HostConfiguration : IEntityTypeConfiguration<Host>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<Host> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("host");
|
||||
builder.HasKey(h => h.Id);
|
||||
|
||||
// Client-generated UUIDv7: items must be creatable offline, with their ids.
|
||||
builder.Property(h => h.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(h => h.Payload).IsRequired();
|
||||
builder.Property(h => h.Hostname).HasMaxLength(255);
|
||||
|
||||
builder.HasIndex(h => new { h.VaultId, h.ChangeSequence });
|
||||
|
||||
builder.HasIndex(h => h.VaultId)
|
||||
.HasFilter("deleted_at_utc IS NULL")
|
||||
.HasDatabaseName("ix_host_vault_live");
|
||||
|
||||
// The relay resolves its target from this row, so an address is stored only when relay is
|
||||
// deliberately enabled for the host. Enforced in the database rather than in application
|
||||
// code: a bug that let a host carry a plaintext address without opting in would silently
|
||||
// widen what the server can see. See ADR 0004.
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_host_relay_target",
|
||||
"""
|
||||
(relay_enabled AND hostname IS NOT NULL AND port IS NOT NULL)
|
||||
OR (NOT relay_enabled AND hostname IS NULL AND port IS NULL)
|
||||
"""));
|
||||
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_host_port_range",
|
||||
"port IS NULL OR (port BETWEEN 1 AND 65535)"));
|
||||
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_host_version",
|
||||
"version >= 1"));
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="SyncChange"/>.</summary>
|
||||
public sealed class SyncChangeConfiguration : IEntityTypeConfiguration<SyncChange>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<SyncChange> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("sync_change");
|
||||
builder.HasKey(c => c.Sequence);
|
||||
|
||||
// Identity ALWAYS rather than BY DEFAULT: nothing may supply its own sequence value, or
|
||||
// cursor ordering stops meaning anything.
|
||||
builder.Property(c => c.Sequence).UseIdentityAlwaysColumn();
|
||||
|
||||
builder.Property(c => c.EntityType).HasConversion<int>();
|
||||
builder.Property(c => c.Operation).HasConversion<int>();
|
||||
|
||||
// The delta-pull access path: everything after a cursor, for one vault.
|
||||
builder.HasIndex(c => new { c.VaultId, c.Sequence });
|
||||
|
||||
// Latest change for a given entity, used when resolving a conflict.
|
||||
builder.HasIndex(c => new { c.VaultId, c.EntityId, c.Sequence })
|
||||
.IsDescending(false, false, true);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="SyncOperationReceipt"/>.</summary>
|
||||
public sealed class SyncOperationReceiptConfiguration : IEntityTypeConfiguration<SyncOperationReceipt>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<SyncOperationReceipt> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("sync_operation_receipt");
|
||||
|
||||
// The client-generated operation id is the key, which is what makes a retried push
|
||||
// exactly-once per operation rather than per batch.
|
||||
builder.HasKey(r => r.OperationId);
|
||||
builder.Property(r => r.OperationId).ValueGeneratedNever();
|
||||
|
||||
builder.HasIndex(r => new { r.VaultId, r.CreatedAtUtc });
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,181 @@
|
||||
using DodoSSH.Domain;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Metadata.Builders;
|
||||
|
||||
namespace DodoSSH.Infrastructure.Configurations;
|
||||
|
||||
/// <summary>Maps <see cref="UserAccount"/>.</summary>
|
||||
public sealed class UserAccountConfiguration : IEntityTypeConfiguration<UserAccount>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<UserAccount> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("user_account");
|
||||
builder.HasKey(u => u.Id);
|
||||
builder.Property(u => u.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(u => u.Issuer).HasMaxLength(512).IsRequired();
|
||||
builder.Property(u => u.Subject).HasMaxLength(256).IsRequired();
|
||||
|
||||
// citext, so lookups and uniqueness are case-insensitive without lower() everywhere.
|
||||
builder.Property(u => u.Email).HasColumnType("citext").HasMaxLength(320);
|
||||
builder.Property(u => u.DisplayName).HasMaxLength(256);
|
||||
|
||||
builder.Property(u => u.Status).HasConversion<int>();
|
||||
|
||||
// The natural key. Multi-issuer from the start so a second provider does not require a
|
||||
// schema change; the issuer is part of the identity, not a detail.
|
||||
builder.HasIndex(u => new { u.Issuer, u.Subject }).IsUnique();
|
||||
|
||||
// Email is not unique in general — only among live accounts, and only when present.
|
||||
builder.HasIndex(u => u.Email)
|
||||
.IsUnique()
|
||||
.HasFilter("email IS NOT NULL AND deleted_at_utc IS NULL");
|
||||
|
||||
builder.HasMany(u => u.Keys)
|
||||
.WithOne(k => k.User)
|
||||
.HasForeignKey(k => k.UserId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
|
||||
builder.HasMany(u => u.KeyWraps)
|
||||
.WithOne(w => w.User)
|
||||
.HasForeignKey(w => w.UserId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
|
||||
builder.HasMany(u => u.Devices)
|
||||
.WithOne(d => d.User)
|
||||
.HasForeignKey(d => d.UserId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="UserKey"/>.</summary>
|
||||
public sealed class UserKeyConfiguration : IEntityTypeConfiguration<UserKey>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<UserKey> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("user_key");
|
||||
builder.HasKey(k => k.Id);
|
||||
builder.Property(k => k.Id).ValueGeneratedNever();
|
||||
|
||||
builder.Property(k => k.EncryptionPublicKey).HasMaxLength(32).IsRequired();
|
||||
builder.Property(k => k.SigningPublicKey).HasMaxLength(32).IsRequired();
|
||||
builder.Property(k => k.FingerprintSha256).HasMaxLength(32).IsRequired();
|
||||
builder.Property(k => k.Statement).HasColumnType("jsonb").IsRequired();
|
||||
builder.Property(k => k.StatementSignature).HasMaxLength(64).IsRequired();
|
||||
builder.Property(k => k.IdentityProviderBinding).HasColumnType("jsonb");
|
||||
|
||||
builder.HasIndex(k => new { k.UserId, k.Generation }).IsUnique();
|
||||
|
||||
// Exactly one current generation per user, enforced by the database rather than by
|
||||
// convention: two "current" keys would make it ambiguous which one to wrap to.
|
||||
builder.HasIndex(k => k.UserId)
|
||||
.IsUnique()
|
||||
.HasFilter("is_current")
|
||||
.HasDatabaseName("ix_user_key_current");
|
||||
|
||||
builder.HasIndex(k => k.FingerprintSha256).IsUnique();
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="UserKeyWrap"/>.</summary>
|
||||
public sealed class UserKeyWrapConfiguration : IEntityTypeConfiguration<UserKeyWrap>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<UserKeyWrap> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("user_key_wrap");
|
||||
builder.HasKey(w => w.Id);
|
||||
builder.Property(w => w.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(w => w.Kind).HasConversion<int>();
|
||||
builder.Property(w => w.Wrap).IsRequired();
|
||||
builder.Property(w => w.KdfAlgorithm).HasMaxLength(64);
|
||||
builder.Property(w => w.KdfSalt).HasMaxLength(64);
|
||||
|
||||
builder.HasOne(w => w.Device)
|
||||
.WithMany()
|
||||
.HasForeignKey(w => w.DeviceId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
|
||||
// One passphrase wrap and one recovery wrap per user; one device wrap per device.
|
||||
builder.HasIndex(w => new { w.UserId, w.Kind })
|
||||
.IsUnique()
|
||||
.HasFilter("device_id IS NULL")
|
||||
.HasDatabaseName("ix_user_key_wrap_user_kind");
|
||||
|
||||
builder.HasIndex(w => new { w.UserId, w.DeviceId })
|
||||
.IsUnique()
|
||||
.HasFilter("device_id IS NOT NULL")
|
||||
.HasDatabaseName("ix_user_key_wrap_user_device");
|
||||
|
||||
// A password-derived wrap is useless without its parameters, and a wrap that is not
|
||||
// password-derived must not carry them. Enforced here so a partial write cannot leave a
|
||||
// bundle permanently unopenable.
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_user_key_wrap_kdf",
|
||||
"""
|
||||
(kind IN (1, 3) AND kdf_algorithm IS NOT NULL AND kdf_salt IS NOT NULL
|
||||
AND kdf_memory_kibibytes IS NOT NULL AND kdf_passes IS NOT NULL
|
||||
AND kdf_parallelism IS NOT NULL)
|
||||
OR (kind IN (2, 4) AND kdf_algorithm IS NULL AND kdf_salt IS NULL)
|
||||
"""));
|
||||
|
||||
// A device wrap must name its device; the others must not.
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_user_key_wrap_device",
|
||||
"(kind = 2 AND device_id IS NOT NULL) OR (kind <> 2 AND device_id IS NULL)"));
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="Device"/>.</summary>
|
||||
public sealed class DeviceConfiguration : IEntityTypeConfiguration<Device>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<Device> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("device");
|
||||
builder.HasKey(d => d.Id);
|
||||
builder.Property(d => d.Id).ValueGeneratedNever();
|
||||
|
||||
builder.Property(d => d.Name).HasMaxLength(256).IsRequired();
|
||||
builder.Property(d => d.Platform).HasConversion<int>();
|
||||
builder.Property(d => d.PublicKey).HasMaxLength(32).IsRequired();
|
||||
|
||||
builder.HasIndex(d => d.UserId);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="KeyLogEntry"/>.</summary>
|
||||
public sealed class KeyLogEntryConfiguration : IEntityTypeConfiguration<KeyLogEntry>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<KeyLogEntry> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("key_log");
|
||||
builder.HasKey(e => e.Sequence);
|
||||
builder.Property(e => e.Sequence).UseIdentityAlwaysColumn();
|
||||
|
||||
builder.Property(e => e.EncryptionPublicKey).HasMaxLength(32).IsRequired();
|
||||
builder.Property(e => e.SigningPublicKey).HasMaxLength(32).IsRequired();
|
||||
builder.Property(e => e.StatementSignature).HasMaxLength(64).IsRequired();
|
||||
builder.Property(e => e.PreviousHash).HasMaxLength(32).IsRequired();
|
||||
builder.Property(e => e.Hash).HasMaxLength(32).IsRequired();
|
||||
|
||||
builder.HasIndex(e => e.UserId);
|
||||
builder.HasIndex(e => e.Hash).IsUnique();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,159 @@
|
||||
using DodoSSH.Domain;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Metadata.Builders;
|
||||
|
||||
namespace DodoSSH.Infrastructure.Configurations;
|
||||
|
||||
/// <summary>Maps <see cref="Team"/>.</summary>
|
||||
public sealed class TeamConfiguration : IEntityTypeConfiguration<Team>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<Team> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("team");
|
||||
builder.HasKey(t => t.Id);
|
||||
builder.Property(t => t.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(t => t.Name).HasMaxLength(256).IsRequired();
|
||||
builder.Property(t => t.Slug).HasColumnType("citext").HasMaxLength(128).IsRequired();
|
||||
builder.Property(t => t.Description).HasMaxLength(2048);
|
||||
|
||||
builder.HasIndex(t => t.Slug)
|
||||
.IsUnique()
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
builder.HasMany(t => t.Memberships)
|
||||
.WithOne(m => m.Team)
|
||||
.HasForeignKey(m => m.TeamId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="TeamMembership"/>.</summary>
|
||||
public sealed class TeamMembershipConfiguration : IEntityTypeConfiguration<TeamMembership>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<TeamMembership> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("team_membership");
|
||||
builder.HasKey(m => m.Id);
|
||||
builder.Property(m => m.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(m => m.Role).HasConversion<int>();
|
||||
builder.Property(m => m.Status).HasConversion<int>();
|
||||
|
||||
builder.HasOne(m => m.User)
|
||||
.WithMany()
|
||||
.HasForeignKey(m => m.UserId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
|
||||
builder.HasIndex(m => new { m.TeamId, m.UserId })
|
||||
.IsUnique()
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
// Effective-permission resolution starts from the user, so this is the hot direction.
|
||||
builder.HasIndex(m => m.UserId);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="Vault"/>.</summary>
|
||||
public sealed class VaultConfiguration : IEntityTypeConfiguration<Vault>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<Vault> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("vault");
|
||||
builder.HasKey(v => v.Id);
|
||||
builder.Property(v => v.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(v => v.Name).HasMaxLength(256).IsRequired();
|
||||
builder.Property(v => v.OwnerKind).HasConversion<int>();
|
||||
builder.Property(v => v.RekeyReason).HasConversion<int>();
|
||||
|
||||
builder.HasOne(v => v.OwnerUser)
|
||||
.WithMany()
|
||||
.HasForeignKey(v => v.OwnerUserId)
|
||||
.OnDelete(DeleteBehavior.Restrict);
|
||||
|
||||
builder.HasOne(v => v.Team)
|
||||
.WithMany()
|
||||
.HasForeignKey(v => v.TeamId)
|
||||
.OnDelete(DeleteBehavior.Restrict);
|
||||
|
||||
builder.HasIndex(v => v.OwnerUserId);
|
||||
builder.HasIndex(v => v.TeamId);
|
||||
|
||||
// Exactly one owner. Without this a vault could end up owned by both or neither, and
|
||||
// permission resolution would have no defined answer.
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_vault_owner",
|
||||
"""
|
||||
(owner_kind = 1 AND owner_user_id IS NOT NULL AND team_id IS NULL)
|
||||
OR (owner_kind = 2 AND team_id IS NOT NULL AND owner_user_id IS NULL)
|
||||
"""));
|
||||
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_vault_key_generation",
|
||||
"key_generation >= 1"));
|
||||
|
||||
builder.HasMany(v => v.KeyGrants)
|
||||
.WithOne(g => g.Vault)
|
||||
.HasForeignKey(g => g.VaultId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
|
||||
builder.HasMany(v => v.Hosts)
|
||||
.WithOne(h => h.Vault)
|
||||
.HasForeignKey(h => h.VaultId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Maps <see cref="VaultKeyGrant"/>.</summary>
|
||||
public sealed class VaultKeyGrantConfiguration : IEntityTypeConfiguration<VaultKeyGrant>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<VaultKeyGrant> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("vault_key_grant");
|
||||
builder.HasKey(g => g.Id);
|
||||
builder.Property(g => g.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(g => g.Kind).HasConversion<int>();
|
||||
builder.Property(g => g.State).HasConversion<int>();
|
||||
builder.Property(g => g.RecipientKeyFingerprint).HasMaxLength(32).IsRequired();
|
||||
builder.Property(g => g.WrappedKey).IsRequired();
|
||||
builder.Property(g => g.GranterKeyFingerprint).HasMaxLength(32).IsRequired();
|
||||
builder.Property(g => g.KeyLogHead).HasMaxLength(32);
|
||||
builder.Property(g => g.Signature).HasMaxLength(64).IsRequired();
|
||||
|
||||
builder.HasOne(g => g.RecipientUser)
|
||||
.WithMany()
|
||||
.HasForeignKey(g => g.RecipientUserId)
|
||||
.OnDelete(DeleteBehavior.Cascade);
|
||||
|
||||
// One live member grant per recipient per generation. Revoked rows are retained, so the
|
||||
// filter is on revocation rather than on deletion.
|
||||
builder.HasIndex(g => new { g.VaultId, g.KeyGeneration, g.RecipientUserId })
|
||||
.IsUnique()
|
||||
.HasFilter("revoked_at_utc IS NULL AND recipient_user_id IS NOT NULL");
|
||||
|
||||
builder.HasIndex(g => g.RecipientUserId);
|
||||
|
||||
// A member grant names a user; recovery and escrow grants do not.
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_vault_key_grant_recipient",
|
||||
"(kind = 1 AND recipient_user_id IS NOT NULL) OR (kind <> 1 AND recipient_user_id IS NULL)"));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
using DodoSSH.Domain;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
|
||||
namespace DodoSSH.Infrastructure;
|
||||
|
||||
/// <summary>
|
||||
/// The application database context.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Everything lives in the <c>dodo</c> schema with snake_case names. Timestamps are
|
||||
/// <c>timestamptz</c> and always UTC, so there is no tzdata dependency and no conflict with
|
||||
/// <c>InvariantGlobalization</c>.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Two concurrency mechanisms coexist deliberately. <c>Version</c> on item rows is the
|
||||
/// client-visible, monotonic value used for <c>expectedVersion</c> conflict detection.
|
||||
/// <c>xmin</c> is the server-side optimistic guard and is never exposed, because it is not stable
|
||||
/// across <c>VACUUM FREEZE</c> and must never become a client cursor.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public class DodoDbContext(DbContextOptions<DodoDbContext> options) : DbContext(options)
|
||||
{
|
||||
/// <summary>The database schema every table lives in.</summary>
|
||||
public const string SchemaName = "dodo";
|
||||
|
||||
/// <summary>User accounts.</summary>
|
||||
public DbSet<UserAccount> Users => Set<UserAccount>();
|
||||
|
||||
/// <summary>Identity key generations.</summary>
|
||||
public DbSet<UserKey> UserKeys => Set<UserKey>();
|
||||
|
||||
/// <summary>Wraps of users' secret bundles.</summary>
|
||||
public DbSet<UserKeyWrap> UserKeyWraps => Set<UserKeyWrap>();
|
||||
|
||||
/// <summary>Enrolled devices.</summary>
|
||||
public DbSet<Device> Devices => Set<Device>();
|
||||
|
||||
/// <summary>The append-only key transparency log.</summary>
|
||||
public DbSet<KeyLogEntry> KeyLog => Set<KeyLogEntry>();
|
||||
|
||||
/// <summary>Teams.</summary>
|
||||
public DbSet<Team> Teams => Set<Team>();
|
||||
|
||||
/// <summary>Team memberships.</summary>
|
||||
public DbSet<TeamMembership> TeamMemberships => Set<TeamMembership>();
|
||||
|
||||
/// <summary>Vaults.</summary>
|
||||
public DbSet<Vault> Vaults => Set<Vault>();
|
||||
|
||||
/// <summary>Wrapped vault keys.</summary>
|
||||
public DbSet<VaultKeyGrant> VaultKeyGrants => Set<VaultKeyGrant>();
|
||||
|
||||
/// <summary>SSH hosts.</summary>
|
||||
public DbSet<Host> Hosts => Set<Host>();
|
||||
|
||||
/// <summary>The per-vault change log that delta sync reads.</summary>
|
||||
public DbSet<SyncChange> SyncChanges => Set<SyncChange>();
|
||||
|
||||
/// <summary>Applied-operation receipts, for exactly-once retries.</summary>
|
||||
public DbSet<SyncOperationReceipt> SyncOperationReceipts => Set<SyncOperationReceipt>();
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void OnModelCreating(ModelBuilder modelBuilder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(modelBuilder);
|
||||
|
||||
modelBuilder.HasDefaultSchema(SchemaName);
|
||||
modelBuilder.HasPostgresExtension("citext");
|
||||
|
||||
modelBuilder.ApplyConfigurationsFromAssembly(typeof(DodoDbContext).Assembly);
|
||||
|
||||
base.OnModelCreating(modelBuilder);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Design;
|
||||
|
||||
namespace DodoSSH.Infrastructure;
|
||||
|
||||
/// <summary>
|
||||
/// Builds a context for <c>dotnet ef</c> at design time.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Deliberately independent of the API host: generating a migration should not require the web
|
||||
/// application to start, nor a reachable database. The connection string here is never used to
|
||||
/// connect — only to select the provider so the model can be built.
|
||||
/// </remarks>
|
||||
public sealed class DodoDbContextFactory : IDesignTimeDbContextFactory<DodoDbContext>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public DodoDbContext CreateDbContext(string[] args)
|
||||
{
|
||||
var connectionString = Environment.GetEnvironmentVariable("DODOSSH_DESIGN_CONNECTION")
|
||||
?? "Host=localhost;Database=dodossh_design;Username=postgres";
|
||||
|
||||
var options = new DbContextOptionsBuilder<DodoDbContext>()
|
||||
.UseNpgsql(connectionString, npgsql =>
|
||||
npgsql.MigrationsHistoryTable("__EFMigrationsHistory", DodoDbContext.SchemaName))
|
||||
.UseSnakeCaseNamingConvention()
|
||||
.Options;
|
||||
|
||||
return new DodoDbContext(options);
|
||||
}
|
||||
}
|
||||
@@ -9,6 +9,15 @@
|
||||
<ProjectReference Include="../DodoSSH.Domain/DodoSSH.Domain.csproj" />
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" />
|
||||
<PackageReference Include="EFCore.NamingConventions" />
|
||||
<PackageReference Include="Microsoft.EntityFrameworkCore.Design">
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
|
||||
</PackageReference>
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<InternalsVisibleTo Include="DodoSSH.Infrastructure.Tests" />
|
||||
<InternalsVisibleTo Include="DodoSSH.Api.Tests" />
|
||||
|
||||
+971
@@ -0,0 +1,971 @@
|
||||
// <auto-generated />
|
||||
using System;
|
||||
using DodoSSH.Infrastructure;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Infrastructure;
|
||||
using Microsoft.EntityFrameworkCore.Migrations;
|
||||
using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
|
||||
using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
|
||||
|
||||
#nullable disable
|
||||
|
||||
namespace DodoSSH.Infrastructure.Migrations
|
||||
{
|
||||
[DbContext(typeof(DodoDbContext))]
|
||||
[Migration("20260728113419_InitialSchema")]
|
||||
partial class InitialSchema
|
||||
{
|
||||
/// <inheritdoc />
|
||||
protected override void BuildTargetModel(ModelBuilder modelBuilder)
|
||||
{
|
||||
#pragma warning disable 612, 618
|
||||
modelBuilder
|
||||
.HasDefaultSchema("dodo")
|
||||
.HasAnnotation("ProductVersion", "10.0.10")
|
||||
.HasAnnotation("Relational:MaxIdentifierLength", 63);
|
||||
|
||||
NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "citext");
|
||||
NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Device", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("EnrolledAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("enrolled_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("LastSeenAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("last_seen_at_utc");
|
||||
|
||||
b.Property<string>("Name")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("name");
|
||||
|
||||
b.Property<int>("Platform")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("platform");
|
||||
|
||||
b.Property<byte[]>("PublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("public_key");
|
||||
|
||||
b.Property<DateTimeOffset?>("RevokedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("revoked_at_utc");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_device");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.HasDatabaseName("ix_device_user_id");
|
||||
|
||||
b.ToTable("device", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Host", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<long>("ChangeSequence")
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("change_sequence");
|
||||
|
||||
b.Property<Guid?>("ContentKeyId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("content_key_id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<Guid>("CreatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("created_by_user_id");
|
||||
|
||||
b.Property<byte[]>("DataKeyWrap")
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("data_key_wrap");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<Guid?>("GroupId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("group_id");
|
||||
|
||||
b.Property<string>("Hostname")
|
||||
.HasMaxLength(255)
|
||||
.HasColumnType("character varying(255)")
|
||||
.HasColumnName("hostname");
|
||||
|
||||
b.Property<int>("KeyGeneration")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("key_generation");
|
||||
|
||||
b.Property<byte[]>("Payload")
|
||||
.IsRequired()
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("payload");
|
||||
|
||||
b.Property<short>("PayloadAadVersion")
|
||||
.HasColumnType("smallint")
|
||||
.HasColumnName("payload_aad_version");
|
||||
|
||||
b.Property<int?>("Port")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("port");
|
||||
|
||||
b.Property<bool>("RelayEnabled")
|
||||
.HasColumnType("boolean")
|
||||
.HasColumnName("relay_enabled");
|
||||
|
||||
b.Property<DateTimeOffset>("UpdatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("updated_at_utc");
|
||||
|
||||
b.Property<Guid>("UpdatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("updated_by_user_id");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.Property<int>("Version")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("version");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_host");
|
||||
|
||||
b.HasIndex("VaultId")
|
||||
.HasDatabaseName("ix_host_vault_live")
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
b.HasIndex("VaultId", "ChangeSequence")
|
||||
.HasDatabaseName("ix_host_vault_id_change_sequence");
|
||||
|
||||
b.ToTable("host", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_host_port_range", "port IS NULL OR (port BETWEEN 1 AND 65535)");
|
||||
|
||||
t.HasCheckConstraint("ck_host_relay_target", "(relay_enabled AND hostname IS NOT NULL AND port IS NOT NULL)\nOR (NOT relay_enabled AND hostname IS NULL AND port IS NULL)");
|
||||
|
||||
t.HasCheckConstraint("ck_host_version", "version >= 1");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.KeyLogEntry", b =>
|
||||
{
|
||||
b.Property<long>("Sequence")
|
||||
.ValueGeneratedOnAdd()
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("sequence");
|
||||
|
||||
NpgsqlPropertyBuilderExtensions.UseIdentityAlwaysColumn(b.Property<long>("Sequence"));
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<byte[]>("EncryptionPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("encryption_public_key");
|
||||
|
||||
b.Property<int>("Generation")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("generation");
|
||||
|
||||
b.Property<byte[]>("Hash")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("hash");
|
||||
|
||||
b.Property<byte[]>("PreviousHash")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("previous_hash");
|
||||
|
||||
b.Property<byte[]>("SigningPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("signing_public_key");
|
||||
|
||||
b.Property<byte[]>("StatementSignature")
|
||||
.IsRequired()
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("statement_signature");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.HasKey("Sequence")
|
||||
.HasName("pk_key_log");
|
||||
|
||||
b.HasIndex("Hash")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_key_log_hash");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.HasDatabaseName("ix_key_log_user_id");
|
||||
|
||||
b.ToTable("key_log", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.SyncChange", b =>
|
||||
{
|
||||
b.Property<long>("Sequence")
|
||||
.ValueGeneratedOnAdd()
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("sequence");
|
||||
|
||||
NpgsqlPropertyBuilderExtensions.UseIdentityAlwaysColumn(b.Property<long>("Sequence"));
|
||||
|
||||
b.Property<Guid>("ActorUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("actor_user_id");
|
||||
|
||||
b.Property<Guid>("EntityId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("entity_id");
|
||||
|
||||
b.Property<int>("EntityType")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("entity_type");
|
||||
|
||||
b.Property<DateTimeOffset>("OccurredAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("occurred_at_utc");
|
||||
|
||||
b.Property<int>("Operation")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("operation");
|
||||
|
||||
b.Property<int>("Revision")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("revision");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.HasKey("Sequence")
|
||||
.HasName("pk_sync_change");
|
||||
|
||||
b.HasIndex("VaultId", "Sequence")
|
||||
.HasDatabaseName("ix_sync_change_vault_id_sequence");
|
||||
|
||||
b.HasIndex("VaultId", "EntityId", "Sequence")
|
||||
.IsDescending(false, false, true)
|
||||
.HasDatabaseName("ix_sync_change_vault_id_entity_id_sequence");
|
||||
|
||||
b.ToTable("sync_change", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.SyncOperationReceipt", b =>
|
||||
{
|
||||
b.Property<Guid>("OperationId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("operation_id");
|
||||
|
||||
b.Property<long?>("AppliedChangeSequence")
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("applied_change_sequence");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<int?>("ResultVersion")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("result_version");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.HasKey("OperationId")
|
||||
.HasName("pk_sync_operation_receipt");
|
||||
|
||||
b.HasIndex("VaultId", "CreatedAtUtc")
|
||||
.HasDatabaseName("ix_sync_operation_receipt_vault_id_created_at_utc");
|
||||
|
||||
b.ToTable("sync_operation_receipt", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Team", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<Guid>("CreatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("created_by_user_id");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<string>("Description")
|
||||
.HasMaxLength(2048)
|
||||
.HasColumnType("character varying(2048)")
|
||||
.HasColumnName("description");
|
||||
|
||||
b.Property<string>("Name")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("name");
|
||||
|
||||
b.Property<string>("Slug")
|
||||
.IsRequired()
|
||||
.HasMaxLength(128)
|
||||
.HasColumnType("citext")
|
||||
.HasColumnName("slug");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_team");
|
||||
|
||||
b.HasIndex("Slug")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_team_slug")
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
b.ToTable("team", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.TeamMembership", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<Guid?>("InvitedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("invited_by_user_id");
|
||||
|
||||
b.Property<DateTimeOffset?>("JoinedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("joined_at_utc");
|
||||
|
||||
b.Property<int>("Role")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("role");
|
||||
|
||||
b.Property<int>("Status")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("status");
|
||||
|
||||
b.Property<Guid>("TeamId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("team_id");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_team_membership");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.HasDatabaseName("ix_team_membership_user_id");
|
||||
|
||||
b.HasIndex("TeamId", "UserId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_team_membership_team_id_user_id")
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
b.ToTable("team_membership", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserAccount", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<string>("DisplayName")
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("display_name");
|
||||
|
||||
b.Property<string>("Email")
|
||||
.HasMaxLength(320)
|
||||
.HasColumnType("citext")
|
||||
.HasColumnName("email");
|
||||
|
||||
b.Property<DateTimeOffset?>("EnrolledAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("enrolled_at_utc");
|
||||
|
||||
b.Property<string>("Issuer")
|
||||
.IsRequired()
|
||||
.HasMaxLength(512)
|
||||
.HasColumnType("character varying(512)")
|
||||
.HasColumnName("issuer");
|
||||
|
||||
b.Property<DateTimeOffset?>("LastSeenAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("last_seen_at_utc");
|
||||
|
||||
b.Property<int>("Status")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("status");
|
||||
|
||||
b.Property<string>("Subject")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("subject");
|
||||
|
||||
b.Property<DateTimeOffset>("UpdatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("updated_at_utc");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_user_account");
|
||||
|
||||
b.HasIndex("Email")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_account_email")
|
||||
.HasFilter("email IS NOT NULL AND deleted_at_utc IS NULL");
|
||||
|
||||
b.HasIndex("Issuer", "Subject")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_account_issuer_subject");
|
||||
|
||||
b.ToTable("user_account", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKey", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<byte[]>("EncryptionPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("encryption_public_key");
|
||||
|
||||
b.Property<byte[]>("FingerprintSha256")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("fingerprint_sha256");
|
||||
|
||||
b.Property<int>("Generation")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("generation");
|
||||
|
||||
b.Property<string>("IdentityProviderBinding")
|
||||
.HasColumnType("jsonb")
|
||||
.HasColumnName("identity_provider_binding");
|
||||
|
||||
b.Property<bool>("IsCurrent")
|
||||
.HasColumnType("boolean")
|
||||
.HasColumnName("is_current");
|
||||
|
||||
b.Property<DateTimeOffset?>("RevokedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("revoked_at_utc");
|
||||
|
||||
b.Property<byte[]>("SigningPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("signing_public_key");
|
||||
|
||||
b.Property<string>("Statement")
|
||||
.IsRequired()
|
||||
.HasColumnType("jsonb")
|
||||
.HasColumnName("statement");
|
||||
|
||||
b.Property<byte[]>("StatementSignature")
|
||||
.IsRequired()
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("statement_signature");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_user_key");
|
||||
|
||||
b.HasIndex("FingerprintSha256")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_fingerprint_sha256");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_current")
|
||||
.HasFilter("is_current");
|
||||
|
||||
b.HasIndex("UserId", "Generation")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_user_id_generation");
|
||||
|
||||
b.ToTable("user_key", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKeyWrap", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<Guid?>("DeviceId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("device_id");
|
||||
|
||||
b.Property<string>("KdfAlgorithm")
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("character varying(64)")
|
||||
.HasColumnName("kdf_algorithm");
|
||||
|
||||
b.Property<int?>("KdfMemoryKibibytes")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kdf_memory_kibibytes");
|
||||
|
||||
b.Property<int?>("KdfParallelism")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kdf_parallelism");
|
||||
|
||||
b.Property<int?>("KdfPasses")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kdf_passes");
|
||||
|
||||
b.Property<byte[]>("KdfSalt")
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("kdf_salt");
|
||||
|
||||
b.Property<int>("Kind")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kind");
|
||||
|
||||
b.Property<DateTimeOffset?>("LastUsedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("last_used_at_utc");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.Property<byte[]>("Wrap")
|
||||
.IsRequired()
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("wrap");
|
||||
|
||||
b.Property<int>("WrapVersion")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("wrap_version");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_user_key_wrap");
|
||||
|
||||
b.HasIndex("DeviceId")
|
||||
.HasDatabaseName("ix_user_key_wrap_device_id");
|
||||
|
||||
b.HasIndex("UserId", "DeviceId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_wrap_user_device")
|
||||
.HasFilter("device_id IS NOT NULL");
|
||||
|
||||
b.HasIndex("UserId", "Kind")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_wrap_user_kind")
|
||||
.HasFilter("device_id IS NULL");
|
||||
|
||||
b.ToTable("user_key_wrap", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_user_key_wrap_device", "(kind = 2 AND device_id IS NOT NULL) OR (kind <> 2 AND device_id IS NULL)");
|
||||
|
||||
t.HasCheckConstraint("ck_user_key_wrap_kdf", "(kind IN (1, 3) AND kdf_algorithm IS NOT NULL AND kdf_salt IS NOT NULL\n AND kdf_memory_kibibytes IS NOT NULL AND kdf_passes IS NOT NULL\n AND kdf_parallelism IS NOT NULL)\nOR (kind IN (2, 4) AND kdf_algorithm IS NULL AND kdf_salt IS NULL)");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Vault", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<int>("KeyGeneration")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("key_generation");
|
||||
|
||||
b.Property<string>("Name")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("name");
|
||||
|
||||
b.Property<int>("OwnerKind")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("owner_kind");
|
||||
|
||||
b.Property<Guid?>("OwnerUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("owner_user_id");
|
||||
|
||||
b.Property<int>("RekeyReason")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("rekey_reason");
|
||||
|
||||
b.Property<bool>("RekeyRequired")
|
||||
.HasColumnType("boolean")
|
||||
.HasColumnName("rekey_required");
|
||||
|
||||
b.Property<Guid?>("TeamId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("team_id");
|
||||
|
||||
b.Property<DateTimeOffset>("UpdatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("updated_at_utc");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_vault");
|
||||
|
||||
b.HasIndex("OwnerUserId")
|
||||
.HasDatabaseName("ix_vault_owner_user_id");
|
||||
|
||||
b.HasIndex("TeamId")
|
||||
.HasDatabaseName("ix_vault_team_id");
|
||||
|
||||
b.ToTable("vault", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_vault_key_generation", "key_generation >= 1");
|
||||
|
||||
t.HasCheckConstraint("ck_vault_owner", "(owner_kind = 1 AND owner_user_id IS NOT NULL AND team_id IS NULL)\nOR (owner_kind = 2 AND team_id IS NOT NULL AND owner_user_id IS NULL)");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.VaultKeyGrant", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<byte[]>("GranterKeyFingerprint")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("granter_key_fingerprint");
|
||||
|
||||
b.Property<Guid>("GranterUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("granter_user_id");
|
||||
|
||||
b.Property<int>("KeyGeneration")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("key_generation");
|
||||
|
||||
b.Property<byte[]>("KeyLogHead")
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("key_log_head");
|
||||
|
||||
b.Property<int>("Kind")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kind");
|
||||
|
||||
b.Property<byte[]>("RecipientKeyFingerprint")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("recipient_key_fingerprint");
|
||||
|
||||
b.Property<Guid?>("RecipientUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("recipient_user_id");
|
||||
|
||||
b.Property<DateTimeOffset?>("RevokedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("revoked_at_utc");
|
||||
|
||||
b.Property<byte[]>("Signature")
|
||||
.IsRequired()
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("signature");
|
||||
|
||||
b.Property<int>("State")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("state");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.Property<byte[]>("WrappedKey")
|
||||
.IsRequired()
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("wrapped_key");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_vault_key_grant");
|
||||
|
||||
b.HasIndex("RecipientUserId")
|
||||
.HasDatabaseName("ix_vault_key_grant_recipient_user_id");
|
||||
|
||||
b.HasIndex("VaultId", "KeyGeneration", "RecipientUserId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_vault_key_grant_vault_id_key_generation_recipient_user_id")
|
||||
.HasFilter("revoked_at_utc IS NULL AND recipient_user_id IS NOT NULL");
|
||||
|
||||
b.ToTable("vault_key_grant", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_vault_key_grant_recipient", "(kind = 1 AND recipient_user_id IS NOT NULL) OR (kind <> 1 AND recipient_user_id IS NULL)");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Device", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany("Devices")
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_device_users_user_id");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Host", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.Vault", "Vault")
|
||||
.WithMany("Hosts")
|
||||
.HasForeignKey("VaultId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_host_vaults_vault_id");
|
||||
|
||||
b.Navigation("Vault");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.TeamMembership", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.Team", "Team")
|
||||
.WithMany("Memberships")
|
||||
.HasForeignKey("TeamId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_team_membership_team_team_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany()
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_team_membership_users_user_id");
|
||||
|
||||
b.Navigation("Team");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKey", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany("Keys")
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_user_key_user_account_user_id");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKeyWrap", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.Device", "Device")
|
||||
.WithMany()
|
||||
.HasForeignKey("DeviceId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.HasConstraintName("fk_user_key_wrap_device_device_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany("KeyWraps")
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_user_key_wrap_user_account_user_id");
|
||||
|
||||
b.Navigation("Device");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Vault", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "OwnerUser")
|
||||
.WithMany()
|
||||
.HasForeignKey("OwnerUserId")
|
||||
.OnDelete(DeleteBehavior.Restrict)
|
||||
.HasConstraintName("fk_vault_user_account_owner_user_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.Team", "Team")
|
||||
.WithMany()
|
||||
.HasForeignKey("TeamId")
|
||||
.OnDelete(DeleteBehavior.Restrict)
|
||||
.HasConstraintName("fk_vault_team_team_id");
|
||||
|
||||
b.Navigation("OwnerUser");
|
||||
|
||||
b.Navigation("Team");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.VaultKeyGrant", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "RecipientUser")
|
||||
.WithMany()
|
||||
.HasForeignKey("RecipientUserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.HasConstraintName("fk_vault_key_grant_user_account_recipient_user_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.Vault", "Vault")
|
||||
.WithMany("KeyGrants")
|
||||
.HasForeignKey("VaultId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_vault_key_grant_vault_vault_id");
|
||||
|
||||
b.Navigation("RecipientUser");
|
||||
|
||||
b.Navigation("Vault");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Team", b =>
|
||||
{
|
||||
b.Navigation("Memberships");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserAccount", b =>
|
||||
{
|
||||
b.Navigation("Devices");
|
||||
|
||||
b.Navigation("KeyWraps");
|
||||
|
||||
b.Navigation("Keys");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Vault", b =>
|
||||
{
|
||||
b.Navigation("Hosts");
|
||||
|
||||
b.Navigation("KeyGrants");
|
||||
});
|
||||
#pragma warning restore 612, 618
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,583 @@
|
||||
using System;
|
||||
using Microsoft.EntityFrameworkCore.Migrations;
|
||||
using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
|
||||
|
||||
#nullable disable
|
||||
|
||||
namespace DodoSSH.Infrastructure.Migrations
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public partial class InitialSchema : Migration
|
||||
{
|
||||
/// <inheritdoc />
|
||||
protected override void Up(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.EnsureSchema(
|
||||
name: "dodo");
|
||||
|
||||
migrationBuilder.AlterDatabase()
|
||||
.Annotation("Npgsql:PostgresExtension:citext", ",,");
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "key_log",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
sequence = table.Column<long>(type: "bigint", nullable: false)
|
||||
.Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityAlwaysColumn),
|
||||
user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
generation = table.Column<int>(type: "integer", nullable: false),
|
||||
encryption_public_key = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
signing_public_key = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
statement_signature = table.Column<byte[]>(type: "bytea", maxLength: 64, nullable: false),
|
||||
previous_hash = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
hash = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_key_log", x => x.sequence);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "sync_change",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
sequence = table.Column<long>(type: "bigint", nullable: false)
|
||||
.Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityAlwaysColumn),
|
||||
vault_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
entity_type = table.Column<int>(type: "integer", nullable: false),
|
||||
entity_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
operation = table.Column<int>(type: "integer", nullable: false),
|
||||
revision = table.Column<int>(type: "integer", nullable: false),
|
||||
actor_user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
occurred_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_sync_change", x => x.sequence);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "sync_operation_receipt",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
operation_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
vault_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
applied_change_sequence = table.Column<long>(type: "bigint", nullable: true),
|
||||
result_version = table.Column<int>(type: "integer", nullable: true),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_sync_operation_receipt", x => x.operation_id);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "team",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: false),
|
||||
slug = table.Column<string>(type: "citext", maxLength: 128, nullable: false),
|
||||
description = table.Column<string>(type: "character varying(2048)", maxLength: 2048, nullable: true),
|
||||
created_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_team", x => x.id);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "user_account",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
issuer = table.Column<string>(type: "character varying(512)", maxLength: 512, nullable: false),
|
||||
subject = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: false),
|
||||
email = table.Column<string>(type: "citext", maxLength: 320, nullable: true),
|
||||
display_name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
|
||||
status = table.Column<int>(type: "integer", nullable: false),
|
||||
enrolled_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
updated_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
last_seen_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_user_account", x => x.id);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "device",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: false),
|
||||
platform = table.Column<int>(type: "integer", nullable: false),
|
||||
public_key = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
enrolled_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
last_seen_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
revoked_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_device", x => x.id);
|
||||
table.ForeignKey(
|
||||
name: "fk_device_users_user_id",
|
||||
column: x => x.user_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "user_account",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "team_membership",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
team_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
role = table.Column<int>(type: "integer", nullable: false),
|
||||
status = table.Column<int>(type: "integer", nullable: false),
|
||||
invited_by_user_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
joined_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_team_membership", x => x.id);
|
||||
table.ForeignKey(
|
||||
name: "fk_team_membership_team_team_id",
|
||||
column: x => x.team_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "team",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
table.ForeignKey(
|
||||
name: "fk_team_membership_users_user_id",
|
||||
column: x => x.user_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "user_account",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "user_key",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
generation = table.Column<int>(type: "integer", nullable: false),
|
||||
encryption_public_key = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
signing_public_key = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
fingerprint_sha256 = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
statement = table.Column<string>(type: "jsonb", nullable: false),
|
||||
statement_signature = table.Column<byte[]>(type: "bytea", maxLength: 64, nullable: false),
|
||||
identity_provider_binding = table.Column<string>(type: "jsonb", nullable: true),
|
||||
is_current = table.Column<bool>(type: "boolean", nullable: false),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
revoked_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_user_key", x => x.id);
|
||||
table.ForeignKey(
|
||||
name: "fk_user_key_user_account_user_id",
|
||||
column: x => x.user_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "user_account",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "vault",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: false),
|
||||
owner_kind = table.Column<int>(type: "integer", nullable: false),
|
||||
owner_user_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
team_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
key_generation = table.Column<int>(type: "integer", nullable: false),
|
||||
rekey_required = table.Column<bool>(type: "boolean", nullable: false),
|
||||
rekey_reason = table.Column<int>(type: "integer", nullable: false),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
updated_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_vault", x => x.id);
|
||||
table.CheckConstraint("ck_vault_key_generation", "key_generation >= 1");
|
||||
table.CheckConstraint("ck_vault_owner", "(owner_kind = 1 AND owner_user_id IS NOT NULL AND team_id IS NULL)\nOR (owner_kind = 2 AND team_id IS NOT NULL AND owner_user_id IS NULL)");
|
||||
table.ForeignKey(
|
||||
name: "fk_vault_team_team_id",
|
||||
column: x => x.team_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "team",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Restrict);
|
||||
table.ForeignKey(
|
||||
name: "fk_vault_user_account_owner_user_id",
|
||||
column: x => x.owner_user_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "user_account",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Restrict);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "user_key_wrap",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
kind = table.Column<int>(type: "integer", nullable: false),
|
||||
device_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
wrap = table.Column<byte[]>(type: "bytea", nullable: false),
|
||||
wrap_version = table.Column<int>(type: "integer", nullable: false),
|
||||
kdf_algorithm = table.Column<string>(type: "character varying(64)", maxLength: 64, nullable: true),
|
||||
kdf_salt = table.Column<byte[]>(type: "bytea", maxLength: 64, nullable: true),
|
||||
kdf_memory_kibibytes = table.Column<int>(type: "integer", nullable: true),
|
||||
kdf_passes = table.Column<int>(type: "integer", nullable: true),
|
||||
kdf_parallelism = table.Column<int>(type: "integer", nullable: true),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
last_used_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_user_key_wrap", x => x.id);
|
||||
table.CheckConstraint("ck_user_key_wrap_device", "(kind = 2 AND device_id IS NOT NULL) OR (kind <> 2 AND device_id IS NULL)");
|
||||
table.CheckConstraint("ck_user_key_wrap_kdf", "(kind IN (1, 3) AND kdf_algorithm IS NOT NULL AND kdf_salt IS NOT NULL\n AND kdf_memory_kibibytes IS NOT NULL AND kdf_passes IS NOT NULL\n AND kdf_parallelism IS NOT NULL)\nOR (kind IN (2, 4) AND kdf_algorithm IS NULL AND kdf_salt IS NULL)");
|
||||
table.ForeignKey(
|
||||
name: "fk_user_key_wrap_device_device_id",
|
||||
column: x => x.device_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "device",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
table.ForeignKey(
|
||||
name: "fk_user_key_wrap_user_account_user_id",
|
||||
column: x => x.user_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "user_account",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "host",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
vault_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
payload = table.Column<byte[]>(type: "bytea", nullable: false),
|
||||
data_key_wrap = table.Column<byte[]>(type: "bytea", nullable: true),
|
||||
content_key_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
key_generation = table.Column<int>(type: "integer", nullable: false),
|
||||
payload_aad_version = table.Column<short>(type: "smallint", nullable: false),
|
||||
relay_enabled = table.Column<bool>(type: "boolean", nullable: false),
|
||||
hostname = table.Column<string>(type: "character varying(255)", maxLength: 255, nullable: true),
|
||||
port = table.Column<int>(type: "integer", nullable: true),
|
||||
group_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
version = table.Column<int>(type: "integer", nullable: false),
|
||||
change_sequence = table.Column<long>(type: "bigint", nullable: false),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
updated_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
created_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
updated_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_host", x => x.id);
|
||||
table.CheckConstraint("ck_host_port_range", "port IS NULL OR (port BETWEEN 1 AND 65535)");
|
||||
table.CheckConstraint("ck_host_relay_target", "(relay_enabled AND hostname IS NOT NULL AND port IS NOT NULL)\nOR (NOT relay_enabled AND hostname IS NULL AND port IS NULL)");
|
||||
table.CheckConstraint("ck_host_version", "version >= 1");
|
||||
table.ForeignKey(
|
||||
name: "fk_host_vaults_vault_id",
|
||||
column: x => x.vault_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "vault",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateTable(
|
||||
name: "vault_key_grant",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
vault_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
key_generation = table.Column<int>(type: "integer", nullable: false),
|
||||
kind = table.Column<int>(type: "integer", nullable: false),
|
||||
recipient_user_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
recipient_key_fingerprint = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
wrapped_key = table.Column<byte[]>(type: "bytea", nullable: false),
|
||||
granter_user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
granter_key_fingerprint = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: false),
|
||||
key_log_head = table.Column<byte[]>(type: "bytea", maxLength: 32, nullable: true),
|
||||
signature = table.Column<byte[]>(type: "bytea", maxLength: 64, nullable: false),
|
||||
state = table.Column<int>(type: "integer", nullable: false),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
revoked_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_vault_key_grant", x => x.id);
|
||||
table.CheckConstraint("ck_vault_key_grant_recipient", "(kind = 1 AND recipient_user_id IS NOT NULL) OR (kind <> 1 AND recipient_user_id IS NULL)");
|
||||
table.ForeignKey(
|
||||
name: "fk_vault_key_grant_user_account_recipient_user_id",
|
||||
column: x => x.recipient_user_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "user_account",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
table.ForeignKey(
|
||||
name: "fk_vault_key_grant_vault_vault_id",
|
||||
column: x => x.vault_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "vault",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_device_user_id",
|
||||
schema: "dodo",
|
||||
table: "device",
|
||||
column: "user_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_host_vault_id_change_sequence",
|
||||
schema: "dodo",
|
||||
table: "host",
|
||||
columns: new[] { "vault_id", "change_sequence" });
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_host_vault_live",
|
||||
schema: "dodo",
|
||||
table: "host",
|
||||
column: "vault_id",
|
||||
filter: "deleted_at_utc IS NULL");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_key_log_hash",
|
||||
schema: "dodo",
|
||||
table: "key_log",
|
||||
column: "hash",
|
||||
unique: true);
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_key_log_user_id",
|
||||
schema: "dodo",
|
||||
table: "key_log",
|
||||
column: "user_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_sync_change_vault_id_entity_id_sequence",
|
||||
schema: "dodo",
|
||||
table: "sync_change",
|
||||
columns: new[] { "vault_id", "entity_id", "sequence" },
|
||||
descending: new[] { false, false, true });
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_sync_change_vault_id_sequence",
|
||||
schema: "dodo",
|
||||
table: "sync_change",
|
||||
columns: new[] { "vault_id", "sequence" });
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_sync_operation_receipt_vault_id_created_at_utc",
|
||||
schema: "dodo",
|
||||
table: "sync_operation_receipt",
|
||||
columns: new[] { "vault_id", "created_at_utc" });
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_team_slug",
|
||||
schema: "dodo",
|
||||
table: "team",
|
||||
column: "slug",
|
||||
unique: true,
|
||||
filter: "deleted_at_utc IS NULL");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_team_membership_team_id_user_id",
|
||||
schema: "dodo",
|
||||
table: "team_membership",
|
||||
columns: new[] { "team_id", "user_id" },
|
||||
unique: true,
|
||||
filter: "deleted_at_utc IS NULL");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_team_membership_user_id",
|
||||
schema: "dodo",
|
||||
table: "team_membership",
|
||||
column: "user_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_account_email",
|
||||
schema: "dodo",
|
||||
table: "user_account",
|
||||
column: "email",
|
||||
unique: true,
|
||||
filter: "email IS NOT NULL AND deleted_at_utc IS NULL");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_account_issuer_subject",
|
||||
schema: "dodo",
|
||||
table: "user_account",
|
||||
columns: new[] { "issuer", "subject" },
|
||||
unique: true);
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_key_current",
|
||||
schema: "dodo",
|
||||
table: "user_key",
|
||||
column: "user_id",
|
||||
unique: true,
|
||||
filter: "is_current");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_key_fingerprint_sha256",
|
||||
schema: "dodo",
|
||||
table: "user_key",
|
||||
column: "fingerprint_sha256",
|
||||
unique: true);
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_key_user_id_generation",
|
||||
schema: "dodo",
|
||||
table: "user_key",
|
||||
columns: new[] { "user_id", "generation" },
|
||||
unique: true);
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_key_wrap_device_id",
|
||||
schema: "dodo",
|
||||
table: "user_key_wrap",
|
||||
column: "device_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_key_wrap_user_device",
|
||||
schema: "dodo",
|
||||
table: "user_key_wrap",
|
||||
columns: new[] { "user_id", "device_id" },
|
||||
unique: true,
|
||||
filter: "device_id IS NOT NULL");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_user_key_wrap_user_kind",
|
||||
schema: "dodo",
|
||||
table: "user_key_wrap",
|
||||
columns: new[] { "user_id", "kind" },
|
||||
unique: true,
|
||||
filter: "device_id IS NULL");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_vault_owner_user_id",
|
||||
schema: "dodo",
|
||||
table: "vault",
|
||||
column: "owner_user_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_vault_team_id",
|
||||
schema: "dodo",
|
||||
table: "vault",
|
||||
column: "team_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_vault_key_grant_recipient_user_id",
|
||||
schema: "dodo",
|
||||
table: "vault_key_grant",
|
||||
column: "recipient_user_id");
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_vault_key_grant_vault_id_key_generation_recipient_user_id",
|
||||
schema: "dodo",
|
||||
table: "vault_key_grant",
|
||||
columns: new[] { "vault_id", "key_generation", "recipient_user_id" },
|
||||
unique: true,
|
||||
filter: "revoked_at_utc IS NULL AND recipient_user_id IS NOT NULL");
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void Down(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.DropTable(
|
||||
name: "host",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "key_log",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "sync_change",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "sync_operation_receipt",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "team_membership",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "user_key",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "user_key_wrap",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "vault_key_grant",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "device",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "vault",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "team",
|
||||
schema: "dodo");
|
||||
|
||||
migrationBuilder.DropTable(
|
||||
name: "user_account",
|
||||
schema: "dodo");
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,968 @@
|
||||
// <auto-generated />
|
||||
using System;
|
||||
using DodoSSH.Infrastructure;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Infrastructure;
|
||||
using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
|
||||
using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
|
||||
|
||||
#nullable disable
|
||||
|
||||
namespace DodoSSH.Infrastructure.Migrations
|
||||
{
|
||||
[DbContext(typeof(DodoDbContext))]
|
||||
partial class DodoDbContextModelSnapshot : ModelSnapshot
|
||||
{
|
||||
protected override void BuildModel(ModelBuilder modelBuilder)
|
||||
{
|
||||
#pragma warning disable 612, 618
|
||||
modelBuilder
|
||||
.HasDefaultSchema("dodo")
|
||||
.HasAnnotation("ProductVersion", "10.0.10")
|
||||
.HasAnnotation("Relational:MaxIdentifierLength", 63);
|
||||
|
||||
NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "citext");
|
||||
NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Device", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("EnrolledAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("enrolled_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("LastSeenAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("last_seen_at_utc");
|
||||
|
||||
b.Property<string>("Name")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("name");
|
||||
|
||||
b.Property<int>("Platform")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("platform");
|
||||
|
||||
b.Property<byte[]>("PublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("public_key");
|
||||
|
||||
b.Property<DateTimeOffset?>("RevokedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("revoked_at_utc");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_device");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.HasDatabaseName("ix_device_user_id");
|
||||
|
||||
b.ToTable("device", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Host", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<long>("ChangeSequence")
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("change_sequence");
|
||||
|
||||
b.Property<Guid?>("ContentKeyId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("content_key_id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<Guid>("CreatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("created_by_user_id");
|
||||
|
||||
b.Property<byte[]>("DataKeyWrap")
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("data_key_wrap");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<Guid?>("GroupId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("group_id");
|
||||
|
||||
b.Property<string>("Hostname")
|
||||
.HasMaxLength(255)
|
||||
.HasColumnType("character varying(255)")
|
||||
.HasColumnName("hostname");
|
||||
|
||||
b.Property<int>("KeyGeneration")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("key_generation");
|
||||
|
||||
b.Property<byte[]>("Payload")
|
||||
.IsRequired()
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("payload");
|
||||
|
||||
b.Property<short>("PayloadAadVersion")
|
||||
.HasColumnType("smallint")
|
||||
.HasColumnName("payload_aad_version");
|
||||
|
||||
b.Property<int?>("Port")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("port");
|
||||
|
||||
b.Property<bool>("RelayEnabled")
|
||||
.HasColumnType("boolean")
|
||||
.HasColumnName("relay_enabled");
|
||||
|
||||
b.Property<DateTimeOffset>("UpdatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("updated_at_utc");
|
||||
|
||||
b.Property<Guid>("UpdatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("updated_by_user_id");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.Property<int>("Version")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("version");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_host");
|
||||
|
||||
b.HasIndex("VaultId")
|
||||
.HasDatabaseName("ix_host_vault_live")
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
b.HasIndex("VaultId", "ChangeSequence")
|
||||
.HasDatabaseName("ix_host_vault_id_change_sequence");
|
||||
|
||||
b.ToTable("host", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_host_port_range", "port IS NULL OR (port BETWEEN 1 AND 65535)");
|
||||
|
||||
t.HasCheckConstraint("ck_host_relay_target", "(relay_enabled AND hostname IS NOT NULL AND port IS NOT NULL)\nOR (NOT relay_enabled AND hostname IS NULL AND port IS NULL)");
|
||||
|
||||
t.HasCheckConstraint("ck_host_version", "version >= 1");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.KeyLogEntry", b =>
|
||||
{
|
||||
b.Property<long>("Sequence")
|
||||
.ValueGeneratedOnAdd()
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("sequence");
|
||||
|
||||
NpgsqlPropertyBuilderExtensions.UseIdentityAlwaysColumn(b.Property<long>("Sequence"));
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<byte[]>("EncryptionPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("encryption_public_key");
|
||||
|
||||
b.Property<int>("Generation")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("generation");
|
||||
|
||||
b.Property<byte[]>("Hash")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("hash");
|
||||
|
||||
b.Property<byte[]>("PreviousHash")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("previous_hash");
|
||||
|
||||
b.Property<byte[]>("SigningPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("signing_public_key");
|
||||
|
||||
b.Property<byte[]>("StatementSignature")
|
||||
.IsRequired()
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("statement_signature");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.HasKey("Sequence")
|
||||
.HasName("pk_key_log");
|
||||
|
||||
b.HasIndex("Hash")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_key_log_hash");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.HasDatabaseName("ix_key_log_user_id");
|
||||
|
||||
b.ToTable("key_log", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.SyncChange", b =>
|
||||
{
|
||||
b.Property<long>("Sequence")
|
||||
.ValueGeneratedOnAdd()
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("sequence");
|
||||
|
||||
NpgsqlPropertyBuilderExtensions.UseIdentityAlwaysColumn(b.Property<long>("Sequence"));
|
||||
|
||||
b.Property<Guid>("ActorUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("actor_user_id");
|
||||
|
||||
b.Property<Guid>("EntityId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("entity_id");
|
||||
|
||||
b.Property<int>("EntityType")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("entity_type");
|
||||
|
||||
b.Property<DateTimeOffset>("OccurredAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("occurred_at_utc");
|
||||
|
||||
b.Property<int>("Operation")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("operation");
|
||||
|
||||
b.Property<int>("Revision")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("revision");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.HasKey("Sequence")
|
||||
.HasName("pk_sync_change");
|
||||
|
||||
b.HasIndex("VaultId", "Sequence")
|
||||
.HasDatabaseName("ix_sync_change_vault_id_sequence");
|
||||
|
||||
b.HasIndex("VaultId", "EntityId", "Sequence")
|
||||
.IsDescending(false, false, true)
|
||||
.HasDatabaseName("ix_sync_change_vault_id_entity_id_sequence");
|
||||
|
||||
b.ToTable("sync_change", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.SyncOperationReceipt", b =>
|
||||
{
|
||||
b.Property<Guid>("OperationId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("operation_id");
|
||||
|
||||
b.Property<long?>("AppliedChangeSequence")
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("applied_change_sequence");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<int?>("ResultVersion")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("result_version");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.HasKey("OperationId")
|
||||
.HasName("pk_sync_operation_receipt");
|
||||
|
||||
b.HasIndex("VaultId", "CreatedAtUtc")
|
||||
.HasDatabaseName("ix_sync_operation_receipt_vault_id_created_at_utc");
|
||||
|
||||
b.ToTable("sync_operation_receipt", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Team", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<Guid>("CreatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("created_by_user_id");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<string>("Description")
|
||||
.HasMaxLength(2048)
|
||||
.HasColumnType("character varying(2048)")
|
||||
.HasColumnName("description");
|
||||
|
||||
b.Property<string>("Name")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("name");
|
||||
|
||||
b.Property<string>("Slug")
|
||||
.IsRequired()
|
||||
.HasMaxLength(128)
|
||||
.HasColumnType("citext")
|
||||
.HasColumnName("slug");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_team");
|
||||
|
||||
b.HasIndex("Slug")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_team_slug")
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
b.ToTable("team", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.TeamMembership", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<Guid?>("InvitedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("invited_by_user_id");
|
||||
|
||||
b.Property<DateTimeOffset?>("JoinedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("joined_at_utc");
|
||||
|
||||
b.Property<int>("Role")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("role");
|
||||
|
||||
b.Property<int>("Status")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("status");
|
||||
|
||||
b.Property<Guid>("TeamId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("team_id");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_team_membership");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.HasDatabaseName("ix_team_membership_user_id");
|
||||
|
||||
b.HasIndex("TeamId", "UserId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_team_membership_team_id_user_id")
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
b.ToTable("team_membership", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserAccount", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<string>("DisplayName")
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("display_name");
|
||||
|
||||
b.Property<string>("Email")
|
||||
.HasMaxLength(320)
|
||||
.HasColumnType("citext")
|
||||
.HasColumnName("email");
|
||||
|
||||
b.Property<DateTimeOffset?>("EnrolledAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("enrolled_at_utc");
|
||||
|
||||
b.Property<string>("Issuer")
|
||||
.IsRequired()
|
||||
.HasMaxLength(512)
|
||||
.HasColumnType("character varying(512)")
|
||||
.HasColumnName("issuer");
|
||||
|
||||
b.Property<DateTimeOffset?>("LastSeenAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("last_seen_at_utc");
|
||||
|
||||
b.Property<int>("Status")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("status");
|
||||
|
||||
b.Property<string>("Subject")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("subject");
|
||||
|
||||
b.Property<DateTimeOffset>("UpdatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("updated_at_utc");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_user_account");
|
||||
|
||||
b.HasIndex("Email")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_account_email")
|
||||
.HasFilter("email IS NOT NULL AND deleted_at_utc IS NULL");
|
||||
|
||||
b.HasIndex("Issuer", "Subject")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_account_issuer_subject");
|
||||
|
||||
b.ToTable("user_account", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKey", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<byte[]>("EncryptionPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("encryption_public_key");
|
||||
|
||||
b.Property<byte[]>("FingerprintSha256")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("fingerprint_sha256");
|
||||
|
||||
b.Property<int>("Generation")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("generation");
|
||||
|
||||
b.Property<string>("IdentityProviderBinding")
|
||||
.HasColumnType("jsonb")
|
||||
.HasColumnName("identity_provider_binding");
|
||||
|
||||
b.Property<bool>("IsCurrent")
|
||||
.HasColumnType("boolean")
|
||||
.HasColumnName("is_current");
|
||||
|
||||
b.Property<DateTimeOffset?>("RevokedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("revoked_at_utc");
|
||||
|
||||
b.Property<byte[]>("SigningPublicKey")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("signing_public_key");
|
||||
|
||||
b.Property<string>("Statement")
|
||||
.IsRequired()
|
||||
.HasColumnType("jsonb")
|
||||
.HasColumnName("statement");
|
||||
|
||||
b.Property<byte[]>("StatementSignature")
|
||||
.IsRequired()
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("statement_signature");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_user_key");
|
||||
|
||||
b.HasIndex("FingerprintSha256")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_fingerprint_sha256");
|
||||
|
||||
b.HasIndex("UserId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_current")
|
||||
.HasFilter("is_current");
|
||||
|
||||
b.HasIndex("UserId", "Generation")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_user_id_generation");
|
||||
|
||||
b.ToTable("user_key", "dodo");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKeyWrap", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<Guid?>("DeviceId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("device_id");
|
||||
|
||||
b.Property<string>("KdfAlgorithm")
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("character varying(64)")
|
||||
.HasColumnName("kdf_algorithm");
|
||||
|
||||
b.Property<int?>("KdfMemoryKibibytes")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kdf_memory_kibibytes");
|
||||
|
||||
b.Property<int?>("KdfParallelism")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kdf_parallelism");
|
||||
|
||||
b.Property<int?>("KdfPasses")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kdf_passes");
|
||||
|
||||
b.Property<byte[]>("KdfSalt")
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("kdf_salt");
|
||||
|
||||
b.Property<int>("Kind")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kind");
|
||||
|
||||
b.Property<DateTimeOffset?>("LastUsedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("last_used_at_utc");
|
||||
|
||||
b.Property<Guid>("UserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("user_id");
|
||||
|
||||
b.Property<byte[]>("Wrap")
|
||||
.IsRequired()
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("wrap");
|
||||
|
||||
b.Property<int>("WrapVersion")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("wrap_version");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_user_key_wrap");
|
||||
|
||||
b.HasIndex("DeviceId")
|
||||
.HasDatabaseName("ix_user_key_wrap_device_id");
|
||||
|
||||
b.HasIndex("UserId", "DeviceId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_wrap_user_device")
|
||||
.HasFilter("device_id IS NOT NULL");
|
||||
|
||||
b.HasIndex("UserId", "Kind")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_user_key_wrap_user_kind")
|
||||
.HasFilter("device_id IS NULL");
|
||||
|
||||
b.ToTable("user_key_wrap", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_user_key_wrap_device", "(kind = 2 AND device_id IS NOT NULL) OR (kind <> 2 AND device_id IS NULL)");
|
||||
|
||||
t.HasCheckConstraint("ck_user_key_wrap_kdf", "(kind IN (1, 3) AND kdf_algorithm IS NOT NULL AND kdf_salt IS NOT NULL\n AND kdf_memory_kibibytes IS NOT NULL AND kdf_passes IS NOT NULL\n AND kdf_parallelism IS NOT NULL)\nOR (kind IN (2, 4) AND kdf_algorithm IS NULL AND kdf_salt IS NULL)");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Vault", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<int>("KeyGeneration")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("key_generation");
|
||||
|
||||
b.Property<string>("Name")
|
||||
.IsRequired()
|
||||
.HasMaxLength(256)
|
||||
.HasColumnType("character varying(256)")
|
||||
.HasColumnName("name");
|
||||
|
||||
b.Property<int>("OwnerKind")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("owner_kind");
|
||||
|
||||
b.Property<Guid?>("OwnerUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("owner_user_id");
|
||||
|
||||
b.Property<int>("RekeyReason")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("rekey_reason");
|
||||
|
||||
b.Property<bool>("RekeyRequired")
|
||||
.HasColumnType("boolean")
|
||||
.HasColumnName("rekey_required");
|
||||
|
||||
b.Property<Guid?>("TeamId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("team_id");
|
||||
|
||||
b.Property<DateTimeOffset>("UpdatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("updated_at_utc");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_vault");
|
||||
|
||||
b.HasIndex("OwnerUserId")
|
||||
.HasDatabaseName("ix_vault_owner_user_id");
|
||||
|
||||
b.HasIndex("TeamId")
|
||||
.HasDatabaseName("ix_vault_team_id");
|
||||
|
||||
b.ToTable("vault", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_vault_key_generation", "key_generation >= 1");
|
||||
|
||||
t.HasCheckConstraint("ck_vault_owner", "(owner_kind = 1 AND owner_user_id IS NOT NULL AND team_id IS NULL)\nOR (owner_kind = 2 AND team_id IS NOT NULL AND owner_user_id IS NULL)");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.VaultKeyGrant", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<byte[]>("GranterKeyFingerprint")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("granter_key_fingerprint");
|
||||
|
||||
b.Property<Guid>("GranterUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("granter_user_id");
|
||||
|
||||
b.Property<int>("KeyGeneration")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("key_generation");
|
||||
|
||||
b.Property<byte[]>("KeyLogHead")
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("key_log_head");
|
||||
|
||||
b.Property<int>("Kind")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("kind");
|
||||
|
||||
b.Property<byte[]>("RecipientKeyFingerprint")
|
||||
.IsRequired()
|
||||
.HasMaxLength(32)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("recipient_key_fingerprint");
|
||||
|
||||
b.Property<Guid?>("RecipientUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("recipient_user_id");
|
||||
|
||||
b.Property<DateTimeOffset?>("RevokedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("revoked_at_utc");
|
||||
|
||||
b.Property<byte[]>("Signature")
|
||||
.IsRequired()
|
||||
.HasMaxLength(64)
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("signature");
|
||||
|
||||
b.Property<int>("State")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("state");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.Property<byte[]>("WrappedKey")
|
||||
.IsRequired()
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("wrapped_key");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_vault_key_grant");
|
||||
|
||||
b.HasIndex("RecipientUserId")
|
||||
.HasDatabaseName("ix_vault_key_grant_recipient_user_id");
|
||||
|
||||
b.HasIndex("VaultId", "KeyGeneration", "RecipientUserId")
|
||||
.IsUnique()
|
||||
.HasDatabaseName("ix_vault_key_grant_vault_id_key_generation_recipient_user_id")
|
||||
.HasFilter("revoked_at_utc IS NULL AND recipient_user_id IS NOT NULL");
|
||||
|
||||
b.ToTable("vault_key_grant", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_vault_key_grant_recipient", "(kind = 1 AND recipient_user_id IS NOT NULL) OR (kind <> 1 AND recipient_user_id IS NULL)");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Device", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany("Devices")
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_device_users_user_id");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Host", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.Vault", "Vault")
|
||||
.WithMany("Hosts")
|
||||
.HasForeignKey("VaultId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_host_vaults_vault_id");
|
||||
|
||||
b.Navigation("Vault");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.TeamMembership", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.Team", "Team")
|
||||
.WithMany("Memberships")
|
||||
.HasForeignKey("TeamId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_team_membership_team_team_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany()
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_team_membership_users_user_id");
|
||||
|
||||
b.Navigation("Team");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKey", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany("Keys")
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_user_key_user_account_user_id");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserKeyWrap", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.Device", "Device")
|
||||
.WithMany()
|
||||
.HasForeignKey("DeviceId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.HasConstraintName("fk_user_key_wrap_device_device_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
.WithMany("KeyWraps")
|
||||
.HasForeignKey("UserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_user_key_wrap_user_account_user_id");
|
||||
|
||||
b.Navigation("Device");
|
||||
|
||||
b.Navigation("User");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Vault", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "OwnerUser")
|
||||
.WithMany()
|
||||
.HasForeignKey("OwnerUserId")
|
||||
.OnDelete(DeleteBehavior.Restrict)
|
||||
.HasConstraintName("fk_vault_user_account_owner_user_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.Team", "Team")
|
||||
.WithMany()
|
||||
.HasForeignKey("TeamId")
|
||||
.OnDelete(DeleteBehavior.Restrict)
|
||||
.HasConstraintName("fk_vault_team_team_id");
|
||||
|
||||
b.Navigation("OwnerUser");
|
||||
|
||||
b.Navigation("Team");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.VaultKeyGrant", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "RecipientUser")
|
||||
.WithMany()
|
||||
.HasForeignKey("RecipientUserId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.HasConstraintName("fk_vault_key_grant_user_account_recipient_user_id");
|
||||
|
||||
b.HasOne("DodoSSH.Domain.Vault", "Vault")
|
||||
.WithMany("KeyGrants")
|
||||
.HasForeignKey("VaultId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_vault_key_grant_vault_vault_id");
|
||||
|
||||
b.Navigation("RecipientUser");
|
||||
|
||||
b.Navigation("Vault");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Team", b =>
|
||||
{
|
||||
b.Navigation("Memberships");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.UserAccount", b =>
|
||||
{
|
||||
b.Navigation("Devices");
|
||||
|
||||
b.Navigation("KeyWraps");
|
||||
|
||||
b.Navigation("Keys");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Vault", b =>
|
||||
{
|
||||
b.Navigation("Hosts");
|
||||
|
||||
b.Navigation("KeyGrants");
|
||||
});
|
||||
#pragma warning restore 612, 618
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Metadata.Builders;
|
||||
|
||||
namespace DodoSSH.Infrastructure;
|
||||
|
||||
/// <summary>
|
||||
/// Maps PostgreSQL's <c>xmin</c> system column as an optimistic concurrency token.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Npgsql's <c>UseXminAsConcurrencyToken</c> helper no longer exists in EF 10, so the shadow
|
||||
/// property is configured directly here rather than repeated in every entity configuration.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <c>xmin</c> is a system column that PostgreSQL maintains, so it must never appear in a
|
||||
/// <c>CREATE TABLE</c>. That is what <see cref="RelationalPropertyBuilderExtensions.HasColumnName"/>
|
||||
/// combined with <c>ValueGeneratedOnAddOrUpdate</c> achieves; an
|
||||
/// <c>Infrastructure</c> test asserts the generated DDL does not declare it.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// This token is strictly internal. It is never exposed to clients: <c>xmin</c> is not stable
|
||||
/// across <c>VACUUM FREEZE</c>, so using it as a sync cursor would silently break. Client-visible
|
||||
/// versioning is the separate monotonic <c>Version</c> column on item rows.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public static class XminConcurrency
|
||||
{
|
||||
/// <summary>Name of the shadow property and of the PostgreSQL system column.</summary>
|
||||
public const string PropertyName = "xmin";
|
||||
|
||||
/// <summary>Configures <c>xmin</c> as this entity's concurrency token.</summary>
|
||||
public static EntityTypeBuilder<TEntity> UseXminConcurrencyToken<TEntity>(
|
||||
this EntityTypeBuilder<TEntity> builder)
|
||||
where TEntity : class
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.Property<uint>(PropertyName)
|
||||
.HasColumnName(PropertyName)
|
||||
.HasColumnType("xid")
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.IsConcurrencyToken();
|
||||
|
||||
return builder;
|
||||
}
|
||||
}
|
||||
@@ -2,6 +2,17 @@
|
||||
"version": 2,
|
||||
"dependencies": {
|
||||
"net10.0": {
|
||||
"EFCore.NamingConventions": {
|
||||
"type": "Direct",
|
||||
"requested": "[10.0.1, )",
|
||||
"resolved": "10.0.1",
|
||||
"contentHash": "Xs5k8XfNKPkkQSkGmZkmDI1je0prLTdxse+s8PgTFZxyBrlrTLzTBUTVJtQKSsbvu4y+luAv8DdtO5SALJE++A==",
|
||||
"dependencies": {
|
||||
"Microsoft.EntityFrameworkCore": "[10.0.1, 11.0.0)",
|
||||
"Microsoft.EntityFrameworkCore.Relational": "[10.0.1, 11.0.0)",
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.1"
|
||||
}
|
||||
},
|
||||
"Meziantou.Analyzer": {
|
||||
"type": "Direct",
|
||||
"requested": "[3.0.134, )",
|
||||
@@ -14,8 +25,305 @@
|
||||
"resolved": "5.6.0",
|
||||
"contentHash": "Kcobt3pnOdO0A+6CKiMHZdTEluJpsfxiV20axtZdmfBQnDmiWTKPJADlgAfdTuKNAnVarrkJa0UEGwuOo91muw=="
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore.Design": {
|
||||
"type": "Direct",
|
||||
"requested": "[10.0.10, )",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "BsvxiKcy8k4/ijAPitmwKG1mlVsdC2lQtFLP28K2N8PlsGYbqPFOyfJ7p2kWil3gM6xXgQGf8Hz/pJB8ej+Dug==",
|
||||
"dependencies": {
|
||||
"Humanizer.Core": "2.14.1",
|
||||
"Microsoft.Build.Framework": "18.0.2",
|
||||
"Microsoft.CodeAnalysis.CSharp": "5.0.0",
|
||||
"Microsoft.CodeAnalysis.CSharp.Workspaces": "5.0.0",
|
||||
"Microsoft.CodeAnalysis.Workspaces.MSBuild": "5.0.0",
|
||||
"Microsoft.EntityFrameworkCore.Relational": "10.0.10",
|
||||
"Microsoft.Extensions.Caching.Memory": "10.0.10",
|
||||
"Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
|
||||
"Microsoft.Extensions.DependencyModel": "10.0.10",
|
||||
"Microsoft.Extensions.Logging": "10.0.10",
|
||||
"Mono.TextTemplating": "3.0.0",
|
||||
"Newtonsoft.Json": "13.0.3"
|
||||
}
|
||||
},
|
||||
"Npgsql.EntityFrameworkCore.PostgreSQL": {
|
||||
"type": "Direct",
|
||||
"requested": "[10.0.3, )",
|
||||
"resolved": "10.0.3",
|
||||
"contentHash": "IPGrrZnRkuW7OlHDhUESZz4G5DLkW7Nej/O3Cx+0iTsgyU5XJxBgpsvTHLloo3WWuAKKbDHXBvWPVkX1deRh1Q==",
|
||||
"dependencies": {
|
||||
"Microsoft.EntityFrameworkCore": "[10.0.4, 11.0.0)",
|
||||
"Microsoft.EntityFrameworkCore.Relational": "[10.0.4, 11.0.0)",
|
||||
"Npgsql": "10.0.3"
|
||||
}
|
||||
},
|
||||
"Humanizer.Core": {
|
||||
"type": "Transitive",
|
||||
"resolved": "2.14.1",
|
||||
"contentHash": "lQKvtaTDOXnoVJ20ibTuSIOf2i0uO0MPbDhd1jm238I+U/2ZnRENj0cktKZhtchBMtCUSRQ5v4xBCUbKNmyVMw=="
|
||||
},
|
||||
"Microsoft.Build.Framework": {
|
||||
"type": "Transitive",
|
||||
"resolved": "18.0.2",
|
||||
"contentHash": "sOSb+0J4G/jCBW/YqmRuL0eOMXgfw1KQLdC9TkbvfA5xs7uNm+PBQXJCOzSJGXtZcZrtXozcwxPmUiRUbmd7FA=="
|
||||
},
|
||||
"Microsoft.CodeAnalysis.Analyzers": {
|
||||
"type": "Transitive",
|
||||
"resolved": "3.11.0",
|
||||
"contentHash": "v/EW3UE8/lbEYHoC2Qq7AR/DnmvpgdtAMndfQNmpuIMx/Mto8L5JnuCfdBYtgvalQOtfNCnxFejxuRrryvUTsg=="
|
||||
},
|
||||
"Microsoft.CodeAnalysis.Common": {
|
||||
"type": "Transitive",
|
||||
"resolved": "5.0.0",
|
||||
"contentHash": "ZXRAdvH6GiDeHRyd3q/km8Z44RoM6FBWHd+gen/la81mVnAdHTEsEkO5J0TCNXBymAcx5UYKt5TvgKBhaLJEow==",
|
||||
"dependencies": {
|
||||
"Microsoft.CodeAnalysis.Analyzers": "3.11.0"
|
||||
}
|
||||
},
|
||||
"Microsoft.CodeAnalysis.CSharp": {
|
||||
"type": "Transitive",
|
||||
"resolved": "5.0.0",
|
||||
"contentHash": "5DSyJ9bk+ATuDy7fp2Zt0mJStDVKbBoiz1DyfAwSa+k4H4IwykAUcV3URelw5b8/iVbfSaOwkwmPUZH6opZKCw==",
|
||||
"dependencies": {
|
||||
"Microsoft.CodeAnalysis.Analyzers": "3.11.0",
|
||||
"Microsoft.CodeAnalysis.Common": "[5.0.0]"
|
||||
}
|
||||
},
|
||||
"Microsoft.CodeAnalysis.CSharp.Workspaces": {
|
||||
"type": "Transitive",
|
||||
"resolved": "5.0.0",
|
||||
"contentHash": "Al/Q8B+yO8odSqGVpSvrShMFDvlQdIBU//F3E6Rb0YdiLSALE9wh/pvozPNnfmh5HDnvU+mkmSjpz4hQO++jaA==",
|
||||
"dependencies": {
|
||||
"Humanizer.Core": "2.14.1",
|
||||
"Microsoft.CodeAnalysis.Analyzers": "3.11.0",
|
||||
"Microsoft.CodeAnalysis.CSharp": "[5.0.0]",
|
||||
"Microsoft.CodeAnalysis.Common": "[5.0.0]",
|
||||
"Microsoft.CodeAnalysis.Workspaces.Common": "[5.0.0]",
|
||||
"System.Composition": "9.0.0"
|
||||
}
|
||||
},
|
||||
"Microsoft.CodeAnalysis.Workspaces.Common": {
|
||||
"type": "Transitive",
|
||||
"resolved": "5.0.0",
|
||||
"contentHash": "ZbUmIvT6lqTNKiv06Jl5wf0MTMi1vQ1oH7ou4CLcs2C/no/L7EhP3T8y3XXvn9VbqMcJaJnEsNA1jwYUMgc5jg==",
|
||||
"dependencies": {
|
||||
"Humanizer.Core": "2.14.1",
|
||||
"Microsoft.CodeAnalysis.Analyzers": "3.11.0",
|
||||
"Microsoft.CodeAnalysis.Common": "[5.0.0]",
|
||||
"System.Composition": "9.0.0"
|
||||
}
|
||||
},
|
||||
"Microsoft.CodeAnalysis.Workspaces.MSBuild": {
|
||||
"type": "Transitive",
|
||||
"resolved": "5.0.0",
|
||||
"contentHash": "/G+LVoAGMz6Ae8nm+PGLxSw+F5RjYx/J7irbTO5uKAPw1bxHyQJLc/YOnpDxt+EpPtYxvC9wvBsg/kETZp1F9Q==",
|
||||
"dependencies": {
|
||||
"Humanizer.Core": "2.14.1",
|
||||
"Microsoft.Build.Framework": "17.11.31",
|
||||
"Microsoft.CodeAnalysis.Analyzers": "3.11.0",
|
||||
"Microsoft.CodeAnalysis.Workspaces.Common": "[5.0.0]",
|
||||
"Microsoft.Extensions.DependencyInjection": "9.0.0",
|
||||
"Microsoft.Extensions.Logging": "9.0.0",
|
||||
"Microsoft.Extensions.Logging.Abstractions": "9.0.0",
|
||||
"Microsoft.Extensions.Options": "9.0.0",
|
||||
"Microsoft.Extensions.Primitives": "9.0.0",
|
||||
"Microsoft.VisualStudio.SolutionPersistence": "1.0.52",
|
||||
"Newtonsoft.Json": "13.0.3",
|
||||
"System.Composition": "9.0.0"
|
||||
}
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "bOzrFCl6uZCjaSh2bG1ToRQRdx+iXvxosCg9hFyG9OWeAzOFI4xev9OqKeWfKf/kAHyox2JnbcvLVf2ceA7sqA=="
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore.Analyzers": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "2gLDordUCGf3aNOOuqtTbP5mxhiP9nk6TnvGiE3RnqT891O+Zf/qKu1PIREubs1M16A0SImr4vULBfU5BTDs1Q=="
|
||||
},
|
||||
"Microsoft.Extensions.Caching.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "4ZFBNE+jzR+CrWWlhOesnmywCW7pYKT0dxyAQRdL11yJwxe4jvcAu31eorFtEkoFeCDcUTeNssgPv2yaRRptaQ==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.Primitives": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.Caching.Memory": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "N1w5H7uK6gCTnCBZAWzE0/EQYSPysij/uYwDqntqBVvBa6bjMmBKitsnEFd6yh/SX3wLm67nO6+OnZ84K+gZWg==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.Caching.Abstractions": "10.0.10",
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
|
||||
"Microsoft.Extensions.Logging.Abstractions": "10.0.10",
|
||||
"Microsoft.Extensions.Options": "10.0.10",
|
||||
"Microsoft.Extensions.Primitives": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.Configuration.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "5Vnd2I75DmZCVEjSynIdJ/0EGafgnLQwgR3t2C2/fkjx/nRG+cLwxLLdInoHeCEpkD5K4Ov/g9ZCRYrl4TRsaA==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.Primitives": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.DependencyInjection": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "ANyvsgkNBRvcJh2XLgn8veGmajf+8m0AbKK+HPWdRL1yraSNVVSmQhFntLtdz/C795jxqqup+k05cs/3jZQPOA==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "z/2xXlFw2aLGjHyEm6E0tQ+In6VfzQzTrtArbQ2c0TQE16ZbyDCMGPvaUT9I0s8rgy9sRWlU2P9waW37qV04qA=="
|
||||
},
|
||||
"Microsoft.Extensions.DependencyModel": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "rfZA1RjR021RPqSmIPovfz2aOd79TGqJ9BengbjnzIISOVwjLmuSDnhCMmiY/1c6iYvGolQ1iNGzkav0u11XEA=="
|
||||
},
|
||||
"Microsoft.Extensions.Logging": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "Tf6z5HsL0VDYRTfvsoNrTGHGheCwkTsZBA2FFh5ATJUbkAwug+FFNISJK2gjpUNemlAOoWllAK52HOWCjto3EQ==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.DependencyInjection": "10.0.10",
|
||||
"Microsoft.Extensions.Logging.Abstractions": "10.0.10",
|
||||
"Microsoft.Extensions.Options": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.Logging.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "zkFxGYUvdxAvIKTyXHrmW+Sux53D4SezD9dMyZ6hrwwzPQJNuwCRy1f5W7AvYTqacEGhWF2XderRQG1OvbV8og==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.Options": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "srnhnk7nE8krBiIXp71LvBmKBtraBONWSRzdjJgRv1Ko9Mp8IVNqv4vIS9hGeVteBig8aQkva9ZG+sC+o5sVcA==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
|
||||
"Microsoft.Extensions.Primitives": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.Primitives": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "5wu/GrYVd8mG2DVUw3vFJzF+O336TyTGg/Kmcgw9bfwYhCoFiV5lR5QeEmKecJyrW4W54nMfD3p3589E8a7czQ=="
|
||||
},
|
||||
"Microsoft.VisualStudio.SolutionPersistence": {
|
||||
"type": "Transitive",
|
||||
"resolved": "1.0.52",
|
||||
"contentHash": "oNv2JtYXhpdJrX63nibx1JT3uCESOBQ1LAk7Dtz/sr0+laW0KRM6eKp4CZ3MHDR2siIkKsY8MmUkeP5DKkQQ5w=="
|
||||
},
|
||||
"Mono.TextTemplating": {
|
||||
"type": "Transitive",
|
||||
"resolved": "3.0.0",
|
||||
"contentHash": "YqueG52R/Xej4VVbKuRIodjiAhV0HR/XVbLbNrJhCZnzjnSjgMJ/dCdV0akQQxavX6hp/LC6rqLGLcXeQYU7XA==",
|
||||
"dependencies": {
|
||||
"System.CodeDom": "6.0.0"
|
||||
}
|
||||
},
|
||||
"Newtonsoft.Json": {
|
||||
"type": "Transitive",
|
||||
"resolved": "13.0.3",
|
||||
"contentHash": "HrC5BXdl00IP9zeV+0Z848QWPAoCr9P3bDEZguI+gkLcBKAOxix/tLEAAHC+UvDNPv4a2d18lOReHMOagPa+zQ=="
|
||||
},
|
||||
"Npgsql": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.3",
|
||||
"contentHash": "7nb5YzXuvWWJxB0J8DiyL3we+X4FOctZrt0fIBnucOIaIevFEEwGQVZKtiu9olXdlNAK1eNgqSral6r/jlhI4w==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.Logging.Abstractions": "10.0.0"
|
||||
}
|
||||
},
|
||||
"System.CodeDom": {
|
||||
"type": "Transitive",
|
||||
"resolved": "6.0.0",
|
||||
"contentHash": "CPc6tWO1LAer3IzfZufDBRL+UZQcj5uS207NHALQzP84Vp/z6wF0Aa0YZImOQY8iStY0A2zI/e3ihKNPfUm8XA=="
|
||||
},
|
||||
"System.Composition": {
|
||||
"type": "Transitive",
|
||||
"resolved": "9.0.0",
|
||||
"contentHash": "3Djj70fFTraOarSKmRnmRy/zm4YurICm+kiCtI0dYRqGJnLX6nJ+G3WYuFJ173cAPax/gh96REcbNiVqcrypFQ==",
|
||||
"dependencies": {
|
||||
"System.Composition.AttributedModel": "9.0.0",
|
||||
"System.Composition.Convention": "9.0.0",
|
||||
"System.Composition.Hosting": "9.0.0",
|
||||
"System.Composition.Runtime": "9.0.0",
|
||||
"System.Composition.TypedParts": "9.0.0"
|
||||
}
|
||||
},
|
||||
"System.Composition.AttributedModel": {
|
||||
"type": "Transitive",
|
||||
"resolved": "9.0.0",
|
||||
"contentHash": "iri00l/zIX9g4lHMY+Nz0qV1n40+jFYAmgsaiNn16xvt2RDwlqByNG4wgblagnDYxm3YSQQ0jLlC/7Xlk9CzyA=="
|
||||
},
|
||||
"System.Composition.Convention": {
|
||||
"type": "Transitive",
|
||||
"resolved": "9.0.0",
|
||||
"contentHash": "+vuqVP6xpi582XIjJi6OCsIxuoTZfR0M7WWufk3uGDeCl3wGW6KnpylUJ3iiXdPByPE0vR5TjJgR6hDLez4FQg==",
|
||||
"dependencies": {
|
||||
"System.Composition.AttributedModel": "9.0.0"
|
||||
}
|
||||
},
|
||||
"System.Composition.Hosting": {
|
||||
"type": "Transitive",
|
||||
"resolved": "9.0.0",
|
||||
"contentHash": "OFqSeFeJYr7kHxDfaViGM1ymk7d4JxK//VSoNF9Ux0gpqkLsauDZpu89kTHHNdCWfSljbFcvAafGyBoY094btQ==",
|
||||
"dependencies": {
|
||||
"System.Composition.Runtime": "9.0.0"
|
||||
}
|
||||
},
|
||||
"System.Composition.Runtime": {
|
||||
"type": "Transitive",
|
||||
"resolved": "9.0.0",
|
||||
"contentHash": "w1HOlQY1zsOWYussjFGZCEYF2UZXgvoYnS94NIu2CBnAGMbXFAX8PY8c92KwUItPmowal68jnVLBCzdrWLeEKA=="
|
||||
},
|
||||
"System.Composition.TypedParts": {
|
||||
"type": "Transitive",
|
||||
"resolved": "9.0.0",
|
||||
"contentHash": "aRZlojCCGEHDKqh43jaDgaVpYETsgd7Nx4g1zwLKMtv4iTo0627715ajEFNpEEBTgLmvZuv8K0EVxc3sM4NWJA==",
|
||||
"dependencies": {
|
||||
"System.Composition.AttributedModel": "9.0.0",
|
||||
"System.Composition.Hosting": "9.0.0",
|
||||
"System.Composition.Runtime": "9.0.0"
|
||||
}
|
||||
},
|
||||
"dodossh.domain": {
|
||||
"type": "Project"
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore": {
|
||||
"type": "CentralTransitive",
|
||||
"requested": "[10.0.10, )",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "a0V7zj/VbYP6dTdWpUgE/r2PuLKtUGe2aJ0lVKkn/wP9ZhaxUz2kQydVfvOjCv2SKxlrqdBfHhPD4Cvlf+4ffA==",
|
||||
"dependencies": {
|
||||
"Microsoft.EntityFrameworkCore.Abstractions": "10.0.10",
|
||||
"Microsoft.EntityFrameworkCore.Analyzers": "10.0.10",
|
||||
"Microsoft.Extensions.Caching.Memory": "10.0.10",
|
||||
"Microsoft.Extensions.Logging": "10.0.10"
|
||||
}
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore.Relational": {
|
||||
"type": "CentralTransitive",
|
||||
"requested": "[10.0.10, )",
|
||||
"resolved": "10.0.10",
|
||||
"contentHash": "wNonj40aZxia+GtuBiiD6ZqVh4h6y5Nje1bGdmzZ8/ui0QRsAN+S0SIrLHFCEGbG9cDbeaE40sh+Lr7o9rRs6g==",
|
||||
"dependencies": {
|
||||
"Microsoft.EntityFrameworkCore": "10.0.10",
|
||||
"Microsoft.Extensions.Caching.Memory": "10.0.10",
|
||||
"Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
|
||||
"Microsoft.Extensions.Logging": "10.0.10"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user