38 lines
2.1 KiB
TypeScript
38 lines
2.1 KiB
TypeScript
/** External provisioner only. No namespace/key/generation is created on startup
|
|
* or native dispatch. No FK or type depends on application public objects. */
|
|
export const BANDWIDTH_CONTROL_SOURCE_DDL = `
|
|
CREATE TABLE mmapp_control.bandwidth_source_identity (
|
|
id integer PRIMARY KEY CHECK(id=1),
|
|
installation_id uuid NOT NULL,
|
|
control_generation uuid NOT NULL,
|
|
attestation_sha256 text NOT NULL CHECK(attestation_sha256 ~ '^[a-f0-9]{64}$'),
|
|
event_key_sha256 text NOT NULL CHECK(event_key_sha256 ~ '^[a-f0-9]{64}$'),
|
|
status text NOT NULL DEFAULT 'active' CHECK(status IN ('active','quarantined')),
|
|
created_at timestamptz NOT NULL DEFAULT clock_timestamp()
|
|
);
|
|
CREATE FUNCTION mmapp_control.bandwidth_source_identity_guard() RETURNS trigger
|
|
LANGUAGE plpgsql SET search_path=pg_catalog,mmapp_control AS $body$
|
|
BEGIN
|
|
IF TG_OP IN ('DELETE','TRUNCATE') THEN
|
|
RAISE EXCEPTION 'bandwidth source identity cannot be removed' USING ERRCODE='23514';
|
|
END IF;
|
|
IF TG_OP='INSERT' THEN
|
|
IF NEW.status <> 'active' THEN RAISE EXCEPTION 'new source must be explicitly active' USING ERRCODE='23514'; END IF;
|
|
RETURN NEW;
|
|
END IF;
|
|
IF ROW(NEW.id,NEW.installation_id,NEW.control_generation,NEW.attestation_sha256,NEW.event_key_sha256,NEW.created_at)
|
|
IS DISTINCT FROM ROW(OLD.id,OLD.installation_id,OLD.control_generation,OLD.attestation_sha256,OLD.event_key_sha256,OLD.created_at)
|
|
OR OLD.status <> 'active' OR NEW.status <> 'quarantined' THEN
|
|
RAISE EXCEPTION 'source identity is immutable; only quarantine is allowed' USING ERRCODE='23514';
|
|
END IF;
|
|
RETURN NEW;
|
|
END;
|
|
$body$;
|
|
CREATE TRIGGER bandwidth_source_identity_guard BEFORE INSERT OR UPDATE OR DELETE
|
|
ON mmapp_control.bandwidth_source_identity FOR EACH ROW EXECUTE FUNCTION mmapp_control.bandwidth_source_identity_guard();
|
|
CREATE TRIGGER bandwidth_source_identity_no_truncate BEFORE TRUNCATE
|
|
ON mmapp_control.bandwidth_source_identity FOR EACH STATEMENT EXECUTE FUNCTION mmapp_control.bandwidth_source_identity_guard();
|
|
ALTER TABLE mmapp_control.bandwidth_source_identity ENABLE ALWAYS TRIGGER bandwidth_source_identity_guard;
|
|
ALTER TABLE mmapp_control.bandwidth_source_identity ENABLE ALWAYS TRIGGER bandwidth_source_identity_no_truncate;
|
|
`
|