Tizian 「ティツィアーン」
b72cea1fe0
Step 3 of ADR 0044 (D3, D18, D19). A shared space's data keys are sealed on a device to each member's public keys; the instance keeps what devices sealed and never opens it. - halkyon_keys: the safety code of two accounts' public keys (`safetyCode`), 60 digits, the same on both sides. - halkyon_base: the register hands out accounts' public keys (`public-keys-of`, local and remote); the table `shared_space_key` and the endpoint `sharedSpaceKeys` (memberKeys, keysNeeded, seal, mine). Only the Owner and Editors seal, the first key sealed to a member stays, and a member's keys go with their membership. Every host's migration creates the table. - halkyon_app: `ContentCipher` seals a key to another account and opens one sealed by another; `SharedKeys` shares a space's key with its members, seals keys to newcomers and opens the person's own, holding each member to the public keys `KeyPins` pinned on first sight (`key_pins.json` in the person's folder), a change refused until trusted anew. Learn takes them into its `Privacy` in step 4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
117 lines
3.5 KiB
PL/PgSQL
117 lines
3.5 KiB
PL/PgSQL
BEGIN;
|
|
|
|
--
|
|
-- Function: gen_random_uuid_v7()
|
|
-- Source: https://gist.github.com/kjmph/5bd772b2c2df145aa645b837da7eca74
|
|
-- License: MIT (copyright notice included on the generator source code).
|
|
--
|
|
create or replace function gen_random_uuid_v7()
|
|
returns uuid
|
|
as $$
|
|
begin
|
|
-- use random v4 uuid as starting point (which has the same variant we need)
|
|
-- then overlay timestamp
|
|
-- then set version 7 by flipping the 2 and 1 bit in the version 4 string
|
|
return encode(
|
|
set_bit(
|
|
set_bit(
|
|
overlay(uuid_send(gen_random_uuid())
|
|
placing substring(int8send(floor(extract(epoch from clock_timestamp()) * 1000)::bigint) from 3)
|
|
from 1 for 6
|
|
),
|
|
52, 1
|
|
),
|
|
53, 1
|
|
),
|
|
'hex')::uuid;
|
|
end
|
|
$$
|
|
language plpgsql
|
|
volatile;
|
|
|
|
--
|
|
-- ACTION CREATE TABLE
|
|
--
|
|
CREATE TABLE "shared_space_key" (
|
|
"id" uuid PRIMARY KEY DEFAULT gen_random_uuid_v7(),
|
|
"sharedSpaceId" uuid NOT NULL,
|
|
"keyId" text NOT NULL,
|
|
"recipientId" uuid NOT NULL,
|
|
"sealedKey" bytea NOT NULL,
|
|
"sealedBy" uuid NOT NULL,
|
|
"createdAt" timestamp without time zone NOT NULL
|
|
);
|
|
|
|
-- Indexes
|
|
CREATE UNIQUE INDEX "shared_space_key_unique_idx" ON "shared_space_key" USING btree ("sharedSpaceId", "keyId", "recipientId");
|
|
CREATE INDEX "shared_space_key_recipient_idx" ON "shared_space_key" USING btree ("recipientId");
|
|
|
|
--
|
|
-- ACTION CREATE FOREIGN KEY
|
|
--
|
|
ALTER TABLE ONLY "shared_space_key"
|
|
ADD CONSTRAINT "shared_space_key_fk_0"
|
|
FOREIGN KEY("sharedSpaceId")
|
|
REFERENCES "shared_space"("id")
|
|
ON DELETE CASCADE
|
|
ON UPDATE NO ACTION;
|
|
|
|
|
|
--
|
|
-- MIGRATION VERSION FOR halkyon_learn
|
|
--
|
|
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
|
|
VALUES ('halkyon_learn', '20261111100124819-shared-space-keys', now())
|
|
ON CONFLICT ("module")
|
|
DO UPDATE SET "version" = '20261111100124819-shared-space-keys', "timestamp" = now();
|
|
|
|
--
|
|
-- MIGRATION VERSION FOR halkyon_base
|
|
--
|
|
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
|
|
VALUES ('halkyon_base', '20261111100053843-shared-space-keys', now())
|
|
ON CONFLICT ("module")
|
|
DO UPDATE SET "version" = '20261111100053843-shared-space-keys', "timestamp" = now();
|
|
|
|
--
|
|
-- MIGRATION VERSION FOR serverpod
|
|
--
|
|
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
|
|
VALUES ('serverpod', '20260824182259319', now())
|
|
ON CONFLICT ("module")
|
|
DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
|
|
|
|
--
|
|
-- MIGRATION VERSION FOR serverpod_auth_idp
|
|
--
|
|
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
|
|
VALUES ('serverpod_auth_idp', '20260924105404509', now())
|
|
ON CONFLICT ("module")
|
|
DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
|
|
|
|
--
|
|
-- MIGRATION VERSION FOR serverpod_offline_sync
|
|
--
|
|
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
|
|
VALUES ('serverpod_offline_sync', '20260914143806119', now())
|
|
ON CONFLICT ("module")
|
|
DO UPDATE SET "version" = '20260914143806119', "timestamp" = now();
|
|
|
|
--
|
|
-- MIGRATION VERSION FOR halkyon_oidc
|
|
--
|
|
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
|
|
VALUES ('halkyon_oidc', '20261023180644988', now())
|
|
ON CONFLICT ("module")
|
|
DO UPDATE SET "version" = '20261023180644988', "timestamp" = now();
|
|
|
|
--
|
|
-- MIGRATION VERSION FOR serverpod_auth_core
|
|
--
|
|
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
|
|
VALUES ('serverpod_auth_core', '20260924105232991', now())
|
|
ON CONFLICT ("module")
|
|
DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
|
|
|
|
|
|
COMMIT;
|