49 lines
2.3 KiB
SQL
49 lines
2.3 KiB
SQL
-- IAM Hub employee SSO identity, local session revocation and idempotent audit.
|
|
-- The production table prefix in this repository is zyt_.
|
|
|
|
SET @schema_name := DATABASE();
|
|
|
|
SET @sql := IF(
|
|
(SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_subject') = 0,
|
|
'ALTER TABLE `zyt_admin` ADD COLUMN `iam_subject` varchar(128) NULL DEFAULT NULL COMMENT ''IAM Hub OIDC subject'' AFTER `work_wechat_userid`',
|
|
'SELECT 1'
|
|
);
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|
|
|
|
SET @sql := IF(
|
|
(SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_managed') = 0,
|
|
'ALTER TABLE `zyt_admin` ADD COLUMN `iam_managed` tinyint unsigned NOT NULL DEFAULT 0 COMMENT ''IAM Hub managed account'' AFTER `iam_subject`',
|
|
'SELECT 1'
|
|
);
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|
|
|
|
SET @sql := IF(
|
|
(SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_revoked_at') = 0,
|
|
'ALTER TABLE `zyt_admin` ADD COLUMN `iam_revoked_at` int unsigned NOT NULL DEFAULT 0 COMMENT ''last IAM revocation timestamp'' AFTER `iam_managed`',
|
|
'SELECT 1'
|
|
);
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|
|
|
|
SET @sql := IF(
|
|
(SELECT COUNT(*) FROM information_schema.STATISTICS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND INDEX_NAME='uk_admin_iam_subject') = 0,
|
|
'CREATE UNIQUE INDEX `uk_admin_iam_subject` ON `zyt_admin` (`iam_subject`)',
|
|
'SELECT 1'
|
|
);
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|
|
|
|
CREATE TABLE IF NOT EXISTS `zyt_iam_revocation_event` (
|
|
`id` int unsigned NOT NULL AUTO_INCREMENT,
|
|
`event_id` varchar(64) NOT NULL,
|
|
`iam_subject` varchar(128) NOT NULL,
|
|
`admin_id` int unsigned NOT NULL DEFAULT 0,
|
|
`status` varchar(32) NOT NULL,
|
|
`reason` varchar(500) NOT NULL DEFAULT '',
|
|
`payload` longtext NOT NULL,
|
|
`create_time` int unsigned NOT NULL DEFAULT 0,
|
|
`update_time` int unsigned NOT NULL DEFAULT 0,
|
|
PRIMARY KEY (`id`),
|
|
UNIQUE KEY `uk_iam_revocation_event_id` (`event_id`),
|
|
KEY `idx_iam_revocation_subject` (`iam_subject`),
|
|
KEY `idx_iam_revocation_admin` (`admin_id`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='IAM Hub revocation delivery audit';
|