| 1 | -- SCIM: a workspace's identity provider says who is assigned to it, so |
| 2 | -- only they sign in through its single sign-on, and someone unassigned |
| 3 | -- leaves the workspace at once. Every timestamp is RFC 3339 UTC. See |
| 4 | -- src/sso.rs and src/sso/scim.rs. |
| 5 | |
| 6 | -- The workspace's SCIM token, which its provider sends as a bearer token: |
| 7 | -- one at a time, kept as its SHA-256. With none, SCIM is off. |
| 8 | CREATE TABLE scim_tokens ( |
| 9 | workspace_id TEXT PRIMARY KEY REFERENCES workspaces (id) ON DELETE CASCADE, |
| 10 | token_hash TEXT NOT NULL UNIQUE, |
| 11 | -- Its last four characters, for telling tokens apart. |
| 12 | hint TEXT NOT NULL, |
| 13 | created_by TEXT, |
| 14 | created_at TEXT NOT NULL, |
| 15 | last_used_at TEXT |
| 16 | ); |
| 17 | |
| 18 | -- The people the provider has assigned to the workspace, as it describes |
| 19 | -- them. Not g1t accounts: linked to one (user_id) when that person signs |
| 20 | -- in through single sign-on as them. |
| 21 | CREATE TABLE scim_users ( |
| 22 | id TEXT PRIMARY KEY, |
| 23 | workspace_id TEXT NOT NULL REFERENCES workspaces (id) ON DELETE CASCADE, |
| 24 | -- userName as sent, and lowercased to find it by. |
| 25 | user_name TEXT NOT NULL, |
| 26 | user_name_key TEXT NOT NULL, |
| 27 | external_id TEXT, |
| 28 | -- The rest of the user, as JSON (src/sso/scim.rs ScimUser). |
| 29 | resource TEXT NOT NULL, |
| 30 | active INTEGER NOT NULL DEFAULT 1, |
| 31 | user_id TEXT REFERENCES users (id) ON DELETE SET NULL, |
| 32 | created_at TEXT NOT NULL, |
| 33 | updated_at TEXT NOT NULL, |
| 34 | UNIQUE (workspace_id, user_name_key) |
| 35 | ); |
| 36 | |
| 37 | CREATE INDEX scim_users_by_person ON scim_users (workspace_id, user_id); |