Documentation
¶
Overview ¶
Schema indirection (authkit issue 69).
Every SQL statement in authkit — the sqlc-generated constants in this package and the few raw statements in core — is schema-qualified with the literal prefix "profiles.". Hosts embed authkit with a pgx pool that is SHARED with their own queries, so pointing authkit at a different schema via search_path on the pool is ruled out (it would leak into host queries). Instead the qualifier stays in the SQL text and becomes a variable: ForSchema wraps a DBTX so the "profiles." prefix is rewritten to "<schema>." on every statement at execution time. This is a deliberate, documented string substitution: schema names are validated against a strict identifier grammar (ValidSchemaName) at configuration time, every authkit table/function reference is written as `profiles.<name>` (guarded by a test in this package), and the rewrite is the identity (no wrapper at all) for the default schema, so existing embedders see zero change.
Index ¶
- Constants
- func RewriteSQL(sql, schema string) string
- func ValidSchemaName(s string) bool
- type DBTX
- type IdentityUpdateUserEmailParams
- type IdentityUpdateUserUsernameParams
- type IdentityUserByIDRow
- type IdentityUsersByIDsRow
- type NamespaceUserBySlugRow
- type NamespaceUserRenameBySlugRow
- type OwnerSlugUserExistsParams
- type OwnerSlugUserRenameHeldParams
- type ProfilesGroupCustomRole
- type ProfilesGroupInvite
- type ProfilesGroupRoleAssignment
- type ProfilesGroupTypeParent
- type ProfilesOwnerReservedName
- type ProfilesPermissionGroup
- type ProfilesRefreshSession
- type ProfilesRemoteApplication
- type ProfilesRemoteApplicationAttributeDef
- type ProfilesServiceToken
- type ProfilesServiceTokenResource
- type ProfilesTwoFactorFactor
- type ProfilesTwoFactorSetting
- type ProfilesUser
- type ProfilesUserPassword
- type ProfilesUserProvider
- type ProfilesUserRename
- type ProviderLinkByIssuerParams
- type ProviderLinkByIssuerRow
- type ProviderLinkBySlugParams
- type ProviderLinkBySlugRow
- type Queries
- func (q *Queries) IdentityCurrentUsername(ctx context.Context, username *string) (*string, error)
- func (q *Queries) IdentityForwardUsername(ctx context.Context, fromSlug string) (*string, error)
- func (q *Queries) IdentityUpdateUserEmail(ctx context.Context, arg IdentityUpdateUserEmailParams) error
- func (q *Queries) IdentityUpdateUserUsername(ctx context.Context, arg IdentityUpdateUserUsernameParams) error
- func (q *Queries) IdentityUserByID(ctx context.Context, id string) (IdentityUserByIDRow, error)
- func (q *Queries) IdentityUserIDByUsername(ctx context.Context, username *string) (string, error)
- func (q *Queries) IdentityUsersByIDs(ctx context.Context, ids []string) ([]IdentityUsersByIDsRow, error)
- func (q *Queries) NamespaceUserBySlug(ctx context.Context, username *string) (NamespaceUserBySlugRow, error)
- func (q *Queries) NamespaceUserRenameBySlug(ctx context.Context, fromSlug string) (NamespaceUserRenameBySlugRow, error)
- func (q *Queries) OwnerReservedNameDelete(ctx context.Context, slug string) (int64, error)
- func (q *Queries) OwnerReservedNameExists(ctx context.Context, slug string) (bool, error)
- func (q *Queries) OwnerReservedNameUpsert(ctx context.Context, slug string) error
- func (q *Queries) OwnerSlugUserExists(ctx context.Context, arg OwnerSlugUserExistsParams) (bool, error)
- func (q *Queries) OwnerSlugUserRenameHeld(ctx context.Context, arg OwnerSlugUserRenameHeldParams) (bool, error)
- func (q *Queries) ProviderLinkByIssuer(ctx context.Context, arg ProviderLinkByIssuerParams) (ProviderLinkByIssuerRow, error)
- func (q *Queries) ProviderLinkBySlug(ctx context.Context, arg ProviderLinkBySlugParams) (ProviderLinkBySlugRow, error)
- func (q *Queries) RemoteAppAttributeDefDelete(ctx context.Context, arg RemoteAppAttributeDefDeleteParams) (int64, error)
- func (q *Queries) RemoteAppAttributeDefGet(ctx context.Context, arg RemoteAppAttributeDefGetParams) (RemoteAppAttributeDefGetRow, error)
- func (q *Queries) RemoteAppAttributeDefGetLatest(ctx context.Context, arg RemoteAppAttributeDefGetLatestParams) (RemoteAppAttributeDefGetLatestRow, error)
- func (q *Queries) RemoteAppAttributeDefUpsert(ctx context.Context, arg RemoteAppAttributeDefUpsertParams) (RemoteAppAttributeDefUpsertRow, error)
- func (q *Queries) RemoteAppAttributeDefsList(ctx context.Context, remoteApplicationID string) ([]RemoteAppAttributeDefsListRow, error)
- func (q *Queries) RemoteApplicationByIssuer(ctx context.Context, issuer string) (RemoteApplicationByIssuerRow, error)
- func (q *Queries) RemoteApplicationBySlug(ctx context.Context, slug string) (RemoteApplicationBySlugRow, error)
- func (q *Queries) RemoteApplicationDelete(ctx context.Context, issuer string) (int64, error)
- func (q *Queries) RemoteApplicationUpsert(ctx context.Context, arg RemoteApplicationUpsertParams) (RemoteApplicationUpsertRow, error)
- func (q *Queries) RemoteApplicationsAll(ctx context.Context) ([]RemoteApplicationsAllRow, error)
- func (q *Queries) RemoteApplicationsEnabled(ctx context.Context) ([]RemoteApplicationsEnabledRow, error)
- func (q *Queries) SessionByCurrentTokenHash(ctx context.Context, arg SessionByCurrentTokenHashParams) (SessionByCurrentTokenHashRow, error)
- func (q *Queries) SessionByPreviousTokenHash(ctx context.Context, arg SessionByPreviousTokenHashParams) (SessionByPreviousTokenHashRow, error)
- func (q *Queries) SessionFreshSince(ctx context.Context, arg SessionFreshSinceParams) (SessionFreshSinceRow, error)
- func (q *Queries) SessionIDByCurrentTokenHash(ctx context.Context, arg SessionIDByCurrentTokenHashParams) (string, error)
- func (q *Queries) SessionInsert(ctx context.Context, arg SessionInsertParams) (SessionInsertRow, error)
- func (q *Queries) SessionMarkAuthenticated(ctx context.Context, arg SessionMarkAuthenticatedParams) (int64, error)
- func (q *Queries) SessionRevokeByID(ctx context.Context, arg SessionRevokeByIDParams) (string, error)
- func (q *Queries) SessionRevokeByIDForUser(ctx context.Context, arg SessionRevokeByIDForUserParams) (string, error)
- func (q *Queries) SessionRotate(ctx context.Context, arg SessionRotateParams) error
- func (q *Queries) SessionsCountActive(ctx context.Context, arg SessionsCountActiveParams) (int64, error)
- func (q *Queries) SessionsDeleteRevokedOrExpired(ctx context.Context) error
- func (q *Queries) SessionsEvictOldest(ctx context.Context, arg SessionsEvictOldestParams) ([]string, error)
- func (q *Queries) SessionsListByUser(ctx context.Context, arg SessionsListByUserParams) ([]SessionsListByUserRow, error)
- func (q *Queries) SessionsRevokeAll(ctx context.Context, arg SessionsRevokeAllParams) ([]string, error)
- func (q *Queries) SessionsRevokeAllExcept(ctx context.Context, arg SessionsRevokeAllExceptParams) ([]string, error)
- func (q *Queries) SessionsRevokeAllQuiet(ctx context.Context, arg SessionsRevokeAllQuietParams) error
- func (q *Queries) SessionsRevokeFamily(ctx context.Context, familyID string) ([]SessionsRevokeFamilyRow, error)
- func (q *Queries) TwoFactorClearDefaultFactors(ctx context.Context, userID string) error
- func (q *Queries) TwoFactorConsumeFactorTOTPStep(ctx context.Context, arg TwoFactorConsumeFactorTOTPStepParams) (int64, error)
- func (q *Queries) TwoFactorConsumeTOTPStep(ctx context.Context, arg TwoFactorConsumeTOTPStepParams) (int64, error)
- func (q *Queries) TwoFactorDefaultFactorByUser(ctx context.Context, userID string) (ProfilesTwoFactorFactor, error)
- func (q *Queries) TwoFactorDelete(ctx context.Context, userID string) error
- func (q *Queries) TwoFactorDisable(ctx context.Context, userID string) error
- func (q *Queries) TwoFactorDisableAllFactors(ctx context.Context, userID string) error
- func (q *Queries) TwoFactorDisableFactor(ctx context.Context, arg TwoFactorDisableFactorParams) (int64, error)
- func (q *Queries) TwoFactorEnable(ctx context.Context, arg TwoFactorEnableParams) error
- func (q *Queries) TwoFactorFactorByUserMethod(ctx context.Context, arg TwoFactorFactorByUserMethodParams) (ProfilesTwoFactorFactor, error)
- func (q *Queries) TwoFactorListFactorsByUser(ctx context.Context, userID string) ([]ProfilesTwoFactorFactor, error)
- func (q *Queries) TwoFactorSetBackupCodes(ctx context.Context, arg TwoFactorSetBackupCodesParams) error
- func (q *Queries) TwoFactorSetDefaultFactor(ctx context.Context, arg TwoFactorSetDefaultFactorParams) (int64, error)
- func (q *Queries) TwoFactorSettingsByUser(ctx context.Context, userID string) (TwoFactorSettingsByUserRow, error)
- func (q *Queries) TwoFactorUpsertFactor(ctx context.Context, arg TwoFactorUpsertFactorParams) (ProfilesTwoFactorFactor, error)
- func (q *Queries) TwoFactorUpsertSettings(ctx context.Context, arg TwoFactorUpsertSettingsParams) error
- func (q *Queries) UserApplyEmailChange(ctx context.Context, arg UserApplyEmailChangeParams) error
- func (q *Queries) UserApplyPhoneChange(ctx context.Context, arg UserApplyPhoneChangeParams) error
- func (q *Queries) UserBan(ctx context.Context, arg UserBanParams) error
- func (q *Queries) UserByEmail(ctx context.Context, email string) (UserByEmailRow, error)
- func (q *Queries) UserByID(ctx context.Context, id string) (UserByIDRow, error)
- func (q *Queries) UserByPhone(ctx context.Context, phoneNumber *string) (UserByPhoneRow, error)
- func (q *Queries) UserBySlug(ctx context.Context, username *string) (UserBySlugRow, error)
- func (q *Queries) UserBySlugViaRename(ctx context.Context, fromSlug string) (UserBySlugViaRenameRow, error)
- func (q *Queries) UserByUsername(ctx context.Context, username *string) (UserByUsernameRow, error)
- func (q *Queries) UserClearBan(ctx context.Context, id string) error
- func (q *Queries) UserClearLoginIdentifiers(ctx context.Context, id string) error
- func (q *Queries) UserDeleteHard(ctx context.Context, id string) error
- func (q *Queries) UserDiscordUsername(ctx context.Context, id string) (*string, error)
- func (q *Queries) UserEmailByID(ctx context.Context, id string) (*string, error)
- func (q *Queries) UserEmailOrUsernameExists(ctx context.Context, arg UserEmailOrUsernameExistsParams) (bool, error)
- func (q *Queries) UserEmailOrUsernameTaken(ctx context.Context, arg UserEmailOrUsernameTakenParams) (UserEmailOrUsernameTakenRow, error)
- func (q *Queries) UserHasPassword(ctx context.Context, userID string) (bool, error)
- func (q *Queries) UserIDReservedByUsername(ctx context.Context, username *string) (UserIDReservedByUsernameRow, error)
- func (q *Queries) UserImportInsert(ctx context.Context, arg UserImportInsertParams) error
- func (q *Queries) UserImportUpdate(ctx context.Context, arg UserImportUpdateParams) (string, error)
- func (q *Queries) UserInsert(ctx context.Context, arg UserInsertParams) (UserInsertRow, error)
- func (q *Queries) UserIsReserved(ctx context.Context, id string) (bool, error)
- func (q *Queries) UserLastRenamedAt(ctx context.Context, userID string) (time.Time, error)
- func (q *Queries) UserMetadata(ctx context.Context, id string) ([]byte, error)
- func (q *Queries) UserMetadataPatch(ctx context.Context, arg UserMetadataPatchParams) (int64, error)
- func (q *Queries) UserPasswordDelete(ctx context.Context, userID string) error
- func (q *Queries) UserPasswordInsert(ctx context.Context, arg UserPasswordInsertParams) error
- func (q *Queries) UserPasswordRow(ctx context.Context, userID string) (UserPasswordRowRow, error)
- func (q *Queries) UserPasswordUpsert(ctx context.Context, arg UserPasswordUpsertParams) error
- func (q *Queries) UserPhoneOrUsernameExists(ctx context.Context, arg UserPhoneOrUsernameExistsParams) (bool, error)
- func (q *Queries) UserPhoneOrUsernameTaken(ctx context.Context, arg UserPhoneOrUsernameTakenParams) (UserPhoneOrUsernameTakenRow, error)
- func (q *Queries) UserPreferredLanguage(ctx context.Context, id string) (string, error)
- func (q *Queries) UserProviderDeleteBySlug(ctx context.Context, arg UserProviderDeleteBySlugParams) error
- func (q *Queries) UserProviderDeleteOtherSubjects(ctx context.Context, arg UserProviderDeleteOtherSubjectsParams) error
- func (q *Queries) UserProviderInsertSimple(ctx context.Context, arg UserProviderInsertSimpleParams) error
- func (q *Queries) UserProviderLinkExists(ctx context.Context, arg UserProviderLinkExistsParams) (bool, error)
- func (q *Queries) UserProviderMergeProfile(ctx context.Context, arg UserProviderMergeProfileParams) error
- func (q *Queries) UserProviderSetUsername(ctx context.Context, arg UserProviderSetUsernameParams) error
- func (q *Queries) UserProviderSlugs(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserProviderSlugsDistinct(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserProviderSubjectByIssuer(ctx context.Context, arg UserProviderSubjectByIssuerParams) (string, error)
- func (q *Queries) UserProviderSubjectProfileByIssuer(ctx context.Context, arg UserProviderSubjectProfileByIssuerParams) (UserProviderSubjectProfileByIssuerRow, error)
- func (q *Queries) UserProviderUpsertByIssuer(ctx context.Context, arg UserProviderUpsertByIssuerParams) error
- func (q *Queries) UserProviderUsername(ctx context.Context, arg UserProviderUsernameParams) (*string, error)
- func (q *Queries) UserProvidersCount(ctx context.Context, userID string) (int64, error)
- func (q *Queries) UserProvidersDeleteByUser(ctx context.Context, userID string) error
- func (q *Queries) UserRenameInsert(ctx context.Context, arg UserRenameInsertParams) error
- func (q *Queries) UserRestore(ctx context.Context, id string) error
- func (q *Queries) UserSetBiography(ctx context.Context, arg UserSetBiographyParams) error
- func (q *Queries) UserSetEmailAndUnverify(ctx context.Context, arg UserSetEmailAndUnverifyParams) error
- func (q *Queries) UserSetEmailAndVerified(ctx context.Context, arg UserSetEmailAndVerifiedParams) error
- func (q *Queries) UserSetEmailVerified(ctx context.Context, arg UserSetEmailVerifiedParams) error
- func (q *Queries) UserSetLastLogin(ctx context.Context, arg UserSetLastLoginParams) error
- func (q *Queries) UserSetPhoneAndVerified(ctx context.Context, arg UserSetPhoneAndVerifiedParams) error
- func (q *Queries) UserSetPhoneVerifiedByID(ctx context.Context, arg UserSetPhoneVerifiedByIDParams) error
- func (q *Queries) UserSetPhoneVerifiedByIDAndPhone(ctx context.Context, arg UserSetPhoneVerifiedByIDAndPhoneParams) error
- func (q *Queries) UserSetPreferredLanguage(ctx context.Context, arg UserSetPreferredLanguageParams) error
- func (q *Queries) UserSetReserved(ctx context.Context, arg UserSetReservedParams) error
- func (q *Queries) UserSetUsername(ctx context.Context, arg UserSetUsernameParams) error
- func (q *Queries) UserSlugAliases(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserSoftDelete(ctx context.Context, id string) error
- func (q *Queries) UserUsernameByID(ctx context.Context, id string) (string, error)
- func (q *Queries) UserUsernameExists(ctx context.Context, username *string) (bool, error)
- func (q *Queries) UsersPurgeCandidates(ctx context.Context, arg UsersPurgeCandidatesParams) ([]string, error)
- func (q *Queries) WithTx(tx pgx.Tx) *Queries
- type RemoteAppAttributeDefDeleteParams
- type RemoteAppAttributeDefGetLatestParams
- type RemoteAppAttributeDefGetLatestRow
- type RemoteAppAttributeDefGetParams
- type RemoteAppAttributeDefGetRow
- type RemoteAppAttributeDefUpsertParams
- type RemoteAppAttributeDefUpsertRow
- type RemoteAppAttributeDefsListRow
- type RemoteApplicationByIssuerRow
- type RemoteApplicationBySlugRow
- type RemoteApplicationUpsertParams
- type RemoteApplicationUpsertRow
- type RemoteApplicationsAllRow
- type RemoteApplicationsEnabledRow
- type SessionByCurrentTokenHashParams
- type SessionByCurrentTokenHashRow
- type SessionByPreviousTokenHashParams
- type SessionByPreviousTokenHashRow
- type SessionFreshSinceParams
- type SessionFreshSinceRow
- type SessionIDByCurrentTokenHashParams
- type SessionInsertParams
- type SessionInsertRow
- type SessionMarkAuthenticatedParams
- type SessionRevokeByIDForUserParams
- type SessionRevokeByIDParams
- type SessionRotateParams
- type SessionsCountActiveParams
- type SessionsEvictOldestParams
- type SessionsListByUserParams
- type SessionsListByUserRow
- type SessionsRevokeAllExceptParams
- type SessionsRevokeAllParams
- type SessionsRevokeAllQuietParams
- type SessionsRevokeFamilyRow
- type TwoFactorConsumeFactorTOTPStepParams
- type TwoFactorConsumeTOTPStepParams
- type TwoFactorDisableFactorParams
- type TwoFactorEnableParams
- type TwoFactorFactorByUserMethodParams
- type TwoFactorSetBackupCodesParams
- type TwoFactorSetDefaultFactorParams
- type TwoFactorSettingsByUserRow
- type TwoFactorUpsertFactorParams
- type TwoFactorUpsertSettingsParams
- type UserApplyEmailChangeParams
- type UserApplyPhoneChangeParams
- type UserBanParams
- type UserByEmailRow
- type UserByIDRow
- type UserByPhoneRow
- type UserBySlugRow
- type UserBySlugViaRenameRow
- type UserByUsernameRow
- type UserEmailOrUsernameExistsParams
- type UserEmailOrUsernameTakenParams
- type UserEmailOrUsernameTakenRow
- type UserIDReservedByUsernameRow
- type UserImportInsertParams
- type UserImportUpdateParams
- type UserInsertParams
- type UserInsertRow
- type UserMetadataPatchParams
- type UserPasswordInsertParams
- type UserPasswordRowRow
- type UserPasswordUpsertParams
- type UserPhoneOrUsernameExistsParams
- type UserPhoneOrUsernameTakenParams
- type UserPhoneOrUsernameTakenRow
- type UserProviderDeleteBySlugParams
- type UserProviderDeleteOtherSubjectsParams
- type UserProviderInsertSimpleParams
- type UserProviderLinkExistsParams
- type UserProviderMergeProfileParams
- type UserProviderSetUsernameParams
- type UserProviderSubjectByIssuerParams
- type UserProviderSubjectProfileByIssuerParams
- type UserProviderSubjectProfileByIssuerRow
- type UserProviderUpsertByIssuerParams
- type UserProviderUsernameParams
- type UserRenameInsertParams
- type UserSetBiographyParams
- type UserSetEmailAndUnverifyParams
- type UserSetEmailAndVerifiedParams
- type UserSetEmailVerifiedParams
- type UserSetLastLoginParams
- type UserSetPhoneAndVerifiedParams
- type UserSetPhoneVerifiedByIDAndPhoneParams
- type UserSetPhoneVerifiedByIDParams
- type UserSetPreferredLanguageParams
- type UserSetReservedParams
- type UserSetUsernameParams
- type UsersPurgeCandidatesParams
Constants ¶
const DefaultSchema = "profiles"
DefaultSchema is the historical hard-coded schema name. All SQL in this package is written against it; ForSchema rewrites it when a host configures a different schema.
Variables ¶
This section is empty.
Functions ¶
func RewriteSQL ¶ added in v0.26.0
RewriteSQL returns sql with every literal "profiles." qualifier replaced by schema+".". Callers must have validated schema via ValidSchemaName.
func ValidSchemaName ¶ added in v0.26.0
ValidSchemaName reports whether s is acceptable as a configured schema name: lowercase snake_case identifier, at most 63 bytes (the Postgres identifier limit, so the name is never silently truncated server-side).
Types ¶
type DBTX ¶
type DBTX interface {
Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
Query(context.Context, string, ...interface{}) (pgx.Rows, error)
QueryRow(context.Context, string, ...interface{}) pgx.Row
}
func ForSchema ¶ added in v0.26.0
ForSchema wraps d so every statement executed through it has its "profiles." qualifiers rewritten to the given schema. For the default schema (or empty, meaning default) it returns d unchanged, so the default path has zero overhead. The per-call strings.ReplaceAll is negligible next to the network round trip and keeps the wrapper stateless, which matters because transaction-scoped wrappers are created per transaction.
type IdentityUserByIDRow ¶
type IdentityUsersByIDsRow ¶
type NamespaceUserBySlugRow ¶
type ProfilesGroupCustomRole ¶ added in v0.49.0
type ProfilesGroupInvite ¶ added in v0.49.0
type ProfilesGroupRoleAssignment ¶ added in v0.49.0
type ProfilesGroupTypeParent ¶ added in v0.49.0
The declared containment schema (#111): which parent TYPE(s) each group type allows. The app seeds it from core.Config at bootstrap; the permission_group containment trigger enforces it. root is absent (parentless singleton).
type ProfilesPermissionGroup ¶ added in v0.49.0
type ProfilesPermissionGroup struct {
ID string
Type string
ParentID *string
ParentType *string
// Links the group to its app resource AND is the API addressing key: a route (persona, resource-id) resolves to the group via (type, resource_ref). The group id is INTERNAL-only.
ResourceRef *string
Metadata []byte
CreatedAt time.Time
UpdatedAt time.Time
DeletedAt *time.Time
}
type ProfilesRefreshSession ¶
type ProfilesRefreshSession struct {
ID string
UserID string
Issuer string
FamilyID string
CurrentTokenHash []byte
PreviousTokenHash []byte
CreatedAt time.Time
LastAuthenticatedAt *time.Time
LastUsedAt time.Time
ExpiresAt *time.Time
RevokedAt *time.Time
UserAgent *string
IpAddr *string
AuthMethods []string
}
type ProfilesRemoteApplication ¶ added in v0.27.0
type ProfilesRemoteApplication struct {
ID string
Slug string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Audiences []string
Enabled bool
Metadata []byte
CreatedAt time.Time
UpdatedAt time.Time
DeletedAt *time.Time
// REQUIRED controlling permission-group (#111): remote-apps are group-nested. Authority comes from group_role_assignments (subject_kind=remote_application) + the parent walk.
PermissionGroupID string
AllowedOrigins []string
}
Federation principals: external systems that authenticate by signing JWTs verified against their JWKS/public keys. Members of orgs with roles via polymorphic org_memberships.
type ProfilesRemoteApplicationAttributeDef ¶ added in v0.27.0
type ProfilesRemoteApplicationAttributeDef struct {
RemoteApplicationID string
Key string
Version int32
Definition []byte
CreatedAt time.Time
UpdatedAt time.Time
}
REFERENCE-mode attribute definitions: (remote_application_id, key, version) -> opaque definition jsonb. AuthKit transports + serves, never interprets (#75).
type ProfilesServiceToken ¶
type ProfilesServiceToken struct {
ID string
PermissionGroupID string
KeyID string
SecretHash []byte
Name string
CreatedBy *string
CreatedAt time.Time
LastUsedAt *time.Time
ExpiresAt *time.Time
RevokedAt *time.Time
// The single catalog/custom role this API key holds within its permission-group. Effective permissions resolve from the group TYPE catalog (core.Config) or a group_custom_role at use time (#111). Resource-scope is a separate binding (service_token_resources).
Role string
}
type ProfilesTwoFactorFactor ¶ added in v0.54.0
type ProfilesTwoFactorFactor struct {
ID string
UserID string
Method string
PhoneNumber *string
TotpSecret []byte
LastTotpStep *int64
// Default factor AuthKit challenges first when 2FA is required
IsDefault bool
Enabled bool
CreatedAt time.Time
UpdatedAt time.Time
}
Primary enrolled 2FA factors per user; backup codes remain user-scoped on two_factor_settings
type ProfilesTwoFactorSetting ¶
type ProfilesTwoFactorSetting struct {
UserID string
Enabled bool
// Preferred 2FA method: email, sms, or totp
Method string
PhoneNumber *string
// Hashed backup codes for account recovery (10 codes)
BackupCodes []string
CreatedAt time.Time
UpdatedAt time.Time
// Encrypted TOTP shared secret for authenticator-app 2FA
TotpSecret []byte
// Last accepted TOTP time step, used to reject replay
LastTotpStep *int64
}
Two-factor authentication settings per user (admin accounts)
type ProfilesUser ¶
type ProfilesUser struct {
ID string
Email *string
Username *string
DiscordUsername *string
EmailVerified bool
// E.164 format phone number (e.g., +14155551234)
PhoneNumber *string
// Whether the phone number has been verified via SMS code
PhoneVerified *bool
// When the user was banned
BannedAt *time.Time
// When a temporary ban expires (NULL for permanent)
BannedUntil *time.Time
// Reason for ban
BanReason *string
// User ID of admin who imposed ban
BannedBy *string
DeletedAt *time.Time
Biography *string
// Arbitrary user metadata (internal/admin flags such as reserved)
Metadata []byte
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
// User communication/auth language, e.g. en, es, de, ko, zh
PreferredLanguage *string
}
type ProfilesUserPassword ¶
type ProfilesUserProvider ¶
type ProfilesUserRename ¶
type ProviderLinkByIssuerRow ¶
type ProviderLinkBySlugRow ¶
type Queries ¶
type Queries struct {
// contains filtered or unexported fields
}
func (*Queries) IdentityCurrentUsername ¶
Rename-history forwarding (identity/renames.go).
func (*Queries) IdentityForwardUsername ¶
func (*Queries) IdentityUpdateUserEmail ¶
func (q *Queries) IdentityUpdateUserEmail(ctx context.Context, arg IdentityUpdateUserEmailParams) error
func (*Queries) IdentityUpdateUserUsername ¶
func (q *Queries) IdentityUpdateUserUsername(ctx context.Context, arg IdentityUpdateUserUsernameParams) error
func (*Queries) IdentityUserByID ¶
func (*Queries) IdentityUserIDByUsername ¶
func (*Queries) IdentityUsersByIDs ¶
func (q *Queries) IdentityUsersByIDs(ctx context.Context, ids []string) ([]IdentityUsersByIDsRow, error)
Identity store queries (identity package).
func (*Queries) NamespaceUserBySlug ¶
func (q *Queries) NamespaceUserBySlug(ctx context.Context, username *string) (NamespaceUserBySlugRow, error)
Namespace lookup probes (core/owner_namespace_lookup.go). These read soft- deleted rows on purpose (deleted_at IS NOT NULL surfaces as a flag).
func (*Queries) NamespaceUserRenameBySlug ¶
func (*Queries) OwnerReservedNameDelete ¶
func (*Queries) OwnerReservedNameExists ¶
Owner-namespace queries (core/service_owner_namespace*.go, core/owner_namespace_lookup.go).
#111 hard cut: the org plane is gone, so the org-namespace probes (orgs / org_renames) were dropped. Only the user/owner-reserved-name namespace queries remain.
func (*Queries) OwnerReservedNameUpsert ¶
func (*Queries) OwnerSlugUserExists ¶
func (q *Queries) OwnerSlugUserExists(ctx context.Context, arg OwnerSlugUserExistsParams) (bool, error)
Slug-availability probes (core/service_owner_namespace.go ownerSlugAvailable).
func (*Queries) OwnerSlugUserRenameHeld ¶
func (*Queries) ProviderLinkByIssuer ¶
func (q *Queries) ProviderLinkByIssuer(ctx context.Context, arg ProviderLinkByIssuerParams) (ProviderLinkByIssuerRow, error)
func (*Queries) ProviderLinkBySlug ¶
func (q *Queries) ProviderLinkBySlug(ctx context.Context, arg ProviderLinkBySlugParams) (ProviderLinkBySlugRow, error)
func (*Queries) RemoteAppAttributeDefDelete ¶ added in v0.27.0
func (*Queries) RemoteAppAttributeDefGet ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefGet(ctx context.Context, arg RemoteAppAttributeDefGetParams) (RemoteAppAttributeDefGetRow, error)
func (*Queries) RemoteAppAttributeDefGetLatest ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefGetLatest(ctx context.Context, arg RemoteAppAttributeDefGetLatestParams) (RemoteAppAttributeDefGetLatestRow, error)
func (*Queries) RemoteAppAttributeDefUpsert ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefUpsert(ctx context.Context, arg RemoteAppAttributeDefUpsertParams) (RemoteAppAttributeDefUpsertRow, error)
Attribute definition registry (#75): REFERENCE-mode opaque definitions.
func (*Queries) RemoteAppAttributeDefsList ¶ added in v0.27.0
func (*Queries) RemoteApplicationByIssuer ¶ added in v0.27.0
func (*Queries) RemoteApplicationBySlug ¶ added in v0.27.0
func (*Queries) RemoteApplicationDelete ¶ added in v0.27.0
func (*Queries) RemoteApplicationUpsert ¶ added in v0.27.0
func (q *Queries) RemoteApplicationUpsert(ctx context.Context, arg RemoteApplicationUpsertParams) (RemoteApplicationUpsertRow, error)
Remote application registry (core/service_remote_applications.go). A remote_application is the federation PRINCIPAL: it authenticates by signing JWTs verified against its JWKS/public keys (#74).
#111: the controlling group column was renamed org_id -> permission_group_id. The sqlc arg/output names stay `org_id` so the generated Go field is OrgID — the authbase RemoteApplication.OrgID field is deliberately retained and now carries the controlling permission_group_id.
func (*Queries) RemoteApplicationsAll ¶ added in v0.27.0
func (q *Queries) RemoteApplicationsAll(ctx context.Context) ([]RemoteApplicationsAllRow, error)
func (*Queries) RemoteApplicationsEnabled ¶ added in v0.27.0
func (q *Queries) RemoteApplicationsEnabled(ctx context.Context) ([]RemoteApplicationsEnabledRow, error)
func (*Queries) SessionByCurrentTokenHash ¶
func (q *Queries) SessionByCurrentTokenHash(ctx context.Context, arg SessionByCurrentTokenHashParams) (SessionByCurrentTokenHashRow, error)
func (*Queries) SessionByPreviousTokenHash ¶
func (q *Queries) SessionByPreviousTokenHash(ctx context.Context, arg SessionByPreviousTokenHashParams) (SessionByPreviousTokenHashRow, error)
func (*Queries) SessionFreshSince ¶
func (q *Queries) SessionFreshSince(ctx context.Context, arg SessionFreshSinceParams) (SessionFreshSinceRow, error)
func (*Queries) SessionIDByCurrentTokenHash ¶
func (*Queries) SessionInsert ¶
func (q *Queries) SessionInsert(ctx context.Context, arg SessionInsertParams) (SessionInsertRow, error)
Refresh-session queries (core/service_sessions.go).
func (*Queries) SessionMarkAuthenticated ¶
func (*Queries) SessionRevokeByID ¶
func (*Queries) SessionRevokeByIDForUser ¶
func (*Queries) SessionRotate ¶
func (q *Queries) SessionRotate(ctx context.Context, arg SessionRotateParams) error
func (*Queries) SessionsCountActive ¶
func (*Queries) SessionsDeleteRevokedOrExpired ¶
func (*Queries) SessionsEvictOldest ¶
func (*Queries) SessionsListByUser ¶
func (q *Queries) SessionsListByUser(ctx context.Context, arg SessionsListByUserParams) ([]SessionsListByUserRow, error)
func (*Queries) SessionsRevokeAll ¶
func (*Queries) SessionsRevokeAllExcept ¶
func (*Queries) SessionsRevokeAllQuiet ¶
func (q *Queries) SessionsRevokeAllQuiet(ctx context.Context, arg SessionsRevokeAllQuietParams) error
SessionsRevokeAllQuiet is AdminDeleteUser's pre-delete sweep; unlike SessionsRevokeAll it returns nothing (no per-session revoke logging).
func (*Queries) SessionsRevokeFamily ¶
func (*Queries) TwoFactorClearDefaultFactors ¶ added in v0.54.0
func (*Queries) TwoFactorConsumeFactorTOTPStep ¶ added in v0.54.0
func (*Queries) TwoFactorConsumeTOTPStep ¶ added in v0.53.0
func (*Queries) TwoFactorDefaultFactorByUser ¶ added in v0.54.0
func (*Queries) TwoFactorDelete ¶ added in v0.54.0
func (*Queries) TwoFactorDisable ¶
func (*Queries) TwoFactorDisableAllFactors ¶ added in v0.54.0
func (*Queries) TwoFactorDisableFactor ¶ added in v0.54.0
func (*Queries) TwoFactorEnable ¶
func (q *Queries) TwoFactorEnable(ctx context.Context, arg TwoFactorEnableParams) error
Two-factor settings queries (core/service.go).
func (*Queries) TwoFactorFactorByUserMethod ¶ added in v0.54.0
func (q *Queries) TwoFactorFactorByUserMethod(ctx context.Context, arg TwoFactorFactorByUserMethodParams) (ProfilesTwoFactorFactor, error)
func (*Queries) TwoFactorListFactorsByUser ¶ added in v0.54.0
func (*Queries) TwoFactorSetBackupCodes ¶
func (q *Queries) TwoFactorSetBackupCodes(ctx context.Context, arg TwoFactorSetBackupCodesParams) error
func (*Queries) TwoFactorSetDefaultFactor ¶ added in v0.54.0
func (*Queries) TwoFactorSettingsByUser ¶
func (*Queries) TwoFactorUpsertFactor ¶ added in v0.54.0
func (q *Queries) TwoFactorUpsertFactor(ctx context.Context, arg TwoFactorUpsertFactorParams) (ProfilesTwoFactorFactor, error)
func (*Queries) TwoFactorUpsertSettings ¶ added in v0.54.0
func (q *Queries) TwoFactorUpsertSettings(ctx context.Context, arg TwoFactorUpsertSettingsParams) error
func (*Queries) UserApplyEmailChange ¶
func (q *Queries) UserApplyEmailChange(ctx context.Context, arg UserApplyEmailChangeParams) error
func (*Queries) UserApplyPhoneChange ¶
func (q *Queries) UserApplyPhoneChange(ctx context.Context, arg UserApplyPhoneChangeParams) error
func (*Queries) UserByEmail ¶
func (*Queries) UserByPhone ¶
func (*Queries) UserBySlug ¶
func (*Queries) UserBySlugViaRename ¶
func (q *Queries) UserBySlugViaRename(ctx context.Context, fromSlug string) (UserBySlugViaRenameRow, error)
Fallback to renames table (issue #58). Most-recent rename wins when a slug has been used by multiple users at different times (only possible after hard-delete + reuse).
func (*Queries) UserByUsername ¶
func (*Queries) UserClearLoginIdentifiers ¶
func (*Queries) UserDeleteHard ¶
func (*Queries) UserDiscordUsername ¶
func (*Queries) UserEmailByID ¶
User-row queries (core/service.go).
func (*Queries) UserEmailOrUsernameExists ¶
func (*Queries) UserEmailOrUsernameTaken ¶
func (q *Queries) UserEmailOrUsernameTaken(ctx context.Context, arg UserEmailOrUsernameTakenParams) (UserEmailOrUsernameTakenRow, error)
func (*Queries) UserHasPassword ¶
func (*Queries) UserIDReservedByUsername ¶
func (*Queries) UserImportInsert ¶
func (q *Queries) UserImportInsert(ctx context.Context, arg UserImportInsertParams) error
func (*Queries) UserImportUpdate ¶
func (*Queries) UserInsert ¶
func (q *Queries) UserInsert(ctx context.Context, arg UserInsertParams) (UserInsertRow, error)
func (*Queries) UserIsReserved ¶
func (*Queries) UserLastRenamedAt ¶
func (*Queries) UserMetadata ¶
func (*Queries) UserMetadataPatch ¶
func (*Queries) UserPasswordDelete ¶
func (*Queries) UserPasswordInsert ¶
func (q *Queries) UserPasswordInsert(ctx context.Context, arg UserPasswordInsertParams) error
func (*Queries) UserPasswordRow ¶
func (*Queries) UserPasswordUpsert ¶
func (q *Queries) UserPasswordUpsert(ctx context.Context, arg UserPasswordUpsertParams) error
func (*Queries) UserPhoneOrUsernameExists ¶
func (*Queries) UserPhoneOrUsernameTaken ¶
func (q *Queries) UserPhoneOrUsernameTaken(ctx context.Context, arg UserPhoneOrUsernameTakenParams) (UserPhoneOrUsernameTakenRow, error)
func (*Queries) UserPreferredLanguage ¶ added in v0.54.0
func (*Queries) UserProviderDeleteBySlug ¶
func (q *Queries) UserProviderDeleteBySlug(ctx context.Context, arg UserProviderDeleteBySlugParams) error
func (*Queries) UserProviderDeleteOtherSubjects ¶
func (q *Queries) UserProviderDeleteOtherSubjects(ctx context.Context, arg UserProviderDeleteOtherSubjectsParams) error
func (*Queries) UserProviderInsertSimple ¶
func (q *Queries) UserProviderInsertSimple(ctx context.Context, arg UserProviderInsertSimpleParams) error
func (*Queries) UserProviderLinkExists ¶
func (q *Queries) UserProviderLinkExists(ctx context.Context, arg UserProviderLinkExistsParams) (bool, error)
HTTP-layer provider lookups (http/reauth.go, http/user_me_get.go).
func (*Queries) UserProviderMergeProfile ¶
func (q *Queries) UserProviderMergeProfile(ctx context.Context, arg UserProviderMergeProfileParams) error
func (*Queries) UserProviderSetUsername ¶
func (q *Queries) UserProviderSetUsername(ctx context.Context, arg UserProviderSetUsernameParams) error
func (*Queries) UserProviderSlugs ¶
func (*Queries) UserProviderSlugsDistinct ¶
func (*Queries) UserProviderSubjectByIssuer ¶
func (*Queries) UserProviderSubjectProfileByIssuer ¶
func (q *Queries) UserProviderSubjectProfileByIssuer(ctx context.Context, arg UserProviderSubjectProfileByIssuerParams) (UserProviderSubjectProfileByIssuerRow, error)
func (*Queries) UserProviderUpsertByIssuer ¶
func (q *Queries) UserProviderUpsertByIssuer(ctx context.Context, arg UserProviderUpsertByIssuerParams) error
func (*Queries) UserProviderUsername ¶
func (*Queries) UserProvidersCount ¶
Provider-link queries (core/service.go).
func (*Queries) UserProvidersDeleteByUser ¶
func (*Queries) UserRenameInsert ¶
func (q *Queries) UserRenameInsert(ctx context.Context, arg UserRenameInsertParams) error
func (*Queries) UserSetBiography ¶
func (q *Queries) UserSetBiography(ctx context.Context, arg UserSetBiographyParams) error
func (*Queries) UserSetEmailAndUnverify ¶
func (q *Queries) UserSetEmailAndUnverify(ctx context.Context, arg UserSetEmailAndUnverifyParams) error
func (*Queries) UserSetEmailAndVerified ¶ added in v0.54.0
func (q *Queries) UserSetEmailAndVerified(ctx context.Context, arg UserSetEmailAndVerifiedParams) error
func (*Queries) UserSetEmailVerified ¶
func (q *Queries) UserSetEmailVerified(ctx context.Context, arg UserSetEmailVerifiedParams) error
func (*Queries) UserSetLastLogin ¶
func (q *Queries) UserSetLastLogin(ctx context.Context, arg UserSetLastLoginParams) error
func (*Queries) UserSetPhoneAndVerified ¶
func (q *Queries) UserSetPhoneAndVerified(ctx context.Context, arg UserSetPhoneAndVerifiedParams) error
func (*Queries) UserSetPhoneVerifiedByID ¶
func (q *Queries) UserSetPhoneVerifiedByID(ctx context.Context, arg UserSetPhoneVerifiedByIDParams) error
func (*Queries) UserSetPhoneVerifiedByIDAndPhone ¶
func (q *Queries) UserSetPhoneVerifiedByIDAndPhone(ctx context.Context, arg UserSetPhoneVerifiedByIDAndPhoneParams) error
func (*Queries) UserSetPreferredLanguage ¶ added in v0.54.0
func (q *Queries) UserSetPreferredLanguage(ctx context.Context, arg UserSetPreferredLanguageParams) error
func (*Queries) UserSetReserved ¶
func (q *Queries) UserSetReserved(ctx context.Context, arg UserSetReservedParams) error
Reserved-account + metadata queries (core/service_reserved_accounts.go).
func (*Queries) UserSetUsername ¶
func (q *Queries) UserSetUsername(ctx context.Context, arg UserSetUsernameParams) error
func (*Queries) UserSlugAliases ¶
func (*Queries) UserSoftDelete ¶
func (*Queries) UserUsernameByID ¶
func (*Queries) UserUsernameExists ¶
func (*Queries) UsersPurgeCandidates ¶
type RemoteAppAttributeDefDeleteParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetLatestParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetLatestRow ¶ added in v0.27.0
type RemoteAppAttributeDefGetParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetRow ¶ added in v0.27.0
type RemoteAppAttributeDefUpsertParams ¶ added in v0.27.0
type RemoteAppAttributeDefUpsertRow ¶ added in v0.27.0
type RemoteAppAttributeDefsListRow ¶ added in v0.27.0
type RemoteApplicationByIssuerRow ¶ added in v0.27.0
type RemoteApplicationBySlugRow ¶ added in v0.27.0
type RemoteApplicationUpsertParams ¶ added in v0.27.0
type RemoteApplicationUpsertRow ¶ added in v0.27.0
type RemoteApplicationsAllRow ¶ added in v0.27.0
type RemoteApplicationsEnabledRow ¶ added in v0.27.0
type SessionFreshSinceParams ¶
type SessionFreshSinceRow ¶ added in v0.52.0
type SessionInsertParams ¶
type SessionInsertRow ¶
type SessionRevokeByIDParams ¶
type SessionRotateParams ¶
type SessionsListByUserRow ¶
type SessionsRevokeAllParams ¶
type SessionsRevokeFamilyRow ¶
type TwoFactorConsumeFactorTOTPStepParams ¶ added in v0.54.0
type TwoFactorConsumeTOTPStepParams ¶ added in v0.53.0
type TwoFactorDisableFactorParams ¶ added in v0.54.0
type TwoFactorEnableParams ¶
type TwoFactorFactorByUserMethodParams ¶ added in v0.54.0
type TwoFactorSetDefaultFactorParams ¶ added in v0.54.0
type TwoFactorSettingsByUserRow ¶ added in v0.53.0
type TwoFactorUpsertFactorParams ¶ added in v0.54.0
type TwoFactorUpsertSettingsParams ¶ added in v0.54.0
type UserBanParams ¶
type UserByEmailRow ¶
type UserByEmailRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
DiscordUsername *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}
type UserByIDRow ¶
type UserByIDRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
DiscordUsername *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}
type UserByPhoneRow ¶
type UserByPhoneRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
DiscordUsername *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}
type UserBySlugRow ¶
type UserBySlugViaRenameRow ¶
type UserByUsernameRow ¶
type UserByUsernameRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
DiscordUsername *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}