Documentation
¶
Overview ¶
Schema indirection (authkit issue 69).
Every SQL statement in authkit — the sqlc-generated constants in this package and the few raw statements in core — is schema-qualified with the literal prefix "profiles.". Hosts embed authkit with a pgx pool that is SHARED with their own queries, so pointing authkit at a different schema via search_path on the pool is ruled out (it would leak into host queries). Instead the qualifier stays in the SQL text and becomes a variable: ForSchema wraps a DBTX so the "profiles." prefix is rewritten to "<schema>." on every statement at execution time. This is a deliberate, documented string substitution: schema names are validated against a strict identifier grammar (ValidSchemaName) at configuration time, every authkit table/function reference is written as `profiles.<name>` (guarded by a test in this package), and the rewrite is the identity (no wrapper at all) for the default schema, so existing embedders see zero change.
Index ¶
- Constants
- func RewriteSQL(sql, schema string) string
- func ValidSchemaName(s string) bool
- type DBTX
- type IdentityUpdateUserEmailParams
- type IdentityUpdateUserUsernameParams
- type IdentityUserByIDRow
- type IdentityUsersByIDsRow
- type MFAConsumeFactorTOTPStepParams
- type MFADeleteFactorParams
- type MFAFactorByUserMethodParams
- type MFASetBackupCodesParams
- type MFASetDefaultFactorParams
- type MFAUpsertFactorParams
- type MFAUpsertSettingsParams
- type NamespaceUserBySlugRow
- type NamespaceUserRenameBySlugRow
- type OwnerSlugUserExistsParams
- type OwnerSlugUserRenameHeldParams
- type ProfilesApiKey
- type ProfilesApiKeyResource
- type ProfilesGroupCustomRole
- type ProfilesGroupInvite
- type ProfilesGroupPersonaParent
- type ProfilesGroupRemoteApplicationRole
- type ProfilesGroupUserRole
- type ProfilesMfaFactor
- type ProfilesMfaSetting
- type ProfilesOwnerReservedName
- type ProfilesPermissionGroup
- type ProfilesRefreshSession
- type ProfilesRemoteApplication
- type ProfilesRemoteApplicationAttributeDef
- type ProfilesUser
- type ProfilesUserPasskey
- type ProfilesUserPasskeyHandle
- type ProfilesUserPassword
- type ProfilesUserProvider
- type ProfilesUserRename
- type ProviderLinkByIssuerParams
- type ProviderLinkByIssuerRow
- type ProviderLinkBySlugParams
- type ProviderLinkBySlugRow
- type Queries
- func (q *Queries) GroupAssignmentsDeleteByUser(ctx context.Context, userID string) error
- func (q *Queries) GroupInvitesDeleteByInviter(ctx context.Context, userID string) error
- func (q *Queries) IdentityCurrentUsername(ctx context.Context, username *string) (*string, error)
- func (q *Queries) IdentityForwardUsername(ctx context.Context, fromSlug string) (*string, error)
- func (q *Queries) IdentityUpdateUserEmail(ctx context.Context, arg IdentityUpdateUserEmailParams) error
- func (q *Queries) IdentityUpdateUserUsername(ctx context.Context, arg IdentityUpdateUserUsernameParams) error
- func (q *Queries) IdentityUserByID(ctx context.Context, id string) (IdentityUserByIDRow, error)
- func (q *Queries) IdentityUserIDByUsername(ctx context.Context, username *string) (string, error)
- func (q *Queries) IdentityUsersByIDs(ctx context.Context, ids []string) ([]IdentityUsersByIDsRow, error)
- func (q *Queries) MFAClearDefaultFactors(ctx context.Context, userID string) error
- func (q *Queries) MFAConsumeFactorTOTPStep(ctx context.Context, arg MFAConsumeFactorTOTPStepParams) (int64, error)
- func (q *Queries) MFADefaultFactorByUser(ctx context.Context, userID string) (ProfilesMfaFactor, error)
- func (q *Queries) MFADelete(ctx context.Context, userID string) error
- func (q *Queries) MFADeleteAllFactors(ctx context.Context, userID string) error
- func (q *Queries) MFADeleteFactor(ctx context.Context, arg MFADeleteFactorParams) (int64, error)
- func (q *Queries) MFADisable(ctx context.Context, userID string) error
- func (q *Queries) MFAFactorByUserMethod(ctx context.Context, arg MFAFactorByUserMethodParams) (ProfilesMfaFactor, error)
- func (q *Queries) MFAListFactorsByUser(ctx context.Context, userID string) ([]ProfilesMfaFactor, error)
- func (q *Queries) MFASetBackupCodes(ctx context.Context, arg MFASetBackupCodesParams) error
- func (q *Queries) MFASetDefaultFactor(ctx context.Context, arg MFASetDefaultFactorParams) (int64, error)
- func (q *Queries) MFASettingsByUser(ctx context.Context, userID string) (ProfilesMfaSetting, error)
- func (q *Queries) MFAUpsertFactor(ctx context.Context, arg MFAUpsertFactorParams) (ProfilesMfaFactor, error)
- func (q *Queries) MFAUpsertSettings(ctx context.Context, arg MFAUpsertSettingsParams) error
- func (q *Queries) NamespaceUserBySlug(ctx context.Context, username *string) (NamespaceUserBySlugRow, error)
- func (q *Queries) NamespaceUserRenameBySlug(ctx context.Context, fromSlug string) (NamespaceUserRenameBySlugRow, error)
- func (q *Queries) OwnerReservedNameDelete(ctx context.Context, slug string) (int64, error)
- func (q *Queries) OwnerReservedNameExists(ctx context.Context, slug string) (bool, error)
- func (q *Queries) OwnerReservedNameUpsert(ctx context.Context, slug string) error
- func (q *Queries) OwnerSlugUserExists(ctx context.Context, arg OwnerSlugUserExistsParams) (bool, error)
- func (q *Queries) OwnerSlugUserRenameHeld(ctx context.Context, arg OwnerSlugUserRenameHeldParams) (bool, error)
- func (q *Queries) ProviderLinkByIssuer(ctx context.Context, arg ProviderLinkByIssuerParams) (ProviderLinkByIssuerRow, error)
- func (q *Queries) ProviderLinkBySlug(ctx context.Context, arg ProviderLinkBySlugParams) (ProviderLinkBySlugRow, error)
- func (q *Queries) RemoteAppAttributeDefDelete(ctx context.Context, arg RemoteAppAttributeDefDeleteParams) (int64, error)
- func (q *Queries) RemoteAppAttributeDefGet(ctx context.Context, arg RemoteAppAttributeDefGetParams) (RemoteAppAttributeDefGetRow, error)
- func (q *Queries) RemoteAppAttributeDefGetLatest(ctx context.Context, arg RemoteAppAttributeDefGetLatestParams) (RemoteAppAttributeDefGetLatestRow, error)
- func (q *Queries) RemoteAppAttributeDefUpsert(ctx context.Context, arg RemoteAppAttributeDefUpsertParams) (RemoteAppAttributeDefUpsertRow, error)
- func (q *Queries) RemoteAppAttributeDefsList(ctx context.Context, remoteApplicationID string) ([]RemoteAppAttributeDefsListRow, error)
- func (q *Queries) RemoteApplicationByIssuer(ctx context.Context, issuer string) (RemoteApplicationByIssuerRow, error)
- func (q *Queries) RemoteApplicationBySlug(ctx context.Context, slug string) (RemoteApplicationBySlugRow, error)
- func (q *Queries) RemoteApplicationDelete(ctx context.Context, issuer string) (int64, error)
- func (q *Queries) RemoteApplicationUpsert(ctx context.Context, arg RemoteApplicationUpsertParams) (RemoteApplicationUpsertRow, error)
- func (q *Queries) RemoteApplicationsAll(ctx context.Context) ([]RemoteApplicationsAllRow, error)
- func (q *Queries) RemoteApplicationsEnabled(ctx context.Context) ([]RemoteApplicationsEnabledRow, error)
- func (q *Queries) SessionByCurrentTokenHash(ctx context.Context, arg SessionByCurrentTokenHashParams) (SessionByCurrentTokenHashRow, error)
- func (q *Queries) SessionByPreviousTokenHash(ctx context.Context, arg SessionByPreviousTokenHashParams) (SessionByPreviousTokenHashRow, error)
- func (q *Queries) SessionFreshSince(ctx context.Context, arg SessionFreshSinceParams) (SessionFreshSinceRow, error)
- func (q *Queries) SessionIDByCurrentTokenHash(ctx context.Context, arg SessionIDByCurrentTokenHashParams) (string, error)
- func (q *Queries) SessionInsert(ctx context.Context, arg SessionInsertParams) (SessionInsertRow, error)
- func (q *Queries) SessionMarkAuthenticated(ctx context.Context, arg SessionMarkAuthenticatedParams) (int64, error)
- func (q *Queries) SessionRevokeByID(ctx context.Context, arg SessionRevokeByIDParams) (string, error)
- func (q *Queries) SessionRevokeByIDForUser(ctx context.Context, arg SessionRevokeByIDForUserParams) (string, error)
- func (q *Queries) SessionRotate(ctx context.Context, arg SessionRotateParams) error
- func (q *Queries) SessionsCountActive(ctx context.Context, arg SessionsCountActiveParams) (int64, error)
- func (q *Queries) SessionsDeleteRevokedOrExpired(ctx context.Context) error
- func (q *Queries) SessionsEvictOldest(ctx context.Context, arg SessionsEvictOldestParams) ([]string, error)
- func (q *Queries) SessionsListByUser(ctx context.Context, arg SessionsListByUserParams) ([]SessionsListByUserRow, error)
- func (q *Queries) SessionsRevokeAll(ctx context.Context, arg SessionsRevokeAllParams) ([]string, error)
- func (q *Queries) SessionsRevokeAllExcept(ctx context.Context, arg SessionsRevokeAllExceptParams) ([]string, error)
- func (q *Queries) SessionsRevokeAllQuiet(ctx context.Context, arg SessionsRevokeAllQuietParams) error
- func (q *Queries) SessionsRevokeFamily(ctx context.Context, familyID string) ([]SessionsRevokeFamilyRow, error)
- func (q *Queries) UserApplyEmailChange(ctx context.Context, arg UserApplyEmailChangeParams) error
- func (q *Queries) UserApplyPhoneChange(ctx context.Context, arg UserApplyPhoneChangeParams) error
- func (q *Queries) UserBan(ctx context.Context, arg UserBanParams) error
- func (q *Queries) UserByEmail(ctx context.Context, email string) (UserByEmailRow, error)
- func (q *Queries) UserByID(ctx context.Context, id string) (UserByIDRow, error)
- func (q *Queries) UserByPhone(ctx context.Context, phoneNumber *string) (UserByPhoneRow, error)
- func (q *Queries) UserBySlug(ctx context.Context, username *string) (UserBySlugRow, error)
- func (q *Queries) UserBySlugViaRename(ctx context.Context, fromSlug string) (UserBySlugViaRenameRow, error)
- func (q *Queries) UserByUsername(ctx context.Context, username *string) (UserByUsernameRow, error)
- func (q *Queries) UserClearBan(ctx context.Context, id string) error
- func (q *Queries) UserClearLoginIdentifiers(ctx context.Context, id string) error
- func (q *Queries) UserDeleteHard(ctx context.Context, id string) error
- func (q *Queries) UserEmailByID(ctx context.Context, id string) (*string, error)
- func (q *Queries) UserEmailOrUsernameExists(ctx context.Context, arg UserEmailOrUsernameExistsParams) (bool, error)
- func (q *Queries) UserEmailOrUsernameTaken(ctx context.Context, arg UserEmailOrUsernameTakenParams) (UserEmailOrUsernameTakenRow, error)
- func (q *Queries) UserHasPassword(ctx context.Context, userID string) (bool, error)
- func (q *Queries) UserIDReservedByUsername(ctx context.Context, username *string) (UserIDReservedByUsernameRow, error)
- func (q *Queries) UserImportInsert(ctx context.Context, arg UserImportInsertParams) error
- func (q *Queries) UserImportUpdate(ctx context.Context, arg UserImportUpdateParams) (string, error)
- func (q *Queries) UserInsert(ctx context.Context, arg UserInsertParams) (UserInsertRow, error)
- func (q *Queries) UserIsReserved(ctx context.Context, id string) (bool, error)
- func (q *Queries) UserLastRenamedAt(ctx context.Context, userID string) (time.Time, error)
- func (q *Queries) UserMetadata(ctx context.Context, id string) ([]byte, error)
- func (q *Queries) UserMetadataPatch(ctx context.Context, arg UserMetadataPatchParams) (int64, error)
- func (q *Queries) UserPasswordDelete(ctx context.Context, userID string) error
- func (q *Queries) UserPasswordInsert(ctx context.Context, arg UserPasswordInsertParams) error
- func (q *Queries) UserPasswordRow(ctx context.Context, userID string) (UserPasswordRowRow, error)
- func (q *Queries) UserPasswordUpsert(ctx context.Context, arg UserPasswordUpsertParams) error
- func (q *Queries) UserPhoneOrUsernameExists(ctx context.Context, arg UserPhoneOrUsernameExistsParams) (bool, error)
- func (q *Queries) UserPhoneOrUsernameTaken(ctx context.Context, arg UserPhoneOrUsernameTakenParams) (UserPhoneOrUsernameTakenRow, error)
- func (q *Queries) UserPreferredLanguage(ctx context.Context, id string) (string, error)
- func (q *Queries) UserProviderDeleteBySlug(ctx context.Context, arg UserProviderDeleteBySlugParams) error
- func (q *Queries) UserProviderDeleteOtherSubjects(ctx context.Context, arg UserProviderDeleteOtherSubjectsParams) error
- func (q *Queries) UserProviderInsertSimple(ctx context.Context, arg UserProviderInsertSimpleParams) error
- func (q *Queries) UserProviderLinkExists(ctx context.Context, arg UserProviderLinkExistsParams) (bool, error)
- func (q *Queries) UserProviderMergeProfile(ctx context.Context, arg UserProviderMergeProfileParams) error
- func (q *Queries) UserProviderSetUsername(ctx context.Context, arg UserProviderSetUsernameParams) error
- func (q *Queries) UserProviderSlugs(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserProviderSlugsDistinct(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserProviderSubjectByIssuer(ctx context.Context, arg UserProviderSubjectByIssuerParams) (string, error)
- func (q *Queries) UserProviderSubjectProfileByIssuer(ctx context.Context, arg UserProviderSubjectProfileByIssuerParams) (UserProviderSubjectProfileByIssuerRow, error)
- func (q *Queries) UserProviderUpsertByIssuer(ctx context.Context, arg UserProviderUpsertByIssuerParams) error
- func (q *Queries) UserProviderUsername(ctx context.Context, arg UserProviderUsernameParams) (*string, error)
- func (q *Queries) UserProvidersCount(ctx context.Context, userID string) (int64, error)
- func (q *Queries) UserProvidersDeleteByUser(ctx context.Context, userID string) error
- func (q *Queries) UserRenameInsert(ctx context.Context, arg UserRenameInsertParams) error
- func (q *Queries) UserRestore(ctx context.Context, id string) error
- func (q *Queries) UserSetBiography(ctx context.Context, arg UserSetBiographyParams) error
- func (q *Queries) UserSetEmailAndUnverify(ctx context.Context, arg UserSetEmailAndUnverifyParams) error
- func (q *Queries) UserSetEmailAndVerified(ctx context.Context, arg UserSetEmailAndVerifiedParams) error
- func (q *Queries) UserSetEmailVerified(ctx context.Context, arg UserSetEmailVerifiedParams) error
- func (q *Queries) UserSetLastLogin(ctx context.Context, arg UserSetLastLoginParams) error
- func (q *Queries) UserSetPhoneAndVerified(ctx context.Context, arg UserSetPhoneAndVerifiedParams) error
- func (q *Queries) UserSetPhoneVerifiedByID(ctx context.Context, arg UserSetPhoneVerifiedByIDParams) error
- func (q *Queries) UserSetPhoneVerifiedByIDAndPhone(ctx context.Context, arg UserSetPhoneVerifiedByIDAndPhoneParams) error
- func (q *Queries) UserSetPreferredLanguage(ctx context.Context, arg UserSetPreferredLanguageParams) error
- func (q *Queries) UserSetReserved(ctx context.Context, arg UserSetReservedParams) error
- func (q *Queries) UserSetUsername(ctx context.Context, arg UserSetUsernameParams) error
- func (q *Queries) UserSlugAliases(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserSoftDelete(ctx context.Context, id string) error
- func (q *Queries) UserUsernameByID(ctx context.Context, id string) (string, error)
- func (q *Queries) UserUsernameExists(ctx context.Context, username *string) (bool, error)
- func (q *Queries) UsersPurgeCandidates(ctx context.Context, arg UsersPurgeCandidatesParams) ([]string, error)
- func (q *Queries) WithTx(tx pgx.Tx) *Queries
- type RemoteAppAttributeDefDeleteParams
- type RemoteAppAttributeDefGetLatestParams
- type RemoteAppAttributeDefGetLatestRow
- type RemoteAppAttributeDefGetParams
- type RemoteAppAttributeDefGetRow
- type RemoteAppAttributeDefUpsertParams
- type RemoteAppAttributeDefUpsertRow
- type RemoteAppAttributeDefsListRow
- type RemoteApplicationByIssuerRow
- type RemoteApplicationBySlugRow
- type RemoteApplicationUpsertParams
- type RemoteApplicationUpsertRow
- type RemoteApplicationsAllRow
- type RemoteApplicationsEnabledRow
- type SessionByCurrentTokenHashParams
- type SessionByCurrentTokenHashRow
- type SessionByPreviousTokenHashParams
- type SessionByPreviousTokenHashRow
- type SessionFreshSinceParams
- type SessionFreshSinceRow
- type SessionIDByCurrentTokenHashParams
- type SessionInsertParams
- type SessionInsertRow
- type SessionMarkAuthenticatedParams
- type SessionRevokeByIDForUserParams
- type SessionRevokeByIDParams
- type SessionRotateParams
- type SessionsCountActiveParams
- type SessionsEvictOldestParams
- type SessionsListByUserParams
- type SessionsListByUserRow
- type SessionsRevokeAllExceptParams
- type SessionsRevokeAllParams
- type SessionsRevokeAllQuietParams
- type SessionsRevokeFamilyRow
- type UserApplyEmailChangeParams
- type UserApplyPhoneChangeParams
- type UserBanParams
- type UserByEmailRow
- type UserByIDRow
- type UserByPhoneRow
- type UserBySlugRow
- type UserBySlugViaRenameRow
- type UserByUsernameRow
- type UserEmailOrUsernameExistsParams
- type UserEmailOrUsernameTakenParams
- type UserEmailOrUsernameTakenRow
- type UserIDReservedByUsernameRow
- type UserImportInsertParams
- type UserImportUpdateParams
- type UserInsertParams
- type UserInsertRow
- type UserMetadataPatchParams
- type UserPasswordInsertParams
- type UserPasswordRowRow
- type UserPasswordUpsertParams
- type UserPhoneOrUsernameExistsParams
- type UserPhoneOrUsernameTakenParams
- type UserPhoneOrUsernameTakenRow
- type UserProviderDeleteBySlugParams
- type UserProviderDeleteOtherSubjectsParams
- type UserProviderInsertSimpleParams
- type UserProviderLinkExistsParams
- type UserProviderMergeProfileParams
- type UserProviderSetUsernameParams
- type UserProviderSubjectByIssuerParams
- type UserProviderSubjectProfileByIssuerParams
- type UserProviderSubjectProfileByIssuerRow
- type UserProviderUpsertByIssuerParams
- type UserProviderUsernameParams
- type UserRenameInsertParams
- type UserSetBiographyParams
- type UserSetEmailAndUnverifyParams
- type UserSetEmailAndVerifiedParams
- type UserSetEmailVerifiedParams
- type UserSetLastLoginParams
- type UserSetPhoneAndVerifiedParams
- type UserSetPhoneVerifiedByIDAndPhoneParams
- type UserSetPhoneVerifiedByIDParams
- type UserSetPreferredLanguageParams
- type UserSetReservedParams
- type UserSetUsernameParams
- type UsersPurgeCandidatesParams
Constants ¶
const DefaultSchema = "profiles"
DefaultSchema is the historical hard-coded schema name. All SQL in this package is written against it; ForSchema rewrites it when a host configures a different schema.
Variables ¶
This section is empty.
Functions ¶
func RewriteSQL ¶ added in v0.26.0
RewriteSQL returns sql with every literal "profiles." qualifier replaced by schema+".". Callers must have validated schema via ValidSchemaName.
func ValidSchemaName ¶ added in v0.26.0
ValidSchemaName reports whether s is acceptable as a configured schema name: lowercase snake_case identifier, at most 63 bytes (the Postgres identifier limit, so the name is never silently truncated server-side).
Types ¶
type DBTX ¶
type DBTX interface {
Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
Query(context.Context, string, ...interface{}) (pgx.Rows, error)
QueryRow(context.Context, string, ...interface{}) pgx.Row
}
func ForSchema ¶ added in v0.26.0
ForSchema wraps d so every statement executed through it has its "profiles." qualifiers rewritten to the given schema. For the default schema (or empty, meaning default) it returns d unchanged, so the default path has zero overhead. The per-call strings.ReplaceAll is negligible next to the network round trip and keeps the wrapper stateless, which matters because transaction-scoped wrappers are created per transaction.
type IdentityUserByIDRow ¶
type IdentityUsersByIDsRow ¶
type MFAConsumeFactorTOTPStepParams ¶ added in v0.56.0
type MFADeleteFactorParams ¶ added in v0.56.0
type MFAFactorByUserMethodParams ¶ added in v0.56.0
type MFASetBackupCodesParams ¶ added in v0.56.0
type MFASetDefaultFactorParams ¶ added in v0.56.0
type MFAUpsertFactorParams ¶ added in v0.56.0
type MFAUpsertSettingsParams ¶ added in v0.56.0
type NamespaceUserBySlugRow ¶
type ProfilesApiKey ¶ added in v0.56.0
type ProfilesApiKey struct {
ID string
PermissionGroupID string
KeyID string
SecretHash []byte
Name string
CreatedBy *string
CreatedAt time.Time
LastUsedAt *time.Time
ExpiresAt *time.Time
RevokedAt *time.Time
// The single catalog/custom role this API key holds within its permission-group. Resource-scope is a separate binding.
Role string
}
type ProfilesApiKeyResource ¶ added in v0.56.0
type ProfilesGroupCustomRole ¶ added in v0.49.0
type ProfilesGroupInvite ¶ added in v0.49.0
type ProfilesGroupPersonaParent ¶ added in v0.56.0
type ProfilesGroupPersonaParent struct {
Persona string
AllowedParentPersona string
CreatedAt time.Time
}
Declared containment schema: which parent persona each permission-group persona allows. root is absent.
type ProfilesGroupRemoteApplicationRole ¶ added in v0.56.0
type ProfilesGroupUserRole ¶ added in v0.56.0
type ProfilesMfaFactor ¶ added in v0.56.0
type ProfilesMfaFactor struct {
ID string
UserID string
Method string
PhoneNumber *string
TotpSecret []byte
LastTotpStep *int64
// Default factor AuthKit challenges first when 2FA is required
IsDefault bool
CreatedAt time.Time
UpdatedAt time.Time
}
Enrolled 2FA factors per user (hard-deleted on removal); backup codes remain user-scoped on mfa_settings
type ProfilesMfaSetting ¶ added in v0.56.0
type ProfilesMfaSetting struct {
UserID string
Enabled bool
// Hashed backup codes for account recovery
BackupCodes []string
CreatedAt time.Time
UpdatedAt time.Time
}
Account-level 2FA gate + backup codes per user. enabled=true ⇒ 2FA required at login. Per-factor data lives in mfa_factors.
type ProfilesPermissionGroup ¶ added in v0.49.0
type ProfilesPermissionGroup struct {
ID string
Persona string
ParentID *string
ParentPersona *string
// Lowercase URL-safe slug for the app resource and API addressing key; the group id is internal only.
ResourceSlug *string
Metadata []byte
CreatedAt time.Time
UpdatedAt time.Time
DeletedAt *time.Time
}
type ProfilesRefreshSession ¶
type ProfilesRefreshSession struct {
ID string
UserID string
Issuer string
FamilyID string
CurrentTokenHash []byte
PreviousTokenHash []byte
CreatedAt time.Time
LastAuthenticatedAt *time.Time
LastUsedAt time.Time
ExpiresAt *time.Time
RevokedAt *time.Time
UserAgent *string
IpAddr *string
AuthMethods []string
}
type ProfilesRemoteApplication ¶ added in v0.27.0
type ProfilesRemoteApplication struct {
ID string
Slug string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Audiences []string
Enabled bool
Metadata []byte
CreatedAt time.Time
UpdatedAt time.Time
DeletedAt *time.Time
// Required controlling permission-group. Authority comes from group_remote_application_roles and the parent walk.
PermissionGroupID string
AllowedOrigins []string
}
Federation principals: external systems that authenticate by signing JWTs verified against configured keys.
type ProfilesRemoteApplicationAttributeDef ¶ added in v0.27.0
type ProfilesRemoteApplicationAttributeDef struct {
RemoteApplicationID string
Key string
Version int32
Definition []byte
CreatedAt time.Time
UpdatedAt time.Time
}
Reference-mode attribute definitions: opaque JSON by remote application, key, and version.
type ProfilesUser ¶
type ProfilesUser struct {
ID string
Email *string
Username *string
EmailVerified bool
// E.164 format phone number (e.g. +14155551234)
PhoneNumber *string
// Whether the phone number has been verified via SMS code
PhoneVerified bool
// When the user was banned
BannedAt *time.Time
// When a temporary ban expires (NULL for permanent)
BannedUntil *time.Time
// Reason for ban
BanReason *string
// User ID of admin who imposed ban
BannedBy *string
DeletedAt *time.Time
Biography *string
// Arbitrary user metadata (internal/admin flags such as reserved)
Metadata []byte
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
// User communication/auth language, e.g. en, es, de, ko, zh
PreferredLanguage *string
}
type ProfilesUserPasskey ¶ added in v0.56.0
type ProfilesUserPasskey struct {
ID string
UserID string
Rpid string
CredentialID []byte
PublicKey []byte
SignCount int64
CloneWarning bool
Aaguid []byte
Transports []string
AuthenticatorAttachment string
BackupEligible bool
BackupState bool
UserPresent bool
UserVerified bool
Flags []byte
AttestationType string
AttestationFmt string
Label *string
CreatedAt time.Time
LastUsedAt *time.Time
DeletedAt *time.Time
}
type ProfilesUserPasskeyHandle ¶ added in v0.56.0
type ProfilesUserPassword ¶
type ProfilesUserProvider ¶
type ProfilesUserRename ¶
type ProviderLinkByIssuerRow ¶
type ProviderLinkBySlugRow ¶
type Queries ¶
type Queries struct {
// contains filtered or unexported fields
}
func (*Queries) GroupAssignmentsDeleteByUser ¶ added in v0.56.0
#125 D7: pre-delete cleanup for the hard-delete/purge path. group_invites.invited_by is ON DELETE RESTRICT so sent invites must be cleared before the user row is removed.
func (*Queries) GroupInvitesDeleteByInviter ¶ added in v0.56.0
func (*Queries) IdentityCurrentUsername ¶
Rename-history forwarding (identity/renames.go).
func (*Queries) IdentityForwardUsername ¶
func (*Queries) IdentityUpdateUserEmail ¶
func (q *Queries) IdentityUpdateUserEmail(ctx context.Context, arg IdentityUpdateUserEmailParams) error
func (*Queries) IdentityUpdateUserUsername ¶
func (q *Queries) IdentityUpdateUserUsername(ctx context.Context, arg IdentityUpdateUserUsernameParams) error
func (*Queries) IdentityUserByID ¶
func (*Queries) IdentityUserIDByUsername ¶
func (*Queries) IdentityUsersByIDs ¶
func (q *Queries) IdentityUsersByIDs(ctx context.Context, ids []string) ([]IdentityUsersByIDsRow, error)
Identity store queries (identity package).
func (*Queries) MFAClearDefaultFactors ¶ added in v0.56.0
func (*Queries) MFAConsumeFactorTOTPStep ¶ added in v0.56.0
func (*Queries) MFADefaultFactorByUser ¶ added in v0.56.0
func (*Queries) MFADeleteAllFactors ¶ added in v0.56.0
func (*Queries) MFADeleteFactor ¶ added in v0.56.0
func (*Queries) MFADisable ¶ added in v0.56.0
Two-factor queries (core/service.go).
#125: factors are hard-deleted (no per-factor `enabled` flag). mfa_settings holds only the account-level gate (`enabled`) + `backup_codes`; per-factor data (method/phone/totp_secret/last_totp_step) lives ONLY on mfa_factors.
func (*Queries) MFAFactorByUserMethod ¶ added in v0.56.0
func (q *Queries) MFAFactorByUserMethod(ctx context.Context, arg MFAFactorByUserMethodParams) (ProfilesMfaFactor, error)
func (*Queries) MFAListFactorsByUser ¶ added in v0.56.0
func (*Queries) MFASetBackupCodes ¶ added in v0.56.0
func (q *Queries) MFASetBackupCodes(ctx context.Context, arg MFASetBackupCodesParams) error
func (*Queries) MFASetDefaultFactor ¶ added in v0.56.0
func (*Queries) MFASettingsByUser ¶ added in v0.56.0
func (*Queries) MFAUpsertFactor ¶ added in v0.56.0
func (q *Queries) MFAUpsertFactor(ctx context.Context, arg MFAUpsertFactorParams) (ProfilesMfaFactor, error)
func (*Queries) MFAUpsertSettings ¶ added in v0.56.0
func (q *Queries) MFAUpsertSettings(ctx context.Context, arg MFAUpsertSettingsParams) error
func (*Queries) NamespaceUserBySlug ¶
func (q *Queries) NamespaceUserBySlug(ctx context.Context, username *string) (NamespaceUserBySlugRow, error)
Namespace lookup probes (core/owner_namespace_lookup.go). These read soft- deleted rows on purpose (deleted_at IS NOT NULL surfaces as a flag).
func (*Queries) NamespaceUserRenameBySlug ¶
func (*Queries) OwnerReservedNameDelete ¶
func (*Queries) OwnerReservedNameExists ¶
Owner-namespace queries (core/service_owner_namespace*.go, core/owner_namespace_lookup.go).
Permission groups own group-scoped routing now. Only the user/owner-reserved name namespace queries remain here.
func (*Queries) OwnerReservedNameUpsert ¶
func (*Queries) OwnerSlugUserExists ¶
func (q *Queries) OwnerSlugUserExists(ctx context.Context, arg OwnerSlugUserExistsParams) (bool, error)
Slug-availability probes (core/service_owner_namespace.go ownerSlugAvailable).
func (*Queries) OwnerSlugUserRenameHeld ¶
func (*Queries) ProviderLinkByIssuer ¶
func (q *Queries) ProviderLinkByIssuer(ctx context.Context, arg ProviderLinkByIssuerParams) (ProviderLinkByIssuerRow, error)
func (*Queries) ProviderLinkBySlug ¶
func (q *Queries) ProviderLinkBySlug(ctx context.Context, arg ProviderLinkBySlugParams) (ProviderLinkBySlugRow, error)
func (*Queries) RemoteAppAttributeDefDelete ¶ added in v0.27.0
func (*Queries) RemoteAppAttributeDefGet ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefGet(ctx context.Context, arg RemoteAppAttributeDefGetParams) (RemoteAppAttributeDefGetRow, error)
func (*Queries) RemoteAppAttributeDefGetLatest ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefGetLatest(ctx context.Context, arg RemoteAppAttributeDefGetLatestParams) (RemoteAppAttributeDefGetLatestRow, error)
func (*Queries) RemoteAppAttributeDefUpsert ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefUpsert(ctx context.Context, arg RemoteAppAttributeDefUpsertParams) (RemoteAppAttributeDefUpsertRow, error)
Attribute definition registry (#75): REFERENCE-mode opaque definitions.
func (*Queries) RemoteAppAttributeDefsList ¶ added in v0.27.0
func (*Queries) RemoteApplicationByIssuer ¶ added in v0.27.0
func (*Queries) RemoteApplicationBySlug ¶ added in v0.27.0
func (*Queries) RemoteApplicationDelete ¶ added in v0.27.0
func (*Queries) RemoteApplicationUpsert ¶ added in v0.27.0
func (q *Queries) RemoteApplicationUpsert(ctx context.Context, arg RemoteApplicationUpsertParams) (RemoteApplicationUpsertRow, error)
Remote application registry (core/service_remote_applications.go). A remote_application is the federation PRINCIPAL: it authenticates by signing JWTs verified against its JWKS/public keys (#74).
The controlling group is addressed as permission_group_id throughout.
func (*Queries) RemoteApplicationsAll ¶ added in v0.27.0
func (q *Queries) RemoteApplicationsAll(ctx context.Context) ([]RemoteApplicationsAllRow, error)
func (*Queries) RemoteApplicationsEnabled ¶ added in v0.27.0
func (q *Queries) RemoteApplicationsEnabled(ctx context.Context) ([]RemoteApplicationsEnabledRow, error)
func (*Queries) SessionByCurrentTokenHash ¶
func (q *Queries) SessionByCurrentTokenHash(ctx context.Context, arg SessionByCurrentTokenHashParams) (SessionByCurrentTokenHashRow, error)
func (*Queries) SessionByPreviousTokenHash ¶
func (q *Queries) SessionByPreviousTokenHash(ctx context.Context, arg SessionByPreviousTokenHashParams) (SessionByPreviousTokenHashRow, error)
func (*Queries) SessionFreshSince ¶
func (q *Queries) SessionFreshSince(ctx context.Context, arg SessionFreshSinceParams) (SessionFreshSinceRow, error)
func (*Queries) SessionIDByCurrentTokenHash ¶
func (*Queries) SessionInsert ¶
func (q *Queries) SessionInsert(ctx context.Context, arg SessionInsertParams) (SessionInsertRow, error)
Refresh-session queries (core/service_sessions.go).
func (*Queries) SessionMarkAuthenticated ¶
func (*Queries) SessionRevokeByID ¶
func (*Queries) SessionRevokeByIDForUser ¶
func (*Queries) SessionRotate ¶
func (q *Queries) SessionRotate(ctx context.Context, arg SessionRotateParams) error
func (*Queries) SessionsCountActive ¶
func (*Queries) SessionsDeleteRevokedOrExpired ¶
func (*Queries) SessionsEvictOldest ¶
func (*Queries) SessionsListByUser ¶
func (q *Queries) SessionsListByUser(ctx context.Context, arg SessionsListByUserParams) ([]SessionsListByUserRow, error)
func (*Queries) SessionsRevokeAll ¶
func (*Queries) SessionsRevokeAllExcept ¶
func (*Queries) SessionsRevokeAllQuiet ¶
func (q *Queries) SessionsRevokeAllQuiet(ctx context.Context, arg SessionsRevokeAllQuietParams) error
SessionsRevokeAllQuiet is AdminDeleteUser's pre-delete sweep; unlike SessionsRevokeAll it returns nothing (no per-session revoke logging).
func (*Queries) SessionsRevokeFamily ¶
func (*Queries) UserApplyEmailChange ¶
func (q *Queries) UserApplyEmailChange(ctx context.Context, arg UserApplyEmailChangeParams) error
func (*Queries) UserApplyPhoneChange ¶
func (q *Queries) UserApplyPhoneChange(ctx context.Context, arg UserApplyPhoneChangeParams) error
func (*Queries) UserByEmail ¶
func (*Queries) UserByPhone ¶
func (*Queries) UserBySlug ¶
func (*Queries) UserBySlugViaRename ¶
func (q *Queries) UserBySlugViaRename(ctx context.Context, fromSlug string) (UserBySlugViaRenameRow, error)
Fallback to renames table (issue #58). Most-recent rename wins when a slug has been used by multiple users at different times (only possible after hard-delete + reuse).
func (*Queries) UserByUsername ¶
func (*Queries) UserClearLoginIdentifiers ¶
func (*Queries) UserDeleteHard ¶
func (*Queries) UserEmailByID ¶
User-row queries (core/service.go).
func (*Queries) UserEmailOrUsernameExists ¶
func (*Queries) UserEmailOrUsernameTaken ¶
func (q *Queries) UserEmailOrUsernameTaken(ctx context.Context, arg UserEmailOrUsernameTakenParams) (UserEmailOrUsernameTakenRow, error)
func (*Queries) UserHasPassword ¶
func (*Queries) UserIDReservedByUsername ¶
func (*Queries) UserImportInsert ¶
func (q *Queries) UserImportInsert(ctx context.Context, arg UserImportInsertParams) error
func (*Queries) UserImportUpdate ¶
func (*Queries) UserInsert ¶
func (q *Queries) UserInsert(ctx context.Context, arg UserInsertParams) (UserInsertRow, error)
func (*Queries) UserIsReserved ¶
func (*Queries) UserLastRenamedAt ¶
func (*Queries) UserMetadata ¶
func (*Queries) UserMetadataPatch ¶
func (*Queries) UserPasswordDelete ¶
func (*Queries) UserPasswordInsert ¶
func (q *Queries) UserPasswordInsert(ctx context.Context, arg UserPasswordInsertParams) error
func (*Queries) UserPasswordRow ¶
func (*Queries) UserPasswordUpsert ¶
func (q *Queries) UserPasswordUpsert(ctx context.Context, arg UserPasswordUpsertParams) error
func (*Queries) UserPhoneOrUsernameExists ¶
func (*Queries) UserPhoneOrUsernameTaken ¶
func (q *Queries) UserPhoneOrUsernameTaken(ctx context.Context, arg UserPhoneOrUsernameTakenParams) (UserPhoneOrUsernameTakenRow, error)
func (*Queries) UserPreferredLanguage ¶ added in v0.54.0
func (*Queries) UserProviderDeleteBySlug ¶
func (q *Queries) UserProviderDeleteBySlug(ctx context.Context, arg UserProviderDeleteBySlugParams) error
func (*Queries) UserProviderDeleteOtherSubjects ¶
func (q *Queries) UserProviderDeleteOtherSubjects(ctx context.Context, arg UserProviderDeleteOtherSubjectsParams) error
func (*Queries) UserProviderInsertSimple ¶
func (q *Queries) UserProviderInsertSimple(ctx context.Context, arg UserProviderInsertSimpleParams) error
func (*Queries) UserProviderLinkExists ¶
func (q *Queries) UserProviderLinkExists(ctx context.Context, arg UserProviderLinkExistsParams) (bool, error)
HTTP-layer provider lookups (http/reauth.go, http/user_me_get.go).
func (*Queries) UserProviderMergeProfile ¶
func (q *Queries) UserProviderMergeProfile(ctx context.Context, arg UserProviderMergeProfileParams) error
func (*Queries) UserProviderSetUsername ¶
func (q *Queries) UserProviderSetUsername(ctx context.Context, arg UserProviderSetUsernameParams) error
func (*Queries) UserProviderSlugs ¶
func (*Queries) UserProviderSlugsDistinct ¶
func (*Queries) UserProviderSubjectByIssuer ¶
func (*Queries) UserProviderSubjectProfileByIssuer ¶
func (q *Queries) UserProviderSubjectProfileByIssuer(ctx context.Context, arg UserProviderSubjectProfileByIssuerParams) (UserProviderSubjectProfileByIssuerRow, error)
func (*Queries) UserProviderUpsertByIssuer ¶
func (q *Queries) UserProviderUpsertByIssuer(ctx context.Context, arg UserProviderUpsertByIssuerParams) error
func (*Queries) UserProviderUsername ¶
func (*Queries) UserProvidersCount ¶
Provider-link queries (core/service.go).
func (*Queries) UserProvidersDeleteByUser ¶
func (*Queries) UserRenameInsert ¶
func (q *Queries) UserRenameInsert(ctx context.Context, arg UserRenameInsertParams) error
func (*Queries) UserSetBiography ¶
func (q *Queries) UserSetBiography(ctx context.Context, arg UserSetBiographyParams) error
func (*Queries) UserSetEmailAndUnverify ¶
func (q *Queries) UserSetEmailAndUnverify(ctx context.Context, arg UserSetEmailAndUnverifyParams) error
func (*Queries) UserSetEmailAndVerified ¶ added in v0.54.0
func (q *Queries) UserSetEmailAndVerified(ctx context.Context, arg UserSetEmailAndVerifiedParams) error
func (*Queries) UserSetEmailVerified ¶
func (q *Queries) UserSetEmailVerified(ctx context.Context, arg UserSetEmailVerifiedParams) error
func (*Queries) UserSetLastLogin ¶
func (q *Queries) UserSetLastLogin(ctx context.Context, arg UserSetLastLoginParams) error
func (*Queries) UserSetPhoneAndVerified ¶
func (q *Queries) UserSetPhoneAndVerified(ctx context.Context, arg UserSetPhoneAndVerifiedParams) error
func (*Queries) UserSetPhoneVerifiedByID ¶
func (q *Queries) UserSetPhoneVerifiedByID(ctx context.Context, arg UserSetPhoneVerifiedByIDParams) error
func (*Queries) UserSetPhoneVerifiedByIDAndPhone ¶
func (q *Queries) UserSetPhoneVerifiedByIDAndPhone(ctx context.Context, arg UserSetPhoneVerifiedByIDAndPhoneParams) error
func (*Queries) UserSetPreferredLanguage ¶ added in v0.54.0
func (q *Queries) UserSetPreferredLanguage(ctx context.Context, arg UserSetPreferredLanguageParams) error
func (*Queries) UserSetReserved ¶
func (q *Queries) UserSetReserved(ctx context.Context, arg UserSetReservedParams) error
Reserved-account + metadata queries (core/service_reserved_accounts.go).
func (*Queries) UserSetUsername ¶
func (q *Queries) UserSetUsername(ctx context.Context, arg UserSetUsernameParams) error
func (*Queries) UserSlugAliases ¶
func (*Queries) UserSoftDelete ¶
func (*Queries) UserUsernameByID ¶
func (*Queries) UserUsernameExists ¶
func (*Queries) UsersPurgeCandidates ¶
type RemoteAppAttributeDefDeleteParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetLatestParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetLatestRow ¶ added in v0.27.0
type RemoteAppAttributeDefGetParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetRow ¶ added in v0.27.0
type RemoteAppAttributeDefUpsertParams ¶ added in v0.27.0
type RemoteAppAttributeDefUpsertRow ¶ added in v0.27.0
type RemoteAppAttributeDefsListRow ¶ added in v0.27.0
type RemoteApplicationByIssuerRow ¶ added in v0.27.0
type RemoteApplicationBySlugRow ¶ added in v0.27.0
type RemoteApplicationUpsertParams ¶ added in v0.27.0
type RemoteApplicationUpsertRow ¶ added in v0.27.0
type RemoteApplicationsAllRow ¶ added in v0.27.0
type RemoteApplicationsEnabledRow ¶ added in v0.27.0
type SessionFreshSinceParams ¶
type SessionFreshSinceRow ¶ added in v0.52.0
type SessionInsertParams ¶
type SessionInsertRow ¶
type SessionRevokeByIDParams ¶
type SessionRotateParams ¶
type SessionsListByUserRow ¶
type SessionsRevokeAllParams ¶
type SessionsRevokeFamilyRow ¶
type UserBanParams ¶
type UserByEmailRow ¶
type UserByEmailRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}
type UserByIDRow ¶
type UserByIDRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}
type UserByPhoneRow ¶
type UserByPhoneRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}
type UserBySlugRow ¶
type UserBySlugViaRenameRow ¶
type UserByUsernameRow ¶
type UserByUsernameRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
Biography *string
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
}