Documentation
¶
Overview ¶
Schema indirection (authkit issue 69).
Every SQL statement in authkit — the sqlc-generated constants in this package and the few raw statements in core — is schema-qualified with the literal prefix "profiles.". Hosts embed authkit with a pgx pool that is SHARED with their own queries, so pointing authkit at a different schema via search_path on the pool is ruled out (it would leak into host queries). Instead the qualifier stays in the SQL text and becomes a variable: ForSchema wraps a DBTX so the "profiles." prefix is rewritten to "<schema>." on every statement at execution time. This is a deliberate, documented string substitution: schema names are validated against a strict identifier grammar (ValidSchemaName) at configuration time, every authkit table/function reference is written as `profiles.<name>` (guarded by a test in this package), and the rewrite is the identity (no wrapper at all) for the default schema, so existing embedders see zero change.
Index ¶
- Constants
- Variables
- func RewriteSQL(sql, schema string) string
- func ValidSchemaName(s string) bool
- type DBTX
- type IdentityPublicUsersByIDsRow
- type IdentityUserLivenessByIDsRow
- type IdentityUsersByIDsRow
- type LookupSignedDocumentRow
- type MFAConsumeBackupCodeParams
- type MFAConsumeFactorTOTPStepParams
- type MFADeleteFactorParams
- type MFAInsertFactorParams
- type MFASetBackupCodesParams
- type MFASetDefaultFactorParams
- type MFAUpsertSettingsParams
- type ProfilesAccountRegistrationInvite
- type ProfilesApiKey
- type ProfilesBootstrapApply
- type ProfilesGroupCustomRole
- type ProfilesGroupInviteLink
- type ProfilesGroupMembershipInvite
- type ProfilesGroupPersonaParent
- type ProfilesGroupRemoteApplicationRole
- type ProfilesGroupUserRole
- type ProfilesMfaFactor
- type ProfilesMfaSetting
- type ProfilesNameClaim
- type ProfilesPermissionGroup
- type ProfilesRefreshSession
- type ProfilesRefreshTokenHistory
- type ProfilesRemoteApplication
- type ProfilesRemoteApplicationAttributeDef
- type ProfilesSessionEvent
- type ProfilesSignedDocument
- type ProfilesUser
- type ProfilesUserDeviceKey
- type ProfilesUserPasskey
- type ProfilesUserPasskeyHandle
- type ProfilesUserPassword
- type ProfilesUserProvider
- type ProfilesUserRename
- type ProviderLinkByIssuerAnyParams
- type ProviderLinkByIssuerAnyRow
- type ProviderLinkByIssuerParams
- type ProviderLinkByIssuerRow
- type Queries
- func (q *Queries) IdentityPublicUsersByIDs(ctx context.Context, ids []string) ([]IdentityPublicUsersByIDsRow, error)
- func (q *Queries) IdentityUserLivenessByIDs(ctx context.Context, ids []string) ([]IdentityUserLivenessByIDsRow, error)
- func (q *Queries) IdentityUsersByIDs(ctx context.Context, ids []string) ([]IdentityUsersByIDsRow, error)
- func (q *Queries) LookupSignedDocument(ctx context.Context, digest string) (LookupSignedDocumentRow, error)
- func (q *Queries) MFAClearDefaultFactors(ctx context.Context, userID string) error
- func (q *Queries) MFAConsumeBackupCode(ctx context.Context, arg MFAConsumeBackupCodeParams) (int64, error)
- func (q *Queries) MFAConsumeFactorTOTPStep(ctx context.Context, arg MFAConsumeFactorTOTPStepParams) (int64, error)
- func (q *Queries) MFADeleteAllFactors(ctx context.Context, userID string) error
- func (q *Queries) MFADeleteFactor(ctx context.Context, arg MFADeleteFactorParams) (int64, error)
- func (q *Queries) MFADisable(ctx context.Context, userID string) error
- func (q *Queries) MFAInsertFactor(ctx context.Context, arg MFAInsertFactorParams) (ProfilesMfaFactor, error)
- func (q *Queries) MFAListFactorsByUser(ctx context.Context, userID string) ([]ProfilesMfaFactor, error)
- func (q *Queries) MFALockUser(ctx context.Context, id string) (string, error)
- func (q *Queries) MFASetBackupCodes(ctx context.Context, arg MFASetBackupCodesParams) error
- func (q *Queries) MFASetDefaultFactor(ctx context.Context, arg MFASetDefaultFactorParams) (int64, error)
- func (q *Queries) MFASettingsByUser(ctx context.Context, userID string) (ProfilesMfaSetting, error)
- func (q *Queries) MFAUpsertSettings(ctx context.Context, arg MFAUpsertSettingsParams) error
- func (q *Queries) NameClaimsDeleteExpired(ctx context.Context, atTime time.Time) (int64, error)
- func (q *Queries) ProviderLinkByIssuer(ctx context.Context, arg ProviderLinkByIssuerParams) (ProviderLinkByIssuerRow, error)
- func (q *Queries) ProviderLinkByIssuerAny(ctx context.Context, arg ProviderLinkByIssuerAnyParams) (ProviderLinkByIssuerAnyRow, error)
- func (q *Queries) RemoteAppAttributeDefDelete(ctx context.Context, arg RemoteAppAttributeDefDeleteParams) (int64, error)
- func (q *Queries) RemoteAppAttributeDefGet(ctx context.Context, arg RemoteAppAttributeDefGetParams) (RemoteAppAttributeDefGetRow, error)
- func (q *Queries) RemoteAppAttributeDefGetLatest(ctx context.Context, arg RemoteAppAttributeDefGetLatestParams) (RemoteAppAttributeDefGetLatestRow, error)
- func (q *Queries) RemoteAppAttributeDefUpsert(ctx context.Context, arg RemoteAppAttributeDefUpsertParams) (RemoteAppAttributeDefUpsertRow, error)
- func (q *Queries) RemoteAppAttributeDefsList(ctx context.Context, remoteApplicationID string) ([]RemoteAppAttributeDefsListRow, error)
- func (q *Queries) RemoteApplicationByDomainForUpdate(ctx context.Context, domain string) (RemoteApplicationByDomainForUpdateRow, error)
- func (q *Queries) RemoteApplicationByIssuer(ctx context.Context, issuer string) (RemoteApplicationByIssuerRow, error)
- func (q *Queries) RemoteApplicationBySlug(ctx context.Context, slug string) (RemoteApplicationBySlugRow, error)
- func (q *Queries) RemoteApplicationBySlugForUpdate(ctx context.Context, slug string) (RemoteApplicationBySlugForUpdateRow, error)
- func (q *Queries) RemoteApplicationDelete(ctx context.Context, issuer string) (int64, error)
- func (q *Queries) RemoteApplicationDomainInsert(ctx context.Context, arg RemoteApplicationDomainInsertParams) (RemoteApplicationDomainInsertRow, error)
- func (q *Queries) RemoteApplicationDomainRefresh(ctx context.Context, arg RemoteApplicationDomainRefreshParams) (RemoteApplicationDomainRefreshRow, error)
- func (q *Queries) RemoteApplicationRepoint(ctx context.Context, arg RemoteApplicationRepointParams) (RemoteApplicationRepointRow, error)
- func (q *Queries) RemoteApplicationRotateTrustSource(ctx context.Context, arg RemoteApplicationRotateTrustSourceParams) (RemoteApplicationRotateTrustSourceRow, error)
- func (q *Queries) RemoteApplicationSetTier(ctx context.Context, arg RemoteApplicationSetTierParams) (RemoteApplicationSetTierRow, error)
- func (q *Queries) RemoteApplicationUpsert(ctx context.Context, arg RemoteApplicationUpsertParams) (RemoteApplicationUpsertRow, error)
- func (q *Queries) RemoteApplicationsAll(ctx context.Context) ([]RemoteApplicationsAllRow, error)
- func (q *Queries) RemoteApplicationsEnabled(ctx context.Context) ([]RemoteApplicationsEnabledRow, error)
- func (q *Queries) ResolveUsername(ctx context.Context, arg ResolveUsernameParams) (ResolveUsernameRow, error)
- func (q *Queries) SaveSignedDocument(ctx context.Context, arg SaveSignedDocumentParams) (int64, error)
- func (q *Queries) SessionByCurrentTokenHash(ctx context.Context, arg SessionByCurrentTokenHashParams) (SessionByCurrentTokenHashRow, error)
- func (q *Queries) SessionByHistoricalTokenHash(ctx context.Context, arg SessionByHistoricalTokenHashParams) (SessionByHistoricalTokenHashRow, error)
- func (q *Queries) SessionCreateLock(ctx context.Context, key string) error
- func (q *Queries) SessionEventInsert(ctx context.Context, arg SessionEventInsertParams) error
- func (q *Queries) SessionEventsListByUser(ctx context.Context, arg SessionEventsListByUserParams) ([]SessionEventsListByUserRow, error)
- func (q *Queries) SessionEventsPruneBatch(ctx context.Context, arg SessionEventsPruneBatchParams) (int64, error)
- func (q *Queries) SessionFreshSince(ctx context.Context, arg SessionFreshSinceParams) (SessionFreshSinceRow, error)
- func (q *Queries) SessionIDByCurrentTokenHash(ctx context.Context, arg SessionIDByCurrentTokenHashParams) (string, error)
- func (q *Queries) SessionInsert(ctx context.Context, arg SessionInsertParams) (SessionInsertRow, error)
- func (q *Queries) SessionMarkAuthenticated(ctx context.Context, arg SessionMarkAuthenticatedParams) (int64, error)
- func (q *Queries) SessionRevokeByID(ctx context.Context, arg SessionRevokeByIDParams) (string, error)
- func (q *Queries) SessionRevokeByIDForUser(ctx context.Context, arg SessionRevokeByIDForUserParams) (string, error)
- func (q *Queries) SessionRotate(ctx context.Context, arg SessionRotateParams) (int64, error)
- func (q *Queries) SessionsCountActive(ctx context.Context, arg SessionsCountActiveParams) (int64, error)
- func (q *Queries) SessionsDeleteRevokedOrExpiredBatch(ctx context.Context, batchSize int64) (int64, error)
- func (q *Queries) SessionsEvictOldest(ctx context.Context, arg SessionsEvictOldestParams) ([]string, error)
- func (q *Queries) SessionsListByUser(ctx context.Context, arg SessionsListByUserParams) ([]SessionsListByUserRow, error)
- func (q *Queries) SessionsRevokeAll(ctx context.Context, arg SessionsRevokeAllParams) ([]string, error)
- func (q *Queries) SessionsRevokeAllExcept(ctx context.Context, arg SessionsRevokeAllExceptParams) ([]string, error)
- func (q *Queries) SessionsRevokeFamily(ctx context.Context, familyID string) ([]SessionsRevokeFamilyRow, error)
- func (q *Queries) UserApplyEmailChange(ctx context.Context, arg UserApplyEmailChangeParams) error
- func (q *Queries) UserApplyPhoneChange(ctx context.Context, arg UserApplyPhoneChangeParams) error
- func (q *Queries) UserBan(ctx context.Context, arg UserBanParams) error
- func (q *Queries) UserByEmail(ctx context.Context, email string) (UserByEmailRow, error)
- func (q *Queries) UserByID(ctx context.Context, id string) (UserByIDRow, error)
- func (q *Queries) UserByPhone(ctx context.Context, phoneNumber *string) (UserByPhoneRow, error)
- func (q *Queries) UserClearBan(ctx context.Context, id string) error
- func (q *Queries) UserDeleteHard(ctx context.Context, id string) error
- func (q *Queries) UserEmailOrUsernameTaken(ctx context.Context, arg UserEmailOrUsernameTakenParams) (UserEmailOrUsernameTakenRow, error)
- func (q *Queries) UserHasPassword(ctx context.Context, userID string) (bool, error)
- func (q *Queries) UserImportInsert(ctx context.Context, arg UserImportInsertParams) error
- func (q *Queries) UserImportUpdate(ctx context.Context, arg UserImportUpdateParams) (string, error)
- func (q *Queries) UserInsert(ctx context.Context, arg UserInsertParams) (UserInsertRow, error)
- func (q *Queries) UserIsReserved(ctx context.Context, id string) (bool, error)
- func (q *Queries) UserMetadata(ctx context.Context, id string) ([]byte, error)
- func (q *Queries) UserMetadataPatch(ctx context.Context, arg UserMetadataPatchParams) (int64, error)
- func (q *Queries) UserPasswordInsert(ctx context.Context, arg UserPasswordInsertParams) error
- func (q *Queries) UserPasswordRow(ctx context.Context, userID string) (UserPasswordRowRow, error)
- func (q *Queries) UserPasswordUpsert(ctx context.Context, arg UserPasswordUpsertParams) error
- func (q *Queries) UserPhoneOrUsernameTaken(ctx context.Context, arg UserPhoneOrUsernameTakenParams) (UserPhoneOrUsernameTakenRow, error)
- func (q *Queries) UserPreferredLanguage(ctx context.Context, id string) (string, error)
- func (q *Queries) UserProviderByIssuerAny(ctx context.Context, arg UserProviderByIssuerAnyParams) (UserProviderByIssuerAnyRow, error)
- func (q *Queries) UserProviderCountForUpdate(ctx context.Context, userID string) (int32, error)
- func (q *Queries) UserProviderDeleteBySlug(ctx context.Context, arg UserProviderDeleteBySlugParams) error
- func (q *Queries) UserProviderImportUnverified(ctx context.Context, arg UserProviderImportUnverifiedParams) (UserProviderImportUnverifiedRow, error)
- func (q *Queries) UserProviderLinkExists(ctx context.Context, arg UserProviderLinkExistsParams) (bool, error)
- func (q *Queries) UserProviderMergeProfile(ctx context.Context, arg UserProviderMergeProfileParams) error
- func (q *Queries) UserProviderSetUsername(ctx context.Context, arg UserProviderSetUsernameParams) error
- func (q *Queries) UserProviderSlugs(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserProviderSlugsDistinct(ctx context.Context, userID string) ([]string, error)
- func (q *Queries) UserProviderSubjectProfileByIssuer(ctx context.Context, arg UserProviderSubjectProfileByIssuerParams) (UserProviderSubjectProfileByIssuerRow, error)
- func (q *Queries) UserProviderUnverifiedForUpdate(ctx context.Context, arg UserProviderUnverifiedForUpdateParams) (string, error)
- func (q *Queries) UserProviderUpsertByIssuer(ctx context.Context, arg UserProviderUpsertByIssuerParams) (UserProviderUpsertByIssuerRow, error)
- func (q *Queries) UserProviderVerifyImported(ctx context.Context, arg UserProviderVerifyImportedParams) (*time.Time, error)
- func (q *Queries) UserProvidersCount(ctx context.Context, userID string) (int64, error)
- func (q *Queries) UserSetAvatarURL(ctx context.Context, arg UserSetAvatarURLParams) (int64, error)
- func (q *Queries) UserSetEmailAndUnverify(ctx context.Context, arg UserSetEmailAndUnverifyParams) error
- func (q *Queries) UserSetEmailVerified(ctx context.Context, arg UserSetEmailVerifiedParams) error
- func (q *Queries) UserSetLastLogin(ctx context.Context, arg UserSetLastLoginParams) error
- func (q *Queries) UserSetPhoneAndVerified(ctx context.Context, arg UserSetPhoneAndVerifiedParams) error
- func (q *Queries) UserSetPhoneVerifiedByID(ctx context.Context, arg UserSetPhoneVerifiedByIDParams) error
- func (q *Queries) UserSetPhoneVerifiedByIDAndPhone(ctx context.Context, arg UserSetPhoneVerifiedByIDAndPhoneParams) error
- func (q *Queries) UserSetPreferredLanguage(ctx context.Context, arg UserSetPreferredLanguageParams) error
- func (q *Queries) UserSlugAliases(ctx context.Context, arg UserSlugAliasesParams) ([]string, error)
- func (q *Queries) UserSoftDelete(ctx context.Context, id string) error
- func (q *Queries) UserUsernameExists(ctx context.Context, arg UserUsernameExistsParams) (bool, error)
- func (q *Queries) UsersPurgeCandidates(ctx context.Context, arg UsersPurgeCandidatesParams) ([]string, error)
- func (q *Queries) WithTx(tx pgx.Tx) *Queries
- type RemoteAppAttributeDefDeleteParams
- type RemoteAppAttributeDefGetLatestParams
- type RemoteAppAttributeDefGetLatestRow
- type RemoteAppAttributeDefGetParams
- type RemoteAppAttributeDefGetRow
- type RemoteAppAttributeDefUpsertParams
- type RemoteAppAttributeDefUpsertRow
- type RemoteAppAttributeDefsListRow
- type RemoteApplicationByDomainForUpdateRow
- type RemoteApplicationByIssuerRow
- type RemoteApplicationBySlugForUpdateRow
- type RemoteApplicationBySlugRow
- type RemoteApplicationDomainInsertParams
- type RemoteApplicationDomainInsertRow
- type RemoteApplicationDomainRefreshParams
- type RemoteApplicationDomainRefreshRow
- type RemoteApplicationRepointParams
- type RemoteApplicationRepointRow
- type RemoteApplicationRotateTrustSourceParams
- type RemoteApplicationRotateTrustSourceRow
- type RemoteApplicationSetTierParams
- type RemoteApplicationSetTierRow
- type RemoteApplicationUpsertParams
- type RemoteApplicationUpsertRow
- type RemoteApplicationsAllRow
- type RemoteApplicationsEnabledRow
- type ResolveUsernameParams
- type ResolveUsernameRow
- type SaveSignedDocumentParams
- type SessionByCurrentTokenHashParams
- type SessionByCurrentTokenHashRow
- type SessionByHistoricalTokenHashParams
- type SessionByHistoricalTokenHashRow
- type SessionEventInsertParams
- type SessionEventsListByUserParams
- type SessionEventsListByUserRow
- type SessionEventsPruneBatchParams
- type SessionFreshSinceParams
- type SessionFreshSinceRow
- type SessionIDByCurrentTokenHashParams
- type SessionInsertParams
- type SessionInsertRow
- type SessionMarkAuthenticatedParams
- type SessionRevokeByIDForUserParams
- type SessionRevokeByIDParams
- type SessionRotateParams
- type SessionsCountActiveParams
- type SessionsEvictOldestParams
- type SessionsListByUserParams
- type SessionsListByUserRow
- type SessionsRevokeAllExceptParams
- type SessionsRevokeAllParams
- type SessionsRevokeFamilyRow
- type UserApplyEmailChangeParams
- type UserApplyPhoneChangeParams
- type UserBanParams
- type UserByEmailRow
- type UserByIDRow
- type UserByPhoneRow
- type UserEmailOrUsernameTakenParams
- type UserEmailOrUsernameTakenRow
- type UserImportInsertParams
- type UserImportUpdateParams
- type UserInsertParams
- type UserInsertRow
- type UserMetadataPatchParams
- type UserPasswordInsertParams
- type UserPasswordRowRow
- type UserPasswordUpsertParams
- type UserPhoneOrUsernameTakenParams
- type UserPhoneOrUsernameTakenRow
- type UserProviderByIssuerAnyParams
- type UserProviderByIssuerAnyRow
- type UserProviderDeleteBySlugParams
- type UserProviderImportUnverifiedParams
- type UserProviderImportUnverifiedRow
- type UserProviderLinkExistsParams
- type UserProviderMergeProfileParams
- type UserProviderSetUsernameParams
- type UserProviderSubjectProfileByIssuerParams
- type UserProviderSubjectProfileByIssuerRow
- type UserProviderUnverifiedForUpdateParams
- type UserProviderUpsertByIssuerParams
- type UserProviderUpsertByIssuerRow
- type UserProviderVerifyImportedParams
- type UserSetAvatarURLParams
- type UserSetEmailAndUnverifyParams
- type UserSetEmailVerifiedParams
- type UserSetLastLoginParams
- type UserSetPhoneAndVerifiedParams
- type UserSetPhoneVerifiedByIDAndPhoneParams
- type UserSetPhoneVerifiedByIDParams
- type UserSetPreferredLanguageParams
- type UserSlugAliasesParams
- type UserUsernameExistsParams
- type UsersPurgeCandidatesParams
Constants ¶
const DefaultSchema = "profiles"
DefaultSchema is the historical hard-coded schema name. All SQL in this package is written against it; ForSchema rewrites it when a host configures a different schema.
Variables ¶
var QueryText = map[string]string{
"UserByEmail": userByEmail,
"ResolveUsername": resolveUsername,
"IdentityUsersByIDs": identityUsersByIDs,
"IdentityPublicUsersByIDs": identityPublicUsersByIDs,
"IdentityUserLivenessByIDs": identityUserLivenessByIDs,
"SessionByCurrentTokenHash": sessionByCurrentTokenHash,
"SessionByHistoricalTokenHash": sessionByHistoricalTokenHash,
"SessionsListByUser": sessionsListByUser,
"SessionsEvictOldest": sessionsEvictOldest,
"ProviderLinkByIssuer": providerLinkByIssuer,
"UserProviderSlugs": userProviderSlugs,
"UsersPurgeCandidates": usersPurgeCandidates,
"SessionsRevokeFamily": sessionsRevokeFamily,
"SessionsDeleteRevokedOrExpiredBatch": sessionsDeleteRevokedOrExpiredBatch,
}
QueryText exposes generated query SQL by query name for the plan/performance harness (internal/db/querytest). The values ARE the sqlc-generated constants, so the SQL the harness EXPLAINs can never drift from what the application runs — the whole point of the perf gate. Keys are the sqlc `-- name:` identifiers.
Membership here is the set of queries the perf harness measures; the SQL text itself is always the live generated constant. Add an entry when a query joins the perf gate.
Functions ¶
func RewriteSQL ¶ added in v0.26.0
RewriteSQL returns sql with every literal "profiles." qualifier replaced by schema+".". Callers must have validated schema via ValidSchemaName.
func ValidSchemaName ¶ added in v0.26.0
ValidSchemaName reports whether s is acceptable as a configured schema name: lowercase snake_case identifier, at most 63 bytes (the Postgres identifier limit, so the name is never silently truncated server-side).
Types ¶
type DBTX ¶
type DBTX interface {
Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
Query(context.Context, string, ...interface{}) (pgx.Rows, error)
QueryRow(context.Context, string, ...interface{}) pgx.Row
}
func ForSchema ¶ added in v0.26.0
ForSchema wraps d so every statement executed through it has its "profiles." qualifiers rewritten to the given schema. For the default schema (or empty, meaning default) it returns d unchanged, so the default path has zero overhead. The per-call strings.ReplaceAll is negligible next to the network round trip and keeps the wrapper stateless, which matters because transaction-scoped wrappers are created per transaction.
type IdentityPublicUsersByIDsRow ¶ added in v0.92.0
type IdentityUserLivenessByIDsRow ¶ added in v0.92.0
type IdentityUsersByIDsRow ¶
type LookupSignedDocumentRow ¶ added in v0.91.0
type MFAConsumeBackupCodeParams ¶ added in v0.63.0
type MFAConsumeFactorTOTPStepParams ¶ added in v0.56.0
type MFADeleteFactorParams ¶ added in v0.56.0
type MFAInsertFactorParams ¶ added in v0.98.0
type MFASetBackupCodesParams ¶ added in v0.56.0
type MFASetDefaultFactorParams ¶ added in v0.56.0
type MFAUpsertSettingsParams ¶ added in v0.56.0
type ProfilesAccountRegistrationInvite ¶ added in v0.75.0
type ProfilesApiKey ¶ added in v0.56.0
type ProfilesApiKey struct {
ID string
PermissionGroupID string
KeyID string
SecretHash []byte
Name string
CreatedBy *string
CreatedAt time.Time
LastUsedAt *time.Time
ExpiresAt *time.Time
RevokedAt *time.Time
// The single catalog/custom role this API key holds within its permission-group.
Role string
}
type ProfilesBootstrapApply ¶ added in v0.64.0
type ProfilesGroupCustomRole ¶ added in v0.49.0
type ProfilesGroupInviteLink ¶ added in v0.60.0
type ProfilesGroupMembershipInvite ¶ added in v0.75.0
type ProfilesGroupPersonaParent ¶ added in v0.56.0
Declared containment schema: the single parent persona for each permission-group persona. root is absent.
type ProfilesGroupRemoteApplicationRole ¶ added in v0.56.0
type ProfilesGroupUserRole ¶ added in v0.56.0
type ProfilesMfaFactor ¶ added in v0.56.0
type ProfilesMfaFactor struct {
ID string
UserID string
Method string
PhoneNumber *string
TotpSecret []byte
LastTotpStep *int64
// Default factor AuthKit challenges first when 2FA is required
IsDefault bool
CreatedAt time.Time
UpdatedAt time.Time
}
Enrolled 2FA factors per user (hard-deleted on removal); backup codes remain user-scoped on mfa_settings
type ProfilesMfaSetting ¶ added in v0.56.0
type ProfilesMfaSetting struct {
UserID string
Enabled bool
// Hashed backup codes for account recovery
BackupCodes []string
CreatedAt time.Time
UpdatedAt time.Time
}
Account-level 2FA gate + backup codes per user. enabled=true ⇒ 2FA required at login. Per-factor data lives in mfa_factors.
type ProfilesNameClaim ¶ added in v0.98.0
type ProfilesPermissionGroup ¶ added in v0.49.0
type ProfilesPermissionGroup struct {
ID string
Persona string
ParentID *string
// Lowercase URL-safe slug identifying WHICH instance of the persona (e.g. acme-store for a merchant); the API addressing key. The group id is internal only.
InstanceSlug *string
CreatedAt time.Time
UpdatedAt time.Time
DisplayName string
LastRenamedAt *time.Time
}
type ProfilesRefreshSession ¶
type ProfilesRefreshSession struct {
ID string
UserID string
Issuer string
FamilyID string
CurrentTokenHash []byte
CreatedAt time.Time
LastAuthenticatedAt *time.Time
LastUsedAt time.Time
ExpiresAt *time.Time
RevokedAt *time.Time
UserAgent *string
IpAddr *string
AuthMethods []string
// Successor refresh token, XOR-sealed under SHA-256(predecessor || domain separator). Readable only by a caller holding the predecessor token; the database alone cannot unseal it (ak#274).
PreviousSuccessorSealed []byte
// When the most recent predecessor rotated. Bounds the rotation grace window.
PreviousRotatedAt *time.Time
}
type ProfilesRefreshTokenHistory ¶ added in v0.98.0
type ProfilesRemoteApplication ¶ added in v0.27.0
type ProfilesRemoteApplication struct {
ID string
Slug string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
CreatedAt time.Time
UpdatedAt time.Time
// Required controlling permission-group. Authority comes from group_remote_application_roles and the parent walk.
PermissionGroupID string
DisplayName string
// registered (self-registered; zero default capability) | approved (admin act on the host).
Tier string
// What rotates the keys: manual | domain | user. Never the keypair alone.
TrustRoot string
// Trust-root location for domain-rooted applications (canonical registration input; empty otherwise). Separate from slug — the domain proves identity, the slug is a claimed handle.
Domain string
DocumentEndpoint string
// Last successful trust-root proof (domain fetch). Re-verification cadence is host policy (host sweepers disable stale registered-tier apps; re-registration re-proves and re-enables).
RootVerifiedAt *time.Time
}
Federation principals: external systems that authenticate by signing JWTs verified against configured keys.
type ProfilesRemoteApplicationAttributeDef ¶ added in v0.27.0
type ProfilesRemoteApplicationAttributeDef struct {
RemoteApplicationID string
Key string
Version int32
Definition []byte
CreatedAt time.Time
UpdatedAt time.Time
}
Reference-mode attribute definitions: opaque JSON by remote application, key, and version.
type ProfilesSessionEvent ¶ added in v0.81.0
type ProfilesSignedDocument ¶ added in v0.91.0
type ProfilesSignedDocument struct {
Digest string
DocumentType string
CompactJws string
SignedPayload []byte
CreatedAt time.Time
UpdatedAt time.Time
}
AuthKit-published immutable signed documents (ak#260), served at /.well-known/authkit/documents/{digest}. Digest = sha256 over signed_payload; compact_jws may be re-signed on key rotation, payload/type never change.
type ProfilesUser ¶
type ProfilesUser struct {
ID string
Email *string
Username *string
EmailVerified bool
// E.164 format phone number (e.g. +14155551234)
PhoneNumber *string
// Whether the phone number has been verified via SMS code
PhoneVerified bool
// When the user was banned
BannedAt *time.Time
// When a temporary ban expires (NULL for permanent)
BannedUntil *time.Time
// Reason for ban
BanReason *string
// User ID of admin who imposed ban
BannedBy *string
DeletedAt *time.Time
// Arbitrary user metadata (internal/admin flags such as reserved)
Metadata []byte
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
// User communication/auth language, e.g. en, es, de, ko, zh
PreferredLanguage *string
// Host-supplied avatar URL/key string; blob storage is host-owned
AvatarUrl *string
LastRenamedAt *time.Time
}
type ProfilesUserDeviceKey ¶ added in v0.97.2
type ProfilesUserDeviceKey struct {
ID string
UserID string
PublicKey []byte
Label *string
CreatedAt time.Time
LastUsedAt *time.Time
RevokedAt *time.Time
}
Ed25519 public keys for native clients. Revoked rows remain tombstones and cannot be re-enrolled.
type ProfilesUserPasskey ¶ added in v0.56.0
type ProfilesUserPasskey struct {
ID string
UserID string
Rpid string
CredentialID []byte
PublicKey []byte
SignCount int64
CloneWarning bool
Aaguid []byte
Transports []string
AuthenticatorAttachment string
BackupEligible bool
BackupState bool
Flags []byte
AttestationType string
AttestationFmt string
Label *string
CreatedAt time.Time
LastUsedAt *time.Time
DeletedAt *time.Time
}
type ProfilesUserPasskeyHandle ¶ added in v0.56.0
type ProfilesUserPassword ¶
type ProfilesUserProvider ¶
type ProfilesUserRename ¶
type ProviderLinkByIssuerAnyParams ¶ added in v0.97.1
type ProviderLinkByIssuerAnyRow ¶ added in v0.97.1
type ProviderLinkByIssuerRow ¶
type Queries ¶
type Queries struct {
// contains filtered or unexported fields
}
func (*Queries) IdentityPublicUsersByIDs ¶ added in v0.92.0
func (q *Queries) IdentityPublicUsersByIDs(ctx context.Context, ids []string) ([]IdentityPublicUsersByIDsRow, error)
The PUBLIC-safe display projection (#268): no email column is selected, so a caller cannot leak one by forgetting a tag. Soft-deleted rows ARE returned — the Go layer tombstones them — so a reference to a deleted author resolves to a stable placeholder instead of silently vanishing.
func (*Queries) IdentityUserLivenessByIDs ¶ added in v0.92.0
func (q *Queries) IdentityUserLivenessByIDs(ctx context.Context, ids []string) ([]IdentityUserLivenessByIDsRow, error)
The batch account-liveness read behind verify's liveness gate (#267): the ban/ delete/reserve columns AND the fresh identity fields, in ONE query, so a host never needs an admin-privileged user read to refresh display claims. The reserved expression mirrors UserIsReserved (owner_namespace.sql) so the two cannot disagree about what "reserved" means.
func (*Queries) IdentityUsersByIDs ¶
func (q *Queries) IdentityUsersByIDs(ctx context.Context, ids []string) ([]IdentityUsersByIDsRow, error)
Batch user projections (core user enrichment paths).
func (*Queries) LookupSignedDocument ¶ added in v0.91.0
func (*Queries) MFAClearDefaultFactors ¶ added in v0.56.0
func (*Queries) MFAConsumeBackupCode ¶ added in v0.63.0
func (q *Queries) MFAConsumeBackupCode(ctx context.Context, arg MFAConsumeBackupCodeParams) (int64, error)
Atomic single-use consume: removes the hashed code and reports rows affected. 1 = this caller consumed it; 0 = code absent / already used / 2FA disabled. The `= ANY(...)` guard makes the test-and-remove a single statement so concurrent submissions of the same code cannot both succeed.
func (*Queries) MFAConsumeFactorTOTPStep ¶ added in v0.56.0
func (*Queries) MFADeleteAllFactors ¶ added in v0.56.0
func (*Queries) MFADeleteFactor ¶ added in v0.56.0
func (*Queries) MFADisable ¶ added in v0.56.0
Two-factor queries (core/service.go).
#125: factors are hard-deleted (no per-factor `enabled` flag). mfa_settings holds only the account-level gate (`enabled`) + `backup_codes`; per-factor data (method/phone/totp_secret/last_totp_step) lives ONLY on mfa_factors.
func (*Queries) MFAInsertFactor ¶ added in v0.98.0
func (q *Queries) MFAInsertFactor(ctx context.Context, arg MFAInsertFactorParams) (ProfilesMfaFactor, error)
func (*Queries) MFAListFactorsByUser ¶ added in v0.56.0
func (*Queries) MFALockUser ¶ added in v0.98.0
func (*Queries) MFASetBackupCodes ¶ added in v0.56.0
func (q *Queries) MFASetBackupCodes(ctx context.Context, arg MFASetBackupCodesParams) error
func (*Queries) MFASetDefaultFactor ¶ added in v0.56.0
func (*Queries) MFASettingsByUser ¶ added in v0.56.0
func (*Queries) MFAUpsertSettings ¶ added in v0.56.0
func (q *Queries) MFAUpsertSettings(ctx context.Context, arg MFAUpsertSettingsParams) error
func (*Queries) NameClaimsDeleteExpired ¶ added in v0.98.0
func (*Queries) ProviderLinkByIssuer ¶
func (q *Queries) ProviderLinkByIssuer(ctx context.Context, arg ProviderLinkByIssuerParams) (ProviderLinkByIssuerRow, error)
func (*Queries) ProviderLinkByIssuerAny ¶ added in v0.97.1
func (q *Queries) ProviderLinkByIssuerAny(ctx context.Context, arg ProviderLinkByIssuerAnyParams) (ProviderLinkByIssuerAnyRow, error)
func (*Queries) RemoteAppAttributeDefDelete ¶ added in v0.27.0
func (*Queries) RemoteAppAttributeDefGet ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefGet(ctx context.Context, arg RemoteAppAttributeDefGetParams) (RemoteAppAttributeDefGetRow, error)
func (*Queries) RemoteAppAttributeDefGetLatest ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefGetLatest(ctx context.Context, arg RemoteAppAttributeDefGetLatestParams) (RemoteAppAttributeDefGetLatestRow, error)
func (*Queries) RemoteAppAttributeDefUpsert ¶ added in v0.27.0
func (q *Queries) RemoteAppAttributeDefUpsert(ctx context.Context, arg RemoteAppAttributeDefUpsertParams) (RemoteAppAttributeDefUpsertRow, error)
Attribute definition registry (#75): REFERENCE-mode opaque definitions.
func (*Queries) RemoteAppAttributeDefsList ¶ added in v0.27.0
func (*Queries) RemoteApplicationByDomainForUpdate ¶ added in v0.88.0
func (*Queries) RemoteApplicationByIssuer ¶ added in v0.27.0
func (*Queries) RemoteApplicationBySlug ¶ added in v0.27.0
func (*Queries) RemoteApplicationBySlugForUpdate ¶ added in v0.88.0
func (q *Queries) RemoteApplicationBySlugForUpdate(ctx context.Context, slug string) (RemoteApplicationBySlugForUpdateRow, error)
Application self-registration (#264). Domain-rooted rows are KEYED by the proven domain (create-or-reprove idempotency); the slug is a separately claimed handle and the uuid stays stable across every refresh/rotation.
func (*Queries) RemoteApplicationDelete ¶ added in v0.27.0
func (*Queries) RemoteApplicationDomainInsert ¶ added in v0.88.0
func (q *Queries) RemoteApplicationDomainInsert(ctx context.Context, arg RemoteApplicationDomainInsertParams) (RemoteApplicationDomainInsertRow, error)
func (*Queries) RemoteApplicationDomainRefresh ¶ added in v0.88.0
func (q *Queries) RemoteApplicationDomainRefresh(ctx context.Context, arg RemoteApplicationDomainRefreshParams) (RemoteApplicationDomainRefreshRow, error)
Idempotent re-registration: the re-fetched document is the trust-root proof, so it refreshes issuer/keys/config, re-proves the root, and re-enables a sweeper-disabled row. Tier is untouched (approval is an admin act).
func (*Queries) RemoteApplicationRepoint ¶ added in v0.88.0
func (q *Queries) RemoteApplicationRepoint(ctx context.Context, arg RemoteApplicationRepointParams) (RemoteApplicationRepointRow, error)
Application.json re-point: the app moved domains (the TRUST ROOT moves). Signed request + a fresh fetch of the NEW domain's document both verified by the caller. uuid, slug, and org are all stable — the slug is a claimed handle, not the domain.
func (*Queries) RemoteApplicationRotateTrustSource ¶ added in v0.88.0
func (q *Queries) RemoteApplicationRotateTrustSource(ctx context.Context, arg RemoteApplicationRotateTrustSourceParams) (RemoteApplicationRotateTrustSourceRow, error)
Old-key-signs-new convenience rotation (the trust root remains the ONLY mandatory rotation path). Does NOT touch root_verified_at.
func (*Queries) RemoteApplicationSetTier ¶ added in v0.88.0
func (q *Queries) RemoteApplicationSetTier(ctx context.Context, arg RemoteApplicationSetTierParams) (RemoteApplicationSetTierRow, error)
func (*Queries) RemoteApplicationUpsert ¶ added in v0.27.0
func (q *Queries) RemoteApplicationUpsert(ctx context.Context, arg RemoteApplicationUpsertParams) (RemoteApplicationUpsertRow, error)
Remote application registry (core/service_remote_applications.go). A remote_application is the federation PRINCIPAL: it authenticates by signing JWTs verified against its JWKS/public keys (#74).
The controlling group is addressed as permission_group_id throughout.
func (*Queries) RemoteApplicationsAll ¶ added in v0.27.0
func (q *Queries) RemoteApplicationsAll(ctx context.Context) ([]RemoteApplicationsAllRow, error)
func (*Queries) RemoteApplicationsEnabled ¶ added in v0.27.0
func (q *Queries) RemoteApplicationsEnabled(ctx context.Context) ([]RemoteApplicationsEnabledRow, error)
func (*Queries) ResolveUsername ¶ added in v0.98.0
func (q *Queries) ResolveUsername(ctx context.Context, arg ResolveUsernameParams) (ResolveUsernameRow, error)
func (*Queries) SaveSignedDocument ¶ added in v0.91.0
func (q *Queries) SaveSignedDocument(ctx context.Context, arg SaveSignedDocumentParams) (int64, error)
ak#260: AuthKit-owned signed-document store (documents.Service). SaveSignedDocument persists an immutable signed document. The upsert is the digest-immutability guard: a conflicting digest only updates compact_jws when the stored type AND exact payload bytes match (a key-rotation re-signature of the same document); any other collision affects 0 rows and the caller fails loudly.
func (*Queries) SessionByCurrentTokenHash ¶
func (q *Queries) SessionByCurrentTokenHash(ctx context.Context, arg SessionByCurrentTokenHashParams) (SessionByCurrentTokenHashRow, error)
func (*Queries) SessionByHistoricalTokenHash ¶ added in v0.98.0
func (q *Queries) SessionByHistoricalTokenHash(ctx context.Context, arg SessionByHistoricalTokenHashParams) (SessionByHistoricalTokenHashRow, error)
Every consumed token stays attributable for the session lifetime. Only the immediate predecessor can open the current grace seal; older hashes still identify the family for reuse detection.
func (*Queries) SessionCreateLock ¶ added in v0.72.0
Refresh-session queries (core/service_sessions.go). Transaction-scoped advisory lock that serializes concurrent session creation for the same (user, issuer). Taken before the cap count + evict + insert so those run on a consistent view and the active session count can never exceed SessionMaxPerUser under concurrent logins. Auto-released at transaction end; MUST be called inside a transaction.
func (*Queries) SessionEventInsert ¶ added in v0.81.0
func (q *Queries) SessionEventInsert(ctx context.Context, arg SessionEventInsertParams) error
Session-event history queries (authcore/session_events.go, #245). Best-effort append-only log: sign-ins, revocations, password changes. Retention-pruned.
func (*Queries) SessionEventsListByUser ¶ added in v0.81.0
func (q *Queries) SessionEventsListByUser(ctx context.Context, arg SessionEventsListByUserParams) ([]SessionEventsListByUserRow, error)
Per-user history, newest-first. An empty events array means all event types.
func (*Queries) SessionEventsPruneBatch ¶ added in v0.81.0
func (q *Queries) SessionEventsPruneBatch(ctx context.Context, arg SessionEventsPruneBatchParams) (int64, error)
One bounded retention batch: delete up to batch_size rows older than cutoff, walking the occurred_at index. Callers loop until a short batch — never an unbounded single DELETE.
func (*Queries) SessionFreshSince ¶
func (q *Queries) SessionFreshSince(ctx context.Context, arg SessionFreshSinceParams) (SessionFreshSinceRow, error)
func (*Queries) SessionIDByCurrentTokenHash ¶
func (*Queries) SessionInsert ¶
func (q *Queries) SessionInsert(ctx context.Context, arg SessionInsertParams) (SessionInsertRow, error)
func (*Queries) SessionMarkAuthenticated ¶
func (q *Queries) SessionMarkAuthenticated(ctx context.Context, arg SessionMarkAuthenticatedParams) (int64, error)
Re-proving identity refreshes the freshness window and UNIONS the methods just used into whatever the session already proved — it never downgrades assurance. A password-only re-auth on an MFA session keeps its otp/mfa AMR, so a later RequireMFA gate still passes.
func (*Queries) SessionRevokeByID ¶
func (*Queries) SessionRevokeByIDForUser ¶
func (*Queries) SessionRotate ¶
Record the consumed hash and rotate in one statement. The CAS admits one writer; an insertion failure rolls back the rotation, and a lost CAS inserts no history. The row's latest seal still re-delivers the same successor to concurrent holders of the immediate predecessor.
func (*Queries) SessionsCountActive ¶
func (*Queries) SessionsDeleteRevokedOrExpiredBatch ¶ added in v0.98.0
func (q *Queries) SessionsDeleteRevokedOrExpiredBatch(ctx context.Context, batchSize int64) (int64, error)
One bounded GC batch (#325): collect up to batch_size dead sessions through the two partial indexes (revoked / expired), then delete them by tuple id so the outer step is a Tid Scan, never a table scan. Callers loop until a short batch. History rows cascade.
func (*Queries) SessionsEvictOldest ¶
func (*Queries) SessionsListByUser ¶
func (q *Queries) SessionsListByUser(ctx context.Context, arg SessionsListByUserParams) ([]SessionsListByUserRow, error)
last_authenticated_at and revoked_at are intentionally NOT selected: the session-list handler never renders them, and revoked_at is always NULL here (the WHERE clause filters to non-revoked rows), so reading them was pure over-fetch (#230).
func (*Queries) SessionsRevokeAll ¶
func (*Queries) SessionsRevokeAllExcept ¶
func (*Queries) SessionsRevokeFamily ¶
func (*Queries) UserApplyEmailChange ¶
func (q *Queries) UserApplyEmailChange(ctx context.Context, arg UserApplyEmailChangeParams) error
func (*Queries) UserApplyPhoneChange ¶
func (q *Queries) UserApplyPhoneChange(ctx context.Context, arg UserApplyPhoneChangeParams) error
func (*Queries) UserByEmail ¶
func (*Queries) UserByID ¶
User-row queries (core/service.go). preferred_language is included in this projection (a widening; no existing caller breaks) so callers that already load the user row — e.g. GET /me — read the language off this row instead of issuing a separate UserPreferredLanguage query (#228).
func (*Queries) UserByPhone ¶
func (*Queries) UserDeleteHard ¶
func (*Queries) UserEmailOrUsernameTaken ¶
func (q *Queries) UserEmailOrUsernameTaken(ctx context.Context, arg UserEmailOrUsernameTakenParams) (UserEmailOrUsernameTakenRow, error)
func (*Queries) UserHasPassword ¶
func (*Queries) UserImportInsert ¶
func (q *Queries) UserImportInsert(ctx context.Context, arg UserImportInsertParams) error
func (*Queries) UserImportUpdate ¶
func (*Queries) UserInsert ¶
func (q *Queries) UserInsert(ctx context.Context, arg UserInsertParams) (UserInsertRow, error)
func (*Queries) UserIsReserved ¶
Owner-namespace queries (core/service_owner_namespace*.go, core/owner_namespace_lookup.go).
Permission groups own group-scoped routing now. The reserved-account guard is users.metadata->>'reserved' (UserIsReserved); active aliases come from name_claims; rename history is not authority.
func (*Queries) UserMetadata ¶
Reserved-account + metadata queries (core/service_reserved_accounts.go).
func (*Queries) UserMetadataPatch ¶
func (*Queries) UserPasswordInsert ¶
func (q *Queries) UserPasswordInsert(ctx context.Context, arg UserPasswordInsertParams) error
func (*Queries) UserPasswordRow ¶
func (*Queries) UserPasswordUpsert ¶
func (q *Queries) UserPasswordUpsert(ctx context.Context, arg UserPasswordUpsertParams) error
func (*Queries) UserPhoneOrUsernameTaken ¶
func (q *Queries) UserPhoneOrUsernameTaken(ctx context.Context, arg UserPhoneOrUsernameTakenParams) (UserPhoneOrUsernameTakenRow, error)
func (*Queries) UserPreferredLanguage ¶ added in v0.54.0
func (*Queries) UserProviderByIssuerAny ¶ added in v0.97.1
func (q *Queries) UserProviderByIssuerAny(ctx context.Context, arg UserProviderByIssuerAnyParams) (UserProviderByIssuerAnyRow, error)
func (*Queries) UserProviderCountForUpdate ¶ added in v0.72.0
Locks the user's provider rows (FOR UPDATE in the inner query) and returns the count, so a concurrent unlink for the same user serializes behind this lock — closing the last-credential TOCTOU. Must run inside a transaction.
func (*Queries) UserProviderDeleteBySlug ¶
func (q *Queries) UserProviderDeleteBySlug(ctx context.Context, arg UserProviderDeleteBySlugParams) error
func (*Queries) UserProviderImportUnverified ¶ added in v0.97.1
func (q *Queries) UserProviderImportUnverified(ctx context.Context, arg UserProviderImportUnverifiedParams) (UserProviderImportUnverifiedRow, error)
func (*Queries) UserProviderLinkExists ¶
func (q *Queries) UserProviderLinkExists(ctx context.Context, arg UserProviderLinkExistsParams) (bool, error)
HTTP-layer provider lookups (http/step_up.go, http/user_me_get.go).
func (*Queries) UserProviderMergeProfile ¶
func (q *Queries) UserProviderMergeProfile(ctx context.Context, arg UserProviderMergeProfileParams) error
func (*Queries) UserProviderSetUsername ¶
func (q *Queries) UserProviderSetUsername(ctx context.Context, arg UserProviderSetUsernameParams) error
func (*Queries) UserProviderSlugs ¶
func (*Queries) UserProviderSlugsDistinct ¶
func (*Queries) UserProviderSubjectProfileByIssuer ¶
func (q *Queries) UserProviderSubjectProfileByIssuer(ctx context.Context, arg UserProviderSubjectProfileByIssuerParams) (UserProviderSubjectProfileByIssuerRow, error)
func (*Queries) UserProviderUnverifiedForUpdate ¶ added in v0.97.1
func (*Queries) UserProviderUpsertByIssuer ¶
func (q *Queries) UserProviderUpsertByIssuer(ctx context.Context, arg UserProviderUpsertByIssuerParams) (UserProviderUpsertByIssuerRow, error)
func (*Queries) UserProviderVerifyImported ¶ added in v0.97.1
func (*Queries) UserProvidersCount ¶
Provider-link queries (core/service.go).
func (*Queries) UserSetAvatarURL ¶ added in v0.90.0
func (*Queries) UserSetEmailAndUnverify ¶
func (q *Queries) UserSetEmailAndUnverify(ctx context.Context, arg UserSetEmailAndUnverifyParams) error
func (*Queries) UserSetEmailVerified ¶
func (q *Queries) UserSetEmailVerified(ctx context.Context, arg UserSetEmailVerifiedParams) error
func (*Queries) UserSetLastLogin ¶
func (q *Queries) UserSetLastLogin(ctx context.Context, arg UserSetLastLoginParams) error
func (*Queries) UserSetPhoneAndVerified ¶
func (q *Queries) UserSetPhoneAndVerified(ctx context.Context, arg UserSetPhoneAndVerifiedParams) error
func (*Queries) UserSetPhoneVerifiedByID ¶
func (q *Queries) UserSetPhoneVerifiedByID(ctx context.Context, arg UserSetPhoneVerifiedByIDParams) error
func (*Queries) UserSetPhoneVerifiedByIDAndPhone ¶
func (q *Queries) UserSetPhoneVerifiedByIDAndPhone(ctx context.Context, arg UserSetPhoneVerifiedByIDAndPhoneParams) error
func (*Queries) UserSetPreferredLanguage ¶ added in v0.54.0
func (q *Queries) UserSetPreferredLanguage(ctx context.Context, arg UserSetPreferredLanguageParams) error
func (*Queries) UserSlugAliases ¶
func (*Queries) UserSoftDelete ¶
func (*Queries) UserUsernameExists ¶
func (*Queries) UsersPurgeCandidates ¶
type RemoteAppAttributeDefDeleteParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetLatestParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetLatestRow ¶ added in v0.27.0
type RemoteAppAttributeDefGetParams ¶ added in v0.27.0
type RemoteAppAttributeDefGetRow ¶ added in v0.27.0
type RemoteAppAttributeDefUpsertParams ¶ added in v0.27.0
type RemoteAppAttributeDefUpsertRow ¶ added in v0.27.0
type RemoteAppAttributeDefsListRow ¶ added in v0.27.0
type RemoteApplicationByDomainForUpdateRow ¶ added in v0.88.0
type RemoteApplicationByDomainForUpdateRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationByIssuerRow ¶ added in v0.27.0
type RemoteApplicationByIssuerRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationBySlugForUpdateRow ¶ added in v0.88.0
type RemoteApplicationBySlugForUpdateRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationBySlugRow ¶ added in v0.27.0
type RemoteApplicationBySlugRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationDomainInsertParams ¶ added in v0.88.0
type RemoteApplicationDomainInsertRow ¶ added in v0.88.0
type RemoteApplicationDomainInsertRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationDomainRefreshParams ¶ added in v0.88.0
type RemoteApplicationDomainRefreshRow ¶ added in v0.88.0
type RemoteApplicationDomainRefreshRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationRepointParams ¶ added in v0.88.0
type RemoteApplicationRepointRow ¶ added in v0.88.0
type RemoteApplicationRepointRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationRotateTrustSourceParams ¶ added in v0.88.0
type RemoteApplicationRotateTrustSourceRow ¶ added in v0.88.0
type RemoteApplicationRotateTrustSourceRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationSetTierParams ¶ added in v0.88.0
type RemoteApplicationSetTierRow ¶ added in v0.88.0
type RemoteApplicationSetTierRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationUpsertParams ¶ added in v0.27.0
type RemoteApplicationUpsertRow ¶ added in v0.27.0
type RemoteApplicationUpsertRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationsAllRow ¶ added in v0.27.0
type RemoteApplicationsAllRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type RemoteApplicationsEnabledRow ¶ added in v0.27.0
type RemoteApplicationsEnabledRow struct {
ID string
Slug string
PermissionGroupID string
Issuer string
JwksUri string
Mode string
PublicKeys []byte
Enabled bool
DisplayName string
Tier string
TrustRoot string
Domain string
DocumentEndpoint string
RootVerifiedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
}
type ResolveUsernameParams ¶ added in v0.98.0
type ResolveUsernameRow ¶ added in v0.98.0
type SaveSignedDocumentParams ¶ added in v0.91.0
type SessionByHistoricalTokenHashParams ¶ added in v0.98.0
type SessionByHistoricalTokenHashRow ¶ added in v0.98.0
type SessionEventInsertParams ¶ added in v0.81.0
type SessionEventsListByUserParams ¶ added in v0.81.0
type SessionEventsListByUserRow ¶ added in v0.81.0
type SessionEventsPruneBatchParams ¶ added in v0.81.0
type SessionFreshSinceParams ¶
type SessionFreshSinceRow ¶ added in v0.52.0
type SessionInsertParams ¶
type SessionInsertRow ¶
type SessionRevokeByIDParams ¶
type SessionRotateParams ¶
type SessionsListByUserRow ¶
type SessionsRevokeAllParams ¶
type SessionsRevokeFamilyRow ¶
type UserBanParams ¶
type UserByEmailRow ¶
type UserByIDRow ¶
type UserByIDRow struct {
ID string
Email *string
PhoneNumber *string
Username *string
EmailVerified bool
PhoneVerified bool
BannedAt *time.Time
BannedUntil *time.Time
BanReason *string
BannedBy *string
DeletedAt *time.Time
CreatedAt time.Time
UpdatedAt time.Time
LastLogin *time.Time
PreferredLanguage *string
AvatarUrl *string
}