postgres

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 19, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func MigrateDown 

func MigrateDown(databaseURL string) error

MigrateDown rolls back the last migration

func MigrateUp 

func MigrateUp(databaseURL string) error

MigrateUp applies all pending migrations

func MigrateVersion 

func MigrateVersion(databaseURL string) (uint, bool, error)

MigrateVersion returns the current migration version

Types

type DB 

type DB = postgres.DB[*sqlc.Queries]

DB is the database connection for heimdall

func NewDB 

func NewDB(ctx context.Context, databaseURL string) (*DB, error)

NewDB creates a new database connection pool

type LoginAttemptsDB 

type LoginAttemptsDB struct {
	// contains filtered or unexported fields
}

LoginAttemptsDB tracks failed login attempts for progressive lockout and audit trail

func NewLoginAttemptsDB 

func NewLoginAttemptsDB(db *DB) *LoginAttemptsDB

func (*LoginAttemptsDB) DeleteLoginAttempts 

func (r *LoginAttemptsDB) DeleteLoginAttempts(ctx context.Context, userID uuid.UUID) error

DeleteLoginAttempts removes all login attempts for a user after successful authentication

func (*LoginAttemptsDB) GetMostRecentLockout 

func (r *LoginAttemptsDB) GetMostRecentLockout(ctx context.Context, email string) (*time.Time, error)

GetMostRecentLockout returns latest lockout expiry time (nil if no active lockouts)

func (*LoginAttemptsDB) GetRecentFailedAttempts 

func (r *LoginAttemptsDB) GetRecentFailedAttempts(ctx context.Context, email string, since time.Time) (int64, error)

GetRecentFailedAttempts counts failed login attempts since specified time (for lockout calculation)

func (*LoginAttemptsDB) RecordAttempt 

func (r *LoginAttemptsDB) RecordAttempt(ctx context.Context, email string, userID *uuid.UUID, lockedUntil *time.Time) error

RecordAttempt logs failed login attempt with calculated lockout expiry (pre-authentication operation)

type MFABackupCodesDB 

type MFABackupCodesDB struct {
	// contains filtered or unexported fields
}

MFABackupCodesDB manages MFA backup codes (authenticated operations)

func NewMFABackupCodesDB 

func NewMFABackupCodesDB(db *DB) *MFABackupCodesDB

func (*MFABackupCodesDB) CountUnused 

func (r *MFABackupCodesDB) CountUnused(ctx context.Context, userID uuid.UUID) (int, error)

CountUnused counts unused backup codes for a user

func (*MFABackupCodesDB) CreateBatch 

func (r *MFABackupCodesDB) CreateBatch(ctx context.Context, userID uuid.UUID, codeHashes []string) error

CreateBatch creates multiple backup codes using batch insert

func (*MFABackupCodesDB) DeleteByUserID 

func (r *MFABackupCodesDB) DeleteByUserID(ctx context.Context, userID uuid.UUID) error

DeleteByUserID deletes all backup codes for a user

func (*MFABackupCodesDB) GetUnusedByUserID 

func (r *MFABackupCodesDB) GetUnusedByUserID(ctx context.Context, userID uuid.UUID) ([]*iam.MFABackupCode, error)

GetUnusedByUserID retrieves all unused backup codes for a user

func (*MFABackupCodesDB) MarkUsed 

func (r *MFABackupCodesDB) MarkUsed(ctx context.Context, codeID uuid.UUID) error

MarkUsed marks a backup code as used

type MFASettingsDB 

type MFASettingsDB struct {
	// contains filtered or unexported fields
}

MFASettingsDB manages MFA settings (authenticated operations)

func NewMFASettingsDB 

func NewMFASettingsDB(db *DB) *MFASettingsDB

func (*MFASettingsDB) Create 

func (r *MFASettingsDB) Create(ctx context.Context, userID uuid.UUID, encryptedSecret string) (*iam.MFASettings, error)

Create creates MFA settings for a user

func (*MFASettingsDB) Delete 

func (r *MFASettingsDB) Delete(ctx context.Context, userID uuid.UUID) error

Delete deletes MFA settings for a user

func (*MFASettingsDB) GetByUserID 

func (r *MFASettingsDB) GetByUserID(ctx context.Context, userID uuid.UUID) (*iam.MFASettings, error)

GetByUserID retrieves MFA settings by user ID

func (*MFASettingsDB) Update 

func (r *MFASettingsDB) Update(ctx context.Context, settings *iam.MFASettings) error

Update updates MFA settings

func (*MFASettingsDB) UpdateLastUsed 

func (r *MFASettingsDB) UpdateLastUsed(ctx context.Context, userID uuid.UUID, window int64) error

UpdateLastUsed updates last used window and timestamp (for replay prevention)

type OIDCLinksDB 

type OIDCLinksDB struct {
	// contains filtered or unexported fields
}

OIDCLinksDB manages user-to-provider links for SSO (tracks by provider's sub claim)

func NewOIDCLinksDB 

func NewOIDCLinksDB(db *DB) *OIDCLinksDB
func (o *OIDCLinksDB) CreateOIDCLink(ctx context.Context, link *iam.OIDCLink) (*iam.OIDCLink, error)

CreateOIDCLink creates link between user and provider (tracks by immutable sub claim) 

func (o *OIDCLinksDB) DeleteOIDCLink(ctx context.Context, userID uuid.UUID, providerID uuid.UUID) error

DeleteOIDCLink deletes an OIDC link by user ID and provider ID

func (*OIDCLinksDB) GetOIDCLinkByProvider 

func (o *OIDCLinksDB) GetOIDCLinkByProvider(ctx context.Context, providerID uuid.UUID, providerUserID string) (*iam.OIDCLink, error)

GetOIDCLinkByProvider retrieves link by provider's sub claim (allows email reassignment)

func (*OIDCLinksDB) GetOIDCLinkByUser 

func (o *OIDCLinksDB) GetOIDCLinkByUser(ctx context.Context, userID uuid.UUID, providerID uuid.UUID) (*iam.OIDCLink, error)

GetOIDCLinkByUser retrieves an OIDC link by user ID and provider ID

func (*OIDCLinksDB) ListOIDCLinksByUser 

func (o *OIDCLinksDB) ListOIDCLinksByUser(ctx context.Context, userID uuid.UUID) ([]*iam.OIDCLink, error)

ListOIDCLinksByUser lists all OIDC links for a user

func (*OIDCLinksDB) UpdateOIDCLinkLastUsed 

func (o *OIDCLinksDB) UpdateOIDCLinkLastUsed(ctx context.Context, id uuid.UUID) error

UpdateOIDCLinkLastUsed updates the last_used_at timestamp

type OIDCProvidersDB 

type OIDCProvidersDB struct {
	// contains filtered or unexported fields
}

OIDCProvidersDB manages tenant-specific OIDC provider configs with encrypted secrets

func NewOIDCProvidersDB 

func NewOIDCProvidersDB(db *DB, cipher *aes.Cipher) *OIDCProvidersDB

func (*OIDCProvidersDB) CreateOIDCProvider 

func (o *OIDCProvidersDB) CreateOIDCProvider(ctx context.Context, provider *iam.OIDCProviderConfig) (*iam.OIDCProviderConfig, error)

CreateOIDCProvider stores provider config with AES-256-GCM encrypted client secret

func (*OIDCProvidersDB) DeleteOIDCProviderByID 

func (o *OIDCProvidersDB) DeleteOIDCProviderByID(ctx context.Context, id uuid.UUID) error

DeleteOIDCProviderByID deletes an OAuth provider by ID

func (*OIDCProvidersDB) GetOIDCProviderByID 

func (o *OIDCProvidersDB) GetOIDCProviderByID(ctx context.Context, id uuid.UUID) (*iam.OIDCProviderConfig, error)

GetOIDCProviderByID retrieves provider by ID; RLS enforces tenant isolation

func (*OIDCProvidersDB) GetOIDCProvidersByDomain 

func (o *OIDCProvidersDB) GetOIDCProvidersByDomain(ctx context.Context, domain string) ([]*iam.OIDCProviderConfig, error)

GetOIDCProvidersByDomain retrieves all OAuth providers configured for an email domain This is used for SSO discovery during login (cross-tenant, pre-authentication)

func (*OIDCProvidersDB) ListOIDCProviders 

func (o *OIDCProvidersDB) ListOIDCProviders(ctx context.Context) ([]*iam.OIDCProviderConfig, error)

ListOIDCProviders lists all enabled OAuth providers for the tenant

func (*OIDCProvidersDB) UpdateOIDCProvider 

func (o *OIDCProvidersDB) UpdateOIDCProvider(ctx context.Context, params *iam.UpdateOIDCProviderParams) (*iam.OIDCProviderConfig, error)

UpdateOIDCProvider updates an OAuth provider Fields in params that are pointers (nil) or empty slices will not be updated (COALESCE in SQL)

type OIDCSessionsDB 

type OIDCSessionsDB struct {
	// contains filtered or unexported fields
}

OIDCSessionsDB manages OAuth flow sessions (state, PKCE, provider tracking)

func NewOIDCSessionsDB 

func NewOIDCSessionsDB(db *DB) *OIDCSessionsDB

func (*OIDCSessionsDB) CreateOIDCSession 

func (o *OIDCSessionsDB) CreateOIDCSession(ctx context.Context, session *iam.OIDCSession) (*iam.OIDCSession, error)

CreateOIDCSession creates temporary session for OAuth flow (CSRF protection via state)

func (*OIDCSessionsDB) DeleteExpiredOIDCSessions 

func (o *OIDCSessionsDB) DeleteExpiredOIDCSessions(ctx context.Context) error

DeleteExpiredOIDCSessions deletes all expired OAuth sessions

func (*OIDCSessionsDB) DeleteOIDCSession 

func (o *OIDCSessionsDB) DeleteOIDCSession(ctx context.Context, id uuid.UUID) error

DeleteOIDCSession deletes an OAuth session by ID

func (*OIDCSessionsDB) GetOIDCSessionByState 

func (o *OIDCSessionsDB) GetOIDCSessionByState(ctx context.Context, state string) (*iam.OIDCSession, error)

GetOIDCSessionByState retrieves session by state parameter (validates CSRF token)

type PasswordResetTokensDB 

type PasswordResetTokensDB struct {
	// contains filtered or unexported fields
}

PasswordResetTokensDB manages password reset tokens (pre-authentication operation)

func NewPasswordResetTokensDB 

func NewPasswordResetTokensDB(db *DB) *PasswordResetTokensDB

func (*PasswordResetTokensDB) CreateToken 

func (r *PasswordResetTokensDB) CreateToken(ctx context.Context, userID uuid.UUID, token string, expiresAt time.Time) (*iam.UserToken, error)

CreateToken creates or replaces reset token (user_id is PK, enforces one token per user)

func (*PasswordResetTokensDB) DeleteExpiredTokens 

func (r *PasswordResetTokensDB) DeleteExpiredTokens(ctx context.Context) error

DeleteExpiredTokens cleans up expired tokens (should be called periodically via cleanup job)

func (*PasswordResetTokensDB) DeleteToken 

func (r *PasswordResetTokensDB) DeleteToken(ctx context.Context, userID uuid.UUID) error

DeleteToken removes reset token after successful password change

func (*PasswordResetTokensDB) GetToken 

func (r *PasswordResetTokensDB) GetToken(ctx context.Context, token string) (*iam.UserToken, error)

GetToken retrieves token by token string (pre-authentication, no tenant context)

type PermissionsDB 

type PermissionsDB struct {
	// contains filtered or unexported fields
}

PermissionsDB provides database operations for permissions

func NewPermissionsDB 

func NewPermissionsDB(db *DB) *PermissionsDB

NewPermissionsDB creates a new PermissionsDB

func (*PermissionsDB) GetPermissionByID 

func (p *PermissionsDB) GetPermissionByID(ctx context.Context, permissionID uuid.UUID) (*iam.Permission, error)

GetPermissionByID retrieves a permission by ID

func (*PermissionsDB) GetUserPermissions 

func (p *PermissionsDB) GetUserPermissions(ctx context.Context, userID uuid.UUID) ([]*iam.EffectivePermission, error)

GetUserPermissions retrieves all permissions for a user (from roles + direct)

func (*PermissionsDB) ListPermissions 

func (p *PermissionsDB) ListPermissions(ctx context.Context) ([]*iam.Permission, error)

ListPermissions lists all available permissions (system-wide)

type RefreshTokensDB 

type RefreshTokensDB struct {
	// contains filtered or unexported fields
}

RefreshTokensDB manages refresh token storage for session tracking

func NewRefreshTokensDB 

func NewRefreshTokensDB(db *DB) *RefreshTokensDB

func (*RefreshTokensDB) Create 

func (r *RefreshTokensDB) Create(ctx context.Context, token *iam.RefreshToken) (*iam.RefreshToken, error)

Create stores a new refresh token (requires tenant context from auth flow)

func (*RefreshTokensDB) DeleteExpired 

func (r *RefreshTokensDB) DeleteExpired(ctx context.Context) error

DeleteExpired cleans up expired and old revoked tokens (cleanup job: no tenant context)

func (*RefreshTokensDB) GetByHash 

func (r *RefreshTokensDB) GetByHash(ctx context.Context, tokenHash string) (*iam.RefreshToken, error)

GetByHash retrieves a valid (non-revoked, non-expired) token by hash (requires tenant context)

func (*RefreshTokensDB) GetByHashIncludingRevoked 

func (r *RefreshTokensDB) GetByHashIncludingRevoked(ctx context.Context, tokenHash string) (*iam.RefreshToken, error)

GetByHashIncludingRevoked retrieves a token by hash even if revoked (for reuse detection, requires tenant context)

func (*RefreshTokensDB) ListByUserID 

func (r *RefreshTokensDB) ListByUserID(ctx context.Context, userID uuid.UUID) ([]*iam.RefreshToken, error)

ListByUserID returns all active sessions for a user (authenticated: requires tenant context)

func (*RefreshTokensDB) RevokeAllByUserID 

func (r *RefreshTokensDB) RevokeAllByUserID(ctx context.Context, userID uuid.UUID) error

RevokeAllByUserID revokes all sessions for a user (authenticated: sign out everywhere)

func (*RefreshTokensDB) RevokeByFamilyID 

func (r *RefreshTokensDB) RevokeByFamilyID(ctx context.Context, familyID uuid.UUID) error

RevokeByFamilyID revokes all tokens in a family (for token reuse detection, requires tenant context)

func (*RefreshTokensDB) RevokeByHash 

func (r *RefreshTokensDB) RevokeByHash(ctx context.Context, tokenHash string) error

RevokeByHash revokes a token by its hash (requires tenant context)

func (*RefreshTokensDB) RevokeByID 

func (r *RefreshTokensDB) RevokeByID(ctx context.Context, id uuid.UUID) error

RevokeByID revokes a specific session (authenticated: requires tenant context)

func (*RefreshTokensDB) UpdateLastUsed 

func (r *RefreshTokensDB) UpdateLastUsed(ctx context.Context, id uuid.UUID) error

UpdateLastUsed updates the last_used_at timestamp (requires tenant context)

type RolePermissionsDB 

type RolePermissionsDB struct {
	// contains filtered or unexported fields
}

RolePermissionsDB provides database operations for role permissions

func NewRolePermissionsDB 

func NewRolePermissionsDB(db *DB) *RolePermissionsDB

NewRolePermissionsDB creates a new RolePermissionsDB

func (*RolePermissionsDB) GetRolePermissions 

func (r *RolePermissionsDB) GetRolePermissions(ctx context.Context, roleID uuid.UUID) ([]*iam.Permission, error)

GetRolePermissions retrieves all permissions for a role

func (*RolePermissionsDB) SetRolePermissions 

func (r *RolePermissionsDB) SetRolePermissions(ctx context.Context, roleID uuid.UUID, permissionIDs []uuid.UUID) error

SetRolePermissions replaces all permissions for a role (bulk update)

type RolesDB 

type RolesDB struct {
	// contains filtered or unexported fields
}

RolesDB provides database operations for roles

func NewRolesDB 

func NewRolesDB(db *DB) *RolesDB

NewRolesDB creates a new RolesDB

func (*RolesDB) CreateRole 

func (r *RolesDB) CreateRole(ctx context.Context, role *iam.Role) (*iam.Role, error)

CreateRole creates a new role

func (*RolesDB) DeleteRole 

func (r *RolesDB) DeleteRole(ctx context.Context, roleID uuid.UUID) error

DeleteRole deletes a role

func (*RolesDB) GetRoleByID 

func (r *RolesDB) GetRoleByID(ctx context.Context, roleID uuid.UUID) (*iam.Role, error)

GetRoleByID retrieves a role by ID

func (*RolesDB) ListRoles 

func (r *RolesDB) ListRoles(ctx context.Context) ([]*iam.Role, error)

ListRoles lists all roles for a tenant

func (*RolesDB) UpdateRole 

func (r *RolesDB) UpdateRole(ctx context.Context, params iam.UpdateRoleParams) (*iam.Role, error)

UpdateRole updates a role

type TenantsDB 

type TenantsDB struct {
	// contains filtered or unexported fields
}

TenantsDB provides database operations for tenants

func NewTenantsDB 

func NewTenantsDB(db *DB) *TenantsDB

NewTenantsDB creates a new TenantsDB

func (*TenantsDB) BootstrapTenant 

func (t *TenantsDB) BootstrapTenant(ctx context.Context, email, firstName, lastName string, status iam.UserStatus) (*iam.Tenant, *iam.User, error)

BootstrapTenant creates a new tenant with initial user and System Admin role

type TrustedDevicesDB 

type TrustedDevicesDB struct {
	// contains filtered or unexported fields
}

TrustedDevicesDB manages trusted device storage for MFA bypass

func NewTrustedDevicesDB 

func NewTrustedDevicesDB(db *DB) *TrustedDevicesDB

func (*TrustedDevicesDB) Create 

func (r *TrustedDevicesDB) Create(ctx context.Context, device *iam.TrustedDevice) (*iam.TrustedDevice, error)

Create stores a new trusted device (requires tenant context)

func (*TrustedDevicesDB) DeleteExpired 

func (r *TrustedDevicesDB) DeleteExpired(ctx context.Context) error

DeleteExpired cleans up expired and old revoked devices (cleanup job: no tenant context)

func (*TrustedDevicesDB) GetByTokenHash 

func (r *TrustedDevicesDB) GetByTokenHash(ctx context.Context, tokenHash string) (*iam.TrustedDevice, error)

GetByTokenHash retrieves a valid (non-revoked, non-expired) device by token hash

func (*TrustedDevicesDB) RevokeAllByUserID 

func (r *TrustedDevicesDB) RevokeAllByUserID(ctx context.Context, userID uuid.UUID) error

RevokeAllByUserID revokes all trusted devices for a user

func (*TrustedDevicesDB) UpdateLastUsed 

func (r *TrustedDevicesDB) UpdateLastUsed(ctx context.Context, id uuid.UUID, expiresAt time.Time, ipAddress string) error

UpdateLastUsed updates the last_used_at, expires_at, and ip_address (requires tenant context)

type UserPermissionsDB 

type UserPermissionsDB struct {
	// contains filtered or unexported fields
}

UserPermissionsDB provides database operations for direct user permissions

func NewUserPermissionsDB 

func NewUserPermissionsDB(db *DB) *UserPermissionsDB

NewUserPermissionsDB creates a new UserPermissionsDB

func (*UserPermissionsDB) GetDirectPermissions 

func (u *UserPermissionsDB) GetDirectPermissions(ctx context.Context, userID uuid.UUID) ([]*iam.EffectivePermission, error)

GetDirectPermissions retrieves direct permissions assigned to a user

func (*UserPermissionsDB) SetDirectPermissions 

func (u *UserPermissionsDB) SetDirectPermissions(ctx context.Context, userID uuid.UUID, permissions []iam.DirectPermission) error

SetDirectPermissions sets all direct permissions for a user (replaces existing direct permissions)

type UserRolesDB 

type UserRolesDB struct {
	// contains filtered or unexported fields
}

UserRolesDB provides database operations for user roles

func NewUserRolesDB 

func NewUserRolesDB(db *DB) *UserRolesDB

NewUserRolesDB creates a new UserRolesDB

func (*UserRolesDB) GetUserRoles 

func (u *UserRolesDB) GetUserRoles(ctx context.Context, userID uuid.UUID) ([]*iam.Role, error)

GetUserRoles retrieves all roles for a user

func (*UserRolesDB) SetUserRoles 

func (u *UserRolesDB) SetUserRoles(ctx context.Context, userID uuid.UUID, roleIDs []uuid.UUID) error

SetUserRoles sets all roles for a user (replaces existing roles)

type UsersDB 

type UsersDB struct {
	// contains filtered or unexported fields
}

UsersDB handles user database operations with tenant isolation

func NewUsersDB 

func NewUsersDB(db *DB) *UsersDB

NewUsersDB creates a new UsersDB instance

func (*UsersDB) CreateUser 

func (u *UsersDB) CreateUser(ctx context.Context, user *iam.User) (*iam.User, error)

CreateUser persists a user in the current tenant context

func (*UsersDB) DeleteOldUnverifiedUsers 

func (u *UsersDB) DeleteOldUnverifiedUsers(ctx context.Context, days int32) error

DeleteOldUnverifiedUsers deletes unverified users older than the specified number of days Cross-tenant cleanup operation runs via scheduled job, not user request

func (*UsersDB) DeleteUser 

func (u *UsersDB) DeleteUser(ctx context.Context, id uuid.UUID) error

DeleteUser deletes a user with tenant isolation

func (*UsersDB) GetUser 

func (u *UsersDB) GetUser(ctx context.Context, id uuid.UUID) (*iam.User, error)

func (*UsersDB) GetUserByEmail 

func (u *UsersDB) GetUserByEmail(ctx context.Context, email string) (*iam.User, error)

GetUserByEmail retrieves a user by email without tenant isolation Pre-authentication operation: emails are globally unique for password users, but may duplicate for SSO users

func (*UsersDB) UpdateLastLogin 

func (u *UsersDB) UpdateLastLogin(ctx context.Context, id uuid.UUID) error

UpdateLastLogin updates a user's last login timestamp

func (*UsersDB) UpdateUser 

func (u *UsersDB) UpdateUser(ctx context.Context, params *iam.UpdateUserParams) (*iam.User, error)

UpdateUser performs a flexible partial update without tenant isolation Used for pre-authentication operations (email verification, password reset)

type VerificationTokensDB 

type VerificationTokensDB struct {
	// contains filtered or unexported fields
}

VerificationTokensDB manages email verification tokens (pre-authentication operation)

func NewVerificationTokensDB 

func NewVerificationTokensDB(db *DB) *VerificationTokensDB

func (*VerificationTokensDB) CreateToken 

func (r *VerificationTokensDB) CreateToken(ctx context.Context, userID uuid.UUID, token string, expiresAt time.Time) (*iam.UserToken, error)

CreateToken creates or replaces verification token (user_id is PK, enforces one token per user)

func (*VerificationTokensDB) DeleteExpiredTokens 

func (r *VerificationTokensDB) DeleteExpiredTokens(ctx context.Context) error

DeleteExpiredTokens cleans up expired tokens (should be called periodically via cleanup job)

func (*VerificationTokensDB) DeleteToken 

func (r *VerificationTokensDB) DeleteToken(ctx context.Context, userID uuid.UUID) error

DeleteToken removes verification token after successful email confirmation

func (*VerificationTokensDB) GetToken 

func (r *VerificationTokensDB) GetToken(ctx context.Context, token string) (*iam.UserToken, error)

GetToken retrieves token by token string (pre-authentication, no tenant context)

Source Files

View all Source files

Directories

Path Synopsis
internal
sqlc

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.