admindb

func ApplySchemas ¶

func ApplySchemas(sqlClient db.SQLClient) error

ApplySchemas applies the admin DB schema to the given SQL client.

func BootstrapPermissions ¶

func BootstrapPermissions(client db.SQLClient) error

BootstrapPermissions inserts the fixed set of permissions if they do not yet exist.

func BootstrapSuperuser ¶

func BootstrapSuperuser(client db.SQLClient, clientID, clientSecret string) error

bootstrapSuperuser checks if a super user exists and if not, creates one with the provided credentials. This is to allow bootstrapping of the first super user. Subsequent calls to this function will not have any effect. This is to prevent re-provisioning of the super-user, potentially allowing an attacker to reset powerful credentials.

func CreateDebugSession ¶

func CreateDebugSession(
	ctx context.Context,
	client db.SQLClient,
	backend string,
	expiresAt time.Time,
) (int64, error)

func CreateDebugSessionCall ¶

func CreateDebugSessionCall(
	ctx context.Context,
	client db.SQLClient,
	sessionID int64,
	call adminapi.DebugSessionCall,
) (int64, error)

func CreateGroup ¶

func CreateGroup(ctx context.Context, client db.SQLClient, name string) (int64, error)

func CreateSession ¶

func CreateSession(
	ctx context.Context,
	client db.SQLClient,
	userID int64,
	refreshID string,
	sessionID string,
) error

func CreateUser ¶

func CreateUser(
	ctx context.Context,
	client db.SQLClient,
	username, salt, hashedPassword string,
) (int64, error)

func DeleteDebugSession ¶

func DeleteDebugSession(
	ctx context.Context,
	client db.SQLClient,
	backend string,
	id int64,
) error

func DeleteGroup ¶

func DeleteGroup(ctx context.Context, client db.SQLClient, groupID int64) error

func DeleteSession ¶

func DeleteSession(ctx context.Context, client db.SQLClient, sessionID string) error

func DeleteSuperuserSessions ¶

func DeleteSuperuserSessions(ctx context.Context, client db.SQLClient) error

func DeleteUser ¶

func DeleteUser(ctx context.Context, client db.SQLClient, userID int64) error

func GetDebugSession ¶

func GetDebugSession(
	ctx context.Context,
	client db.SQLClient,
	backend string,
	id int64,
) (*adminapi.DebugSession, error)

func GetDebugSessionCall ¶

func GetDebugSessionCall(
	ctx context.Context,
	client db.SQLClient,
	callID int64,
) (*adminapi.DebugSessionCall, error)

func GetGroup ¶

func GetGroup(ctx context.Context, client db.SQLClient, groupID int64) (*adminapi.Group, error)

GetGroup returns an admin group by ID. Returns (nil, errNoGroup) when no matching group exists.

func GetGroupPermissions ¶

func GetGroupPermissions(
	ctx context.Context,
	client db.SQLClient,
	groupID int64,
) ([]adminapi.Permission, error)

GetGroupPermissions returns the permissions assigned to the given group.

func GetSession ¶

func GetSession(
	ctx context.Context,
	client db.SQLClient,
	sessionID string,
) (*model.Session, error)

GetSession returns a session by its session ID. Returns (nil, errNoSession) when no matching session exists.

func GetSessionByRefresh ¶

func GetSessionByRefresh(
	ctx context.Context,
	client db.SQLClient,
	refreshID string,
) (*model.Session, error)

GetSessionByRefresh returns when the session associated with the given refresh ID expires. Returns (0, errNoSession) when no matching session exists.

func GetSuperuser ¶

func GetSuperuser(ctx context.Context, client db.SQLClient) (*model.User, error)

GetSuperuser returns the superuser row. Returns (nil, errNoSuperuser) when no superuser exists.

func GetUser ¶

func GetUser(ctx context.Context, client db.SQLClient, userID int64) (*adminapi.User, error)

GetUser returns a non-superuser admin user by ID. Returns (nil, errNoUser) when no matching user exists.

func GetUserAuth ¶

func GetUserAuth(
	ctx context.Context,
	client db.SQLClient,
	userID int64,
) (*model.UserAuth, error)

GetUserAuth returns authentication credentials for a non-superuser admin user. Returns (nil, errNoUser) when no matching user exists.

func GetUserPermissionIDs ¶

func GetUserPermissionIDs(
	ctx context.Context,
	client db.SQLClient,
	userID int64,
) ([]int64, error)

GetUserPermissionIDs returns all permission IDs available to the given user via their group memberships.

func ListDebugSessionCalls ¶

func ListDebugSessionCalls(
	ctx context.Context,
	client db.SQLClient,
	sessionID int64,
	includeTransitions bool,
) ([]adminapi.DebugSessionCall, error)

func ListDebugSessionFlowTransitions ¶

func ListDebugSessionFlowTransitions(
	ctx context.Context,
	client db.SQLClient,
	callID int64,
) ([]adminapi.FlowTransition, error)

func ListDebugSessions ¶

func ListDebugSessions(
	ctx context.Context,
	client db.SQLClient,
	backend string,
) ([]adminapi.DebugSession, error)

func ListGroupBindings ¶

func ListGroupBindings(
	ctx context.Context,
	client db.SQLClient,
	userID int64,
) ([]*model.GroupBinding, error)

func ListGroups ¶

func ListGroups(ctx context.Context, client db.SQLClient) ([]adminapi.Group, error)

func ListPermissions ¶

func ListPermissions(ctx context.Context, client db.SQLClient) ([]adminapi.Permission, error)

ListPermissions returns all available permissions.

func ListUsers ¶

func ListUsers(ctx context.Context, client db.SQLClient) ([]adminapi.User, error)

func LoginLookup ¶

func LoginLookup(
	ctx context.Context,
	client db.SQLClient,
	username string,
) (*model.SuperuserLoginUser, error)

LoginLookup looks up a non-superuser admin user by username for authentication. Returns (nil, errNoUser) when no matching user exists.

func SetGroupPermissions ¶

func SetGroupPermissions(
	ctx context.Context,
	client db.SQLClient,
	groupID int64,
	permissionIDs []int,
) error

SetGroupPermissions atomically replaces a group's permission bindings with the provided set.

func UpdateDebugSession ¶

func UpdateDebugSession(
	ctx context.Context,
	client db.SQLClient,
	debugSession adminapi.DebugSession,
) error

func UpdateGroup ¶

func UpdateGroup(ctx context.Context, client db.SQLClient, groupID int64, name string) error

func UpdateSuperuserPassword ¶

func UpdateSuperuserPassword(
	ctx context.Context,
	client db.SQLClient,
	salt, hashedPassword string,
) error

func UpdateUser ¶

func UpdateUser(ctx context.Context, client db.SQLClient, userID int64, username string) error

func UpdateUserGroupBindings ¶

func UpdateUserGroupBindings(
	ctx context.Context,
	client db.SQLClient,
	userID int64,
	desiredGroupIDs []int,
) error

UpdateUserGroupBindings atomically updates a user's group memberships to exactly match desiredGroupIDs.

func UpdateUserPassword ¶

func UpdateUserPassword(
	ctx context.Context,
	client db.SQLClient,
	userID int64,
	salt, hashedPassword string,
) error