Skip to content

Commit 2a30b12

Browse files
maparentmaparent
authored
ENG-1718 A database table to pass arbitrary payload between processes (#1009)
1 parent 9026fb2 commit 2a30b12

3 files changed

Lines changed: 133 additions & 0 deletions

File tree

‎packages/database/src/dbTypes.ts‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -722,6 +722,30 @@ export type Database = {
722722
},
723723
]
724724
}
725+
secret_token: {
726+
Row: {
727+
creator: string
728+
expiry_date: string | null
729+
id: string
730+
one_time_use: boolean | null
731+
payload: Json
732+
}
733+
Insert: {
734+
creator?: string
735+
expiry_date?: string | null
736+
id?: string
737+
one_time_use?: boolean | null
738+
payload: Json
739+
}
740+
Update: {
741+
creator?: string
742+
expiry_date?: string | null
743+
id?: string
744+
one_time_use?: boolean | null
745+
payload?: Json
746+
}
747+
Relationships: []
748+
}
725749
Space: {
726750
Row: {
727751
id: number
@@ -1448,6 +1472,14 @@ export type Database = {
14481472
}
14491473
Returns: number
14501474
}
1475+
create_secret_token: {
1476+
Args: {
1477+
expiry_interval?: string
1478+
v_one_time_use?: boolean
1479+
v_payload: Json
1480+
}
1481+
Returns: string
1482+
}
14511483
document_in_space: { Args: { document_id: number }; Returns: boolean }
14521484
document_of_content: {
14531485
Args: { content: Database["public"]["Views"]["my_contents"]["Row"] }
@@ -1489,6 +1521,7 @@ export type Database = {
14891521
}
14901522
Returns: boolean
14911523
}
1524+
get_secret_token: { Args: { token: string }; Returns: Json }
14921525
get_space_anonymous_email: {
14931526
Args: {
14941527
platform: Database["public"]["Enums"]["Platform"]

‎packages/database/supabase/migrations/20260507150056_database_secret_tokens.sql‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
CREATE TABLE IF NOT EXISTS public.secret_token (
2+
id varchar PRIMARY KEY DEFAULT encode(extensions.gen_random_bytes(12), 'base64'),
3+
creator UUID NOT NULL DEFAULT auth.uid(),
4+
payload JSONB NOT NULL,
5+
expiry_date timestamp without time zone,
6+
one_time_use boolean DEFAULT true
7+
);
8+
9+
CREATE INDEX IF NOT EXISTS secret_token_expiry_idx ON public.secret_token (expiry_date) WHERE expiry_date IS NOT null;
10+
11+
CREATE OR REPLACE FUNCTION public.create_secret_token(v_payload JSONB, v_one_time_use BOOLEAN DEFAULT true, expiry_interval INTERVAL DEFAULT '30d') RETURNS VARCHAR
12+
SECURITY DEFINER
13+
SET search_path = ''
14+
LANGUAGE sql AS $$
15+
INSERT INTO public.secret_token (payload, expiry_date, one_time_use) VALUES (v_payload, now()+expiry_interval, v_one_time_use) RETURNING id;
16+
$$;
17+
18+
CREATE OR REPLACE FUNCTION public.get_secret_token(token VARCHAR) RETURNS JSONB
19+
SECURITY DEFINER
20+
SET search_path = ''
21+
LANGUAGE plpgsql AS $$
22+
DECLARE
23+
v_payload JSONB;
24+
v_one_time_use BOOLEAN;
25+
BEGIN
26+
DELETE FROM public.secret_token WHERE expiry_date < now();
27+
DELETE FROM public.secret_token WHERE id=token AND one_time_use = true RETURNING payload INTO v_payload;
28+
IF v_payload IS NULL THEN
29+
SELECT payload INTO v_payload FROM public.secret_token WHERE id=token;
30+
END IF;
31+
RETURN v_payload;
32+
END;
33+
$$;
34+
35+
ALTER TABLE secret_token OWNER TO "postgres";
36+
37+
REVOKE ALL ON TABLE public.secret_token FROM anon;
38+
GRANT ALL ON TABLE public.secret_token TO authenticated;
39+
GRANT ALL ON TABLE public.secret_token TO service_role;
40+
41+
ALTER TABLE public.secret_token ENABLE ROW LEVEL SECURITY;
42+
DROP POLICY IF EXISTS concept_policy ON public.secret_token;
43+
DROP POLICY IF EXISTS concept_select_policy ON public.secret_token;
44+
CREATE POLICY concept_select_policy ON public.secret_token FOR SELECT USING (creator = auth.uid());
45+
DROP POLICY IF EXISTS concept_delete_policy ON public.secret_token;
46+
CREATE POLICY concept_delete_policy ON public.secret_token FOR DELETE USING (creator = auth.uid());
47+
DROP POLICY IF EXISTS concept_insert_policy ON public.secret_token;
48+
-- Do not allow insert except through create_secret_token
49+
DROP POLICY IF EXISTS concept_update_policy ON public.secret_token;
50+
CREATE POLICY concept_update_policy ON public.secret_token FOR UPDATE USING (creator = auth.uid());

‎packages/database/supabase/schemas/secret_tokens.sql‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
CREATE TABLE IF NOT EXISTS public.secret_token (
2+
id varchar PRIMARY KEY DEFAULT encode(extensions.gen_random_bytes(12), 'base64'),
3+
creator UUID NOT NULL DEFAULT auth.uid(),
4+
payload JSONB NOT NULL,
5+
expiry_date timestamp without time zone,
6+
one_time_use boolean DEFAULT true
7+
);
8+
9+
CREATE INDEX IF NOT EXISTS secret_token_expiry_idx ON public.secret_token (expiry_date) WHERE expiry_date IS NOT null;
10+
11+
CREATE OR REPLACE FUNCTION public.create_secret_token(v_payload JSONB, v_one_time_use BOOLEAN DEFAULT true, expiry_interval INTERVAL DEFAULT '30d') RETURNS VARCHAR
12+
SECURITY DEFINER
13+
SET search_path = ''
14+
LANGUAGE sql AS $$
15+
INSERT INTO public.secret_token (payload, expiry_date, one_time_use) VALUES (v_payload, now()+expiry_interval, v_one_time_use) RETURNING id;
16+
$$;
17+
18+
CREATE OR REPLACE FUNCTION public.get_secret_token(token VARCHAR) RETURNS JSONB
19+
SECURITY DEFINER
20+
SET search_path = ''
21+
LANGUAGE plpgsql AS $$
22+
DECLARE
23+
v_payload JSONB;
24+
v_one_time_use BOOLEAN;
25+
BEGIN
26+
DELETE FROM public.secret_token WHERE expiry_date < now();
27+
DELETE FROM public.secret_token WHERE id=token AND one_time_use = true RETURNING payload INTO v_payload;
28+
IF v_payload IS NULL THEN
29+
SELECT payload INTO v_payload FROM public.secret_token WHERE id=token;
30+
END IF;
31+
RETURN v_payload;
32+
END;
33+
$$;
34+
35+
ALTER TABLE secret_token OWNER TO "postgres";
36+
37+
REVOKE ALL ON TABLE public.secret_token FROM anon;
38+
GRANT ALL ON TABLE public.secret_token TO authenticated;
39+
GRANT ALL ON TABLE public.secret_token TO service_role;
40+
41+
ALTER TABLE public.secret_token ENABLE ROW LEVEL SECURITY;
42+
DROP POLICY IF EXISTS concept_policy ON public.secret_token;
43+
DROP POLICY IF EXISTS concept_select_policy ON public.secret_token;
44+
CREATE POLICY concept_select_policy ON public.secret_token FOR SELECT USING (creator = auth.uid());
45+
DROP POLICY IF EXISTS concept_delete_policy ON public.secret_token;
46+
CREATE POLICY concept_delete_policy ON public.secret_token FOR DELETE USING (creator = auth.uid());
47+
DROP POLICY IF EXISTS concept_insert_policy ON public.secret_token;
48+
-- Do not allow insert except through create_secret_token
49+
DROP POLICY IF EXISTS concept_update_policy ON public.secret_token;
50+
CREATE POLICY concept_update_policy ON public.secret_token FOR UPDATE USING (creator = auth.uid());

0 commit comments

Comments
 (0)