23 lines
1.3 KiB
SQL
23 lines
1.3 KiB
SQL
-- The move of the controller's secrets into the vault (novox/hq ADR 0349 clause 7; design 57's V3, issue 676).
|
|
--
|
|
-- The controller cannot open a value it holds, so each machine's node-engine hands in what was sealed to it, and a
|
|
-- machine asleep when the move starts is moved when it is next heard from. These two tables are what lets the
|
|
-- controller tell, then and later, what has moved: that the move was started, by whom, and whether the record of
|
|
-- asks was copied; and each row the vault took, under the vault's name for it, with the machine whose engine handed
|
|
-- it in, the vault's generation, and a digest of the sealed text the row held then — so a row the controller
|
|
-- changed after it moved is said, never moved over the vault's value. No value and no sealed value is kept here.
|
|
create table secret_move (
|
|
one boolean primary key default true check (one),
|
|
started_at timestamptz not null default now(),
|
|
started_by text not null,
|
|
asks_moved_at timestamptz
|
|
);
|
|
|
|
create table secret_moved (
|
|
secret text primary key,
|
|
node uuid not null references node(id) on delete cascade,
|
|
generation integer not null check (generation > 0),
|
|
sealed_digest text not null,
|
|
moved_at timestamptz not null default now()
|
|
);
|