Stuck on a bug with auth, but got to push anyway.
This commit is contained in:
Your Name
BIN
db/ginxsom.db
BIN
db/ginxsom.db
Binary file not shown.
BIN
db/ginxsom.db.backup.1755624647
Normal file
BIN
db/ginxsom.db.backup.1755624647
Normal file
Binary file not shown.
170
db/schema.sql
170
db/schema.sql
@@ -65,3 +65,173 @@ SELECT
|
||||
FROM blobs
|
||||
WHERE uploaded_at > (strftime('%s', 'now') - 86400)
|
||||
ORDER BY uploaded_at DESC;
|
||||
|
||||
-- ============================================================================
|
||||
-- AUTHENTICATION RULES SYSTEM
|
||||
-- ============================================================================
|
||||
|
||||
-- Authentication rules table for flexible access control
|
||||
CREATE TABLE IF NOT EXISTS auth_rules (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
rule_type TEXT NOT NULL, -- 'whitelist', 'blacklist', 'hash_blacklist', 'rate_limit', etc.
|
||||
rule_target TEXT NOT NULL, -- pubkey, hash, IP, MIME type, etc.
|
||||
rule_value TEXT, -- JSON for complex rules (optional)
|
||||
operation TEXT NOT NULL DEFAULT '*', -- 'upload', 'delete', 'list', '*' (all operations)
|
||||
enabled INTEGER NOT NULL DEFAULT 1, -- 0 = disabled, 1 = enabled
|
||||
priority INTEGER NOT NULL DEFAULT 100, -- Lower numbers = higher priority (for conflict resolution)
|
||||
expires_at INTEGER, -- Optional expiration timestamp
|
||||
created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
|
||||
updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
|
||||
created_by TEXT, -- Admin pubkey who created this rule (optional)
|
||||
description TEXT, -- Human-readable rule description
|
||||
CHECK (enabled IN (0, 1)), -- Boolean constraint
|
||||
CHECK (priority >= 0), -- Priority must be non-negative
|
||||
CHECK (expires_at IS NULL OR expires_at > created_at) -- Expiration must be in future
|
||||
);
|
||||
|
||||
-- Rule evaluation cache for performance optimization
|
||||
CREATE TABLE IF NOT EXISTS auth_cache (
|
||||
cache_key TEXT PRIMARY KEY, -- SHA-256 hash of request parameters
|
||||
allowed INTEGER NOT NULL, -- 0 = denied, 1 = allowed
|
||||
rule_id INTEGER, -- Which rule made the decision (optional)
|
||||
rule_reason TEXT, -- Human-readable reason for decision
|
||||
expires_at INTEGER NOT NULL, -- Cache entry expiration
|
||||
created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
|
||||
CHECK (allowed IN (0, 1)), -- Boolean constraint
|
||||
FOREIGN KEY (rule_id) REFERENCES auth_rules(id) ON DELETE SET NULL
|
||||
);
|
||||
|
||||
-- Indexes for authentication system performance
|
||||
CREATE INDEX IF NOT EXISTS idx_auth_rules_type_target ON auth_rules(rule_type, rule_target);
|
||||
CREATE INDEX IF NOT EXISTS idx_auth_rules_operation ON auth_rules(operation);
|
||||
CREATE INDEX IF NOT EXISTS idx_auth_rules_enabled ON auth_rules(enabled);
|
||||
CREATE INDEX IF NOT EXISTS idx_auth_rules_priority ON auth_rules(priority);
|
||||
CREATE INDEX IF NOT EXISTS idx_auth_rules_expires ON auth_rules(expires_at);
|
||||
CREATE INDEX IF NOT EXISTS idx_auth_cache_expires ON auth_cache(expires_at);
|
||||
|
||||
-- ============================================================================
|
||||
-- ADMINISTRATIVE SYSTEM
|
||||
-- ============================================================================
|
||||
|
||||
-- Administrators table for nostr-based server administration
|
||||
CREATE TABLE IF NOT EXISTS administrators (
|
||||
pubkey TEXT PRIMARY KEY NOT NULL, -- Nostr public key (64 hex chars)
|
||||
permissions TEXT NOT NULL DEFAULT '[]', -- JSON array of permissions
|
||||
added_by TEXT, -- Pubkey of admin who added this admin
|
||||
added_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
|
||||
expires_at INTEGER, -- Optional expiration timestamp
|
||||
enabled INTEGER NOT NULL DEFAULT 1, -- 0 = disabled, 1 = enabled
|
||||
description TEXT, -- Human-readable description
|
||||
last_seen INTEGER, -- Last administrative action timestamp
|
||||
CHECK (length(pubkey) = 64), -- Ensure valid pubkey length
|
||||
CHECK (enabled IN (0, 1)), -- Boolean constraint
|
||||
CHECK (expires_at IS NULL OR expires_at > added_at), -- Expiration must be in future
|
||||
FOREIGN KEY (added_by) REFERENCES administrators(pubkey) ON DELETE SET NULL
|
||||
);
|
||||
|
||||
-- Administrative actions audit log
|
||||
CREATE TABLE IF NOT EXISTS admin_log (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
admin_pubkey TEXT NOT NULL, -- Which admin performed the action
|
||||
command TEXT NOT NULL, -- Administrative command executed
|
||||
parameters TEXT, -- JSON command parameters
|
||||
result TEXT, -- Success/failure result and details
|
||||
timestamp INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
|
||||
event_id TEXT, -- Reference to nostr event (optional)
|
||||
target_table TEXT, -- Which table was affected (optional)
|
||||
target_id TEXT, -- Which record was affected (optional)
|
||||
ip_address TEXT, -- Client IP address (optional)
|
||||
user_agent TEXT, -- Client user agent (optional)
|
||||
FOREIGN KEY (admin_pubkey) REFERENCES administrators(pubkey) ON DELETE CASCADE
|
||||
);
|
||||
|
||||
-- Server identity and administrative configuration
|
||||
INSERT OR IGNORE INTO server_config (key, value, description) VALUES
|
||||
('server_pubkey', '', 'Server nostr public key (generated on first run)'),
|
||||
('server_privkey_file', 'keys/server.key', 'Path to encrypted server private key file'),
|
||||
('admin_relays', '[]', 'JSON array of relay URLs for administrative events'),
|
||||
('admin_event_processing', 'true', 'Enable nostr-based administrative event processing'),
|
||||
('require_admin_auth', 'true', 'Require admin authorization for sensitive operations'),
|
||||
('auth_rules_enabled', 'true', 'Enable flexible authentication rules system'),
|
||||
('auth_cache_ttl', '300', 'Authentication cache TTL in seconds (5 minutes)'),
|
||||
('admin_session_timeout', '3600', 'Administrative session timeout in seconds (1 hour)'),
|
||||
('max_admin_log_entries', '10000', 'Maximum administrative log entries to retain');
|
||||
|
||||
-- Indexes for administrative system performance
|
||||
CREATE INDEX IF NOT EXISTS idx_administrators_enabled ON administrators(enabled);
|
||||
CREATE INDEX IF NOT EXISTS idx_administrators_expires ON administrators(expires_at);
|
||||
CREATE INDEX IF NOT EXISTS idx_admin_log_timestamp ON admin_log(timestamp);
|
||||
CREATE INDEX IF NOT EXISTS idx_admin_log_admin_pubkey ON admin_log(admin_pubkey);
|
||||
CREATE INDEX IF NOT EXISTS idx_admin_log_command ON admin_log(command);
|
||||
|
||||
-- ============================================================================
|
||||
-- VIEWS FOR ADMINISTRATIVE QUERIES
|
||||
-- ============================================================================
|
||||
|
||||
-- View for active authentication rules
|
||||
CREATE VIEW IF NOT EXISTS active_auth_rules AS
|
||||
SELECT
|
||||
id,
|
||||
rule_type,
|
||||
rule_target,
|
||||
rule_value,
|
||||
operation,
|
||||
priority,
|
||||
expires_at,
|
||||
created_at,
|
||||
created_by,
|
||||
description,
|
||||
CASE
|
||||
WHEN expires_at IS NULL THEN 'never'
|
||||
WHEN expires_at > strftime('%s', 'now') THEN 'active'
|
||||
ELSE 'expired'
|
||||
END as status
|
||||
FROM auth_rules
|
||||
WHERE enabled = 1
|
||||
ORDER BY priority ASC, created_at ASC;
|
||||
|
||||
-- View for active administrators
|
||||
CREATE VIEW IF NOT EXISTS active_administrators AS
|
||||
SELECT
|
||||
pubkey,
|
||||
permissions,
|
||||
added_by,
|
||||
added_at,
|
||||
expires_at,
|
||||
description,
|
||||
last_seen,
|
||||
CASE
|
||||
WHEN expires_at IS NULL THEN 'never'
|
||||
WHEN expires_at > strftime('%s', 'now') THEN 'active'
|
||||
ELSE 'expired'
|
||||
END as status,
|
||||
datetime(added_at, 'unixepoch') as added_datetime,
|
||||
datetime(last_seen, 'unixepoch') as last_seen_datetime
|
||||
FROM administrators
|
||||
WHERE enabled = 1;
|
||||
|
||||
-- View for recent administrative actions (last 7 days)
|
||||
CREATE VIEW IF NOT EXISTS recent_admin_actions AS
|
||||
SELECT
|
||||
id,
|
||||
admin_pubkey,
|
||||
command,
|
||||
parameters,
|
||||
result,
|
||||
timestamp,
|
||||
event_id,
|
||||
target_table,
|
||||
target_id,
|
||||
datetime(timestamp, 'unixepoch') as action_datetime
|
||||
FROM admin_log
|
||||
WHERE timestamp > (strftime('%s', 'now') - 604800) -- 7 days
|
||||
ORDER BY timestamp DESC;
|
||||
|
||||
-- View for authentication statistics
|
||||
CREATE VIEW IF NOT EXISTS auth_stats AS
|
||||
SELECT
|
||||
(SELECT COUNT(*) FROM auth_rules WHERE enabled = 1) as active_rules,
|
||||
(SELECT COUNT(*) FROM auth_rules WHERE enabled = 1 AND expires_at > strftime('%s', 'now')) as non_expired_rules,
|
||||
(SELECT COUNT(*) FROM auth_cache WHERE expires_at > strftime('%s', 'now')) as cached_decisions,
|
||||
(SELECT COUNT(*) FROM administrators WHERE enabled = 1) as active_admins,
|
||||
(SELECT COUNT(*) FROM admin_log WHERE timestamp > (strftime('%s', 'now') - 86400)) as daily_admin_actions;
|
||||
|
||||
Reference in New Issue
Block a user