mirror of
https://github.com/coder/coder.git
synced 2025-07-03 16:13:58 +00:00
e744cde86f
https://github.com/coder/coder/pull/15608 introduced a buggy behaviour with dbcrypt enabled. When clearing an oauth refresh token, we had been setting the value to the empty string. The database encryption package considers decrypting an empty string to be an error, as an empty encrypted string value will still have a nonce associated with it and thus not actually be empty when stored at rest. Instead of 'deleting' the refresh token, 'update' it to be the empty string. This plays nicely with dbcrypt. It also adds a 'utility test' in the dbcrypt package to help encrypt a value. This was useful when manually fixing users affected by this bug on our dogfood instance.
59 lines
1.4 KiB
SQL
59 lines
1.4 KiB
SQL
-- name: GetExternalAuthLink :one
|
|
SELECT * FROM external_auth_links WHERE provider_id = $1 AND user_id = $2;
|
|
|
|
-- name: DeleteExternalAuthLink :exec
|
|
DELETE FROM external_auth_links WHERE provider_id = $1 AND user_id = $2;
|
|
|
|
-- name: GetExternalAuthLinksByUserID :many
|
|
SELECT * FROM external_auth_links WHERE user_id = $1;
|
|
|
|
-- name: InsertExternalAuthLink :one
|
|
INSERT INTO external_auth_links (
|
|
provider_id,
|
|
user_id,
|
|
created_at,
|
|
updated_at,
|
|
oauth_access_token,
|
|
oauth_access_token_key_id,
|
|
oauth_refresh_token,
|
|
oauth_refresh_token_key_id,
|
|
oauth_expiry,
|
|
oauth_extra
|
|
) VALUES (
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
$5,
|
|
$6,
|
|
$7,
|
|
$8,
|
|
$9,
|
|
$10
|
|
) RETURNING *;
|
|
|
|
-- name: UpdateExternalAuthLink :one
|
|
UPDATE external_auth_links SET
|
|
updated_at = $3,
|
|
oauth_access_token = $4,
|
|
oauth_access_token_key_id = $5,
|
|
oauth_refresh_token = $6,
|
|
oauth_refresh_token_key_id = $7,
|
|
oauth_expiry = $8,
|
|
oauth_extra = $9
|
|
WHERE provider_id = $1 AND user_id = $2 RETURNING *;
|
|
|
|
-- name: UpdateExternalAuthLinkRefreshToken :exec
|
|
UPDATE
|
|
external_auth_links
|
|
SET
|
|
oauth_refresh_token = @oauth_refresh_token,
|
|
updated_at = @updated_at
|
|
WHERE
|
|
provider_id = @provider_id
|
|
AND
|
|
user_id = @user_id
|
|
AND
|
|
-- Required for sqlc to generate a parameter for the oauth_refresh_token_key_id
|
|
@oauth_refresh_token_key_id :: text = @oauth_refresh_token_key_id :: text;
|