5e50b166ef
- Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths
89 lines
3.0 KiB
Go
89 lines
3.0 KiB
Go
package lagoon
|
|
|
|
import (
|
|
"github.com/go-gormigrate/gormigrate/v2"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// BackendJWTBlacklistTable is the framework-owned jti table for admin tokens.
|
|
// It is distinct from the frontend jwt_blacklist table.
|
|
const BackendJWTBlacklistTable = "backend_jwt_blacklist"
|
|
|
|
// BackendAdminMigrations creates Winter-shaped backend identity tables and
|
|
// seeds the developer and publisher system roles. History is isolated under
|
|
// the summercms.cabana plugin id. DDL is re-runnable so the system-role seed
|
|
// stays idempotent if the history row is removed.
|
|
var BackendAdminMigrations = []*gormigrate.Migration{
|
|
{
|
|
ID: "202609240001_backend_admin_identity",
|
|
Migrate: func(tx *gorm.DB) error {
|
|
stmts := []string{
|
|
`CREATE TABLE IF NOT EXISTS backend_user_roles (
|
|
id SERIAL PRIMARY KEY,
|
|
name TEXT NOT NULL UNIQUE,
|
|
code TEXT,
|
|
description TEXT,
|
|
permissions TEXT,
|
|
is_system BOOLEAN NOT NULL DEFAULT FALSE,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
)`,
|
|
`CREATE TABLE IF NOT EXISTS backend_users (
|
|
id SERIAL PRIMARY KEY,
|
|
first_name TEXT,
|
|
last_name TEXT,
|
|
login TEXT NOT NULL UNIQUE,
|
|
email TEXT NOT NULL UNIQUE,
|
|
password TEXT NOT NULL,
|
|
activation_code TEXT,
|
|
persist_code TEXT,
|
|
reset_password_code TEXT,
|
|
permissions TEXT,
|
|
is_activated BOOLEAN NOT NULL DEFAULT FALSE,
|
|
is_superuser BOOLEAN NOT NULL DEFAULT FALSE,
|
|
role_id INTEGER REFERENCES backend_user_roles(id),
|
|
activated_at TIMESTAMPTZ,
|
|
last_login TIMESTAMPTZ,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
deleted_at TIMESTAMPTZ,
|
|
tokens_valid_after TIMESTAMPTZ
|
|
)`,
|
|
`CREATE TABLE IF NOT EXISTS backend_jwt_blacklist (
|
|
jti TEXT PRIMARY KEY,
|
|
expires_at TIMESTAMPTZ NOT NULL,
|
|
valid_until TIMESTAMPTZ NOT NULL
|
|
)`,
|
|
`CREATE INDEX IF NOT EXISTS backend_users_role_id_index ON backend_users (role_id)`,
|
|
`CREATE INDEX IF NOT EXISTS backend_users_deleted_at_index ON backend_users (deleted_at)`,
|
|
`CREATE INDEX IF NOT EXISTS backend_users_activation_code_index ON backend_users (activation_code)`,
|
|
`CREATE INDEX IF NOT EXISTS backend_users_reset_password_code_index ON backend_users (reset_password_code)`,
|
|
`CREATE INDEX IF NOT EXISTS backend_user_roles_code_index ON backend_user_roles (code)`,
|
|
`INSERT INTO backend_user_roles (name, code, description, permissions, is_system)
|
|
VALUES
|
|
('Developer', 'developer', 'Site administrator with access to developer tools.', '{}', TRUE),
|
|
('Publisher', 'publisher', 'Site editor with access to publishing tools.', '{}', TRUE)
|
|
ON CONFLICT (name) DO NOTHING`,
|
|
}
|
|
for _, stmt := range stmts {
|
|
if err := tx.Exec(stmt).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
},
|
|
Rollback: func(tx *gorm.DB) error {
|
|
for _, stmt := range []string{
|
|
`DROP TABLE IF EXISTS backend_jwt_blacklist`,
|
|
`DROP TABLE IF EXISTS backend_users`,
|
|
`DROP TABLE IF EXISTS backend_user_roles`,
|
|
} {
|
|
if err := tx.Exec(stmt).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
},
|
|
},
|
|
}
|