booth 0.0.1 → 0.0.2

data/lib/generators/booth/migration/templates/create_booth_tables.erb

@@ -1,8 +1,14 @@
 class CreateBoothTables < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
+    #######################################################
+    # Up here you may modify this file to suit your needs #
+    #######################################################
+
     # In order for Postgres to generate UUIDs, you may have to enable this extension first.
-    enable_extension 'pgcrypto'
-    # To register timestamps belonging to IPs we use an hstore field.
+    # Postgres 13 supports this out-of-the-box, in that case you don't need the extension.
+    # enable_extension 'pgcrypto'
+
+    # To register multiple timestamps belonging to IPs we use an hstore field.
     enable_extension 'hstore'
 
     ####################################################################################
@@ -11,94 +17,55 @@ class CreateBoothTables < ActiveRecord::Migration[<%= ActiveRecord::Migration.cu
 
     # ------------------------------------------------------------
     # There is one credential record per user.
-    # This is where login secrets such as the password are stored.
+    # Booth owns the credentials table and you own the users table.
     # ------------------------------------------------------------
 
     create_table :booth_credentials, id: :uuid do |t|
-      t.string :scope, null: false, default: 'default'
-      t.string :username, null: false, index: { unique: true }
-      t.string :password_digest, null: false
-      t.string :otp_secret_key, null: false
-      t.column :allowed_modes, :booth_credential_mode, array: true, null: false, default: []
-      t.column :mode, :booth_credential_mode, null: false, default: :first_time
-      t.datetime :flagged_pwned_at
+      t.string :domain, null: false # useful for webauth-rp-id and subdomain-tenanting
+      t.string :scope, null: false # E.g. end-user (self-service-area) or employee (admin-area)
+      t.string :username, null: false, index: { unique: true } # global uniqueness seems safest
+      t.datetime :blocked_at
       t.timestamps
     end
-    add_index :booth_credentials, %i[username scope], unique: true
+    # These indexes are just for performance
+    add_index :booth_credentials, %i[domain scope]
+    add_index :booth_credentials, %i[domain scope username]
+
+    # ----------------------
+    # These are the Passkeys
+    # ----------------------
 
     create_table :booth_authenticators, id: :uuid do |t|
-      t.references :credential, foreign_key: { to_table: :booth_credentials }, type: :uuid, null: false, index: true, on_delete: :cascade
-      t.string :webauthn_id, unique: true, null: false # I.e. our username presented to the hardware key
+      # Known at initiation
+      t.references :credential, foreign_key: { to_table: :booth_credentials, on_delete: :cascade }, type: :uuid, null: false, index: true
+      t.string :webauthn_id, null: false, index: { unique: true } # I.e. our random-generated username as presented to the hardware key
+      t.string :challenge, null: false
+      t.string :rp_id, null: false # what we tell the hardware key which domain it binds to
+
+      # Known at registration
       t.string :device_id # I.e. what the hardware key says its technical name is
-      t.string :nickname # I.e. what the user says its hardware key is called
       t.string :public_key
-      t.string :challenge, null: false
+      t.string :attachment # "platform" (device-bound, like a laptop) or "cross-platform" (roaming, like a Yubikey)
       t.bigint :sign_count
+      t.uuid :aaguid
+      t.string :issuer
+
+      # Known after registration
+      t.string :nickname # I.e. what the user says its hardware key is called
       t.datetime :confirmed_at
-      t.boolean :supports_user_verification, null: false, default: false
       t.timestamps
     end
     add_index :booth_authenticators, %i[credential_id webauthn_id], unique: true
     add_index :booth_authenticators, %i[credential_id confirmed_at], where: 'confirmed_at IS NULL', unique: true
 
-    create_table :booth_password_resets, id: :uuid do |t|
-      t.references :credential, foreign_key: { to_table: :booth_credentials }, type: :uuid, null: false, index: true, on_delete: :cascade
-      t.string :secret_key, null: false, index: { unique: true }
-      t.inet :creator_ip, null: false
-      t.inet :consumer_ip
-      t.datetime :accessed_at
-      t.string :password_digest
-      t.datetime :password_chosen_at
-      t.datetime :password_confirmed_at
-      t.datetime :propagated_at
-      t.datetime :revoked_at
-      t.timestamps
-    end
-
-    create_table :booth_recoveries, id: :uuid do |t|
-      t.string :scope, null: false, index: true
-      t.string :email, null: false, index: true
-      t.inet :creator_ip, null: false
-      t.datetime :consumed_at
-      t.datetime :revoked_at
-      t.timestamps
-    end
-
-    # ------------------------------------------------------------
-    # To give a new user the opportunity to choose a login method,
-    # they go through an onboarding process.
-    # ------------------------------------------------------------
-
-    create_table :booth_onboardings, id: :uuid do |t|
-      t.references :credential, foreign_key: { to_table: :booth_credentials }, type: :uuid, null: false, index: { unique: true }, on_delete: :cascade
-      t.string :secret_key, null: false, index: { unique: true }
-      t.datetime :accessed_at
-      t.column :mode, :booth_credential_mode, null: false, default: :first_time
-      t.string :password_digest
-      t.datetime :password_chosen_at
-      t.datetime :password_confirmed_at
-      t.string :otp_secret_key
-      t.datetime :otp_registered_at
-      t.datetime :otp_confirmed_at
-      t.string :webauthn_id
-      t.string :authenticator_id
-      t.string :authenticator_nickname
-      t.string :authenticator_challenge
-      t.string :authenticator_public_key
-      t.bigint :authenticator_sign_count
-      t.datetime :authenticator_confirmed_at
-      t.datetime :propagated_at
-      t.timestamps
-    end
-
     # ------------------------------------------------------------
     # Once logged in with a credential, a server-side session will
     # be generated and its use continuously verified.
     # ------------------------------------------------------------
 
     create_table :booth_sessions, id: :uuid do |t|
-      t.references :credential, foreign_key: { to_table: :booth_credentials }, type: :uuid, null: false, index: true, on_delete: :cascade
-      t.references :incognito_credential, foreign_key: { to_table: :booth_credentials }, type: :uuid, index: { unique: true }, on_delete: :cascade
+      t.references :credential, foreign_key: { to_table: :booth_credentials, on_delete: :cascade }, type: :uuid, null: false, index: true
+      t.references :incognito_credential, foreign_key: { to_table: :booth_credentials, on_delete: :cascade }, type: :uuid, index: { unique: true }
       t.datetime :activity_at, null: false, index: true
       t.datetime :revoked_at
       t.string :revoke_reason
@@ -110,23 +77,45 @@ class CreateBoothTables < ActiveRecord::Migration[<%= ActiveRecord::Migration.cu
       t.timestamps
     end
 
-    create_table :booth_contests, id: :uuid do |t|
-      t.references :credential, foreign_key: { to_table: :booth_credentials }, type: :uuid, null: false, index: { unique: true }, on_delete: :cascade
+    # ---------------------------------------------
+    # Provides a link that will directly log you in
+    # ---------------------------------------------
+
+    create_table :booth_onboardings, id: :uuid do |t|
+      t.references :credential, foreign_key: { to_table: :booth_credentials, on_delete: :cascade }, type: :uuid, null: false, index: { unique: true }
+      t.string :secret_key, null: false, index: { unique: true }
+      t.datetime :accessed_at
+      t.datetime :consumed_at
+      t.timestamps
+    end
+
+    # -----------------------------------------------------
+    # Provides a code on a device where you're logged in to
+    # remotely log in another device
+    # -----------------------------------------------------
+
+    create_table :booth_remotes, id: :uuid do |t|
+      t.references :credential, foreign_key: { to_table: :booth_credentials, on_delete: :cascade }, type: :uuid, null: false, index: { unique: true }
       t.string :code, null: false, index: true
-      t.string :reason, null: false, index: true
       t.inet :ip, null: false
       t.string :agent
       t.string :location
       t.datetime :responded_at
+      t.datetime :acknowledged_at
       t.timestamps
     end
 
+    # ----------------
+    # Logs every event
+    # ----------------
+
     create_table :booth_audits, id: :uuid do |t|
-      t.references :credential, foreign_key: { to_table: :booth_credentials }, type: :uuid, index: true, on_delete: :cascade
+      t.references :credential, foreign_key: { to_table: :booth_credentials, on_delete: :cascade }, type: :uuid, index: true
       t.inet :ip, null: false
       t.string :agent
       t.string :location
       t.string :event, null: false, index: true
+      t.hstore :payload, null: false, default: {} # Arbitrary metadata for this event.
       t.datetime :deleted_at
       t.timestamps
     end