@xkova/sdk 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/workforce-bff.js

@@ -0,0 +1,462 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { XKOVAClient } from './client.js';
+import { XKOVAApiError } from './errors.js';
+import { isAllowedProtocol } from './url.js';
+import { WorkforceWalletsResource } from './resources/workforce-wallets.js';
+// These helpers operate only on a customer's cookie/reference and CSRF proof.
+// Reusing their cryptography does not reuse member identity or session authority.
+export { serializeXKOVAMemberSessionCookie as serializeXKOVAWorkforceSessionCookie, serializeXKOVAMemberFlowCookie as serializeXKOVAWorkforceFlowCookie, serializeClearedXKOVAMemberCookie as serializeClearedXKOVAWorkforceCookie, readXKOVAMemberCookie as readXKOVAWorkforceCookie, readXKOVAMemberCallbackFlow as readXKOVAWorkforceCallbackFlow, xkovaMemberFlowCookieName as xkovaWorkforceFlowCookieName, createXKOVAMemberCsrfToken as createXKOVAWorkforceCsrfToken, verifyXKOVAMemberCsrfToken as verifyXKOVAWorkforceCsrfToken, assertXKOVAMemberRequestOrigin as assertXKOVAWorkforceRequestOrigin, } from './member-bff.js';
+export class XKOVAWorkforceBffError extends Error {
+    code;
+    constructor(code) {
+        super('The workforce sign-in or session cannot safely continue. Start sign-in again.');
+        this.code = code;
+        this.name = 'XKOVAWorkforceBffError';
+    }
+}
+/** Confidential workforce protocol. It neither enrolls a subject nor creates local staff authority. */
+export class XKOVAWorkforceBffClient {
+    options;
+    client;
+    fingerprint;
+    constructor(options) {
+        this.options = options;
+        if (!/^xkova_wf_[A-Za-z0-9_-]{43}$/.test(options.workforceKey)) {
+            throw new TypeError('Invalid workforce application selector');
+        }
+        this.client = XKOVAClient.forTenant(options);
+        const origin = new URL(options.baseUrl).origin;
+        this.fingerprint = digest(JSON.stringify([origin, options.apiKey, options.workforceKey]));
+    }
+    async beginAuthorization(input) {
+        const origin = new URL(input.browserOrigin);
+        const callback = exactCallback(input.redirectUri);
+        if (origin.origin !== input.browserOrigin ||
+            !isAllowedProtocol(origin) ||
+            callback.origin !== origin.origin) {
+            throw new TypeError('Workforce callback must belong to the exact application origin');
+        }
+        const state = random(), codeVerifier = random();
+        const transaction = {
+            clientFingerprint: this.fingerprint,
+            status: 'pending',
+            redirectUri: callback.href,
+            codeVerifier,
+            codeChallenge: digest(codeVerifier),
+            exchangeAttemptId: random(),
+            sessionReference: random(),
+            expiresAt: Date.now() + 300_000,
+        };
+        const key = digest(state);
+        await input.transactionStore.put(key, transaction);
+        const result = object(await this.postJson('/workforce-auth/transactions', {
+            browser_origin: origin.origin,
+            redirect_uri: callback.href,
+            code_challenge: transaction.codeChallenge,
+            code_challenge_method: 'S256',
+        }, transaction.exchangeAttemptId));
+        const expiresAt = timestamp(result, 'expires_at');
+        if (expiresAt <= Date.now() || expiresAt > transaction.expiresAt + 5_000)
+            throw new Error('Invalid workforce transaction lifetime');
+        const issuer = text(result, 'issuer');
+        secureUrl(issuer);
+        const authorizationEndpoint = secureUrl(text(result, 'authorization_endpoint')).href;
+        const audience = text(result, 'audience'), nonce = text(result, 'nonce');
+        opaque(nonce);
+        const maxAuthAgeSeconds = result.max_auth_age_seconds;
+        if (!Number.isSafeInteger(maxAuthAgeSeconds) || Number(maxAuthAgeSeconds) < 1)
+            throw new Error('Invalid workforce authentication policy');
+        const requiredAcrValues = strings(result.required_acr_values);
+        const bound = {
+            ...transaction,
+            transactionId: text(result, 'transaction_id'),
+            nonce,
+            issuer,
+            audience,
+            expiresAt,
+        };
+        await input.transactionStore.replace(key, bound);
+        return {
+            state,
+            nonce,
+            redirectUri: callback.href,
+            codeChallenge: transaction.codeChallenge,
+            codeChallengeMethod: 'S256',
+            issuer,
+            audience,
+            authorizationEndpoint,
+            maxAuthAgeSeconds: Number(maxAuthAgeSeconds),
+            requiredAcrValues,
+            expiresAt: new Date(expiresAt).toISOString(),
+        };
+    }
+    async completeAuthorizationCallback(input) {
+        const callback = secureUrl(input.callbackUrl), states = callback.searchParams.getAll('state');
+        opaque(input.expectedState);
+        if (states.length !== 1 ||
+            !equal(states[0], input.expectedState) ||
+            callback.searchParams.has('error')) {
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        }
+        const codes = callback.searchParams.getAll('code');
+        if (codes.length !== 1 || !codes[0] || codes[0].length > 8192)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        const code = codes[0], codeHash = digest(code), key = digest(input.expectedState);
+        return input.transactionStore.runExclusive(key, async () => {
+            const initial = await input.transactionStore.get(key);
+            if (!initial ||
+                initial.expiresAt <= Date.now() ||
+                initial.clientFingerprint !== this.fingerprint ||
+                callback.origin + callback.pathname !== initial.redirectUri) {
+                throw new XKOVAWorkforceBffError('transaction_unavailable');
+            }
+            if (initial.providerExchangeStarted &&
+                initial.providerExchangeStarted.codeHash !== codeHash) {
+                throw new XKOVAWorkforceBffError('binding_mismatch');
+            }
+            const reference = initial.sessionReference;
+            return input.sessionStore.runExclusive(reference, async () => {
+                let transaction = initial;
+                if (transaction.stagedProofToken && !transaction.providerExchangeStarted) {
+                    throw new XKOVAWorkforceBffError('transaction_unavailable');
+                }
+                const existing = await input.sessionStore.get(reference);
+                if (existing) {
+                    this.assertSession(existing);
+                    if (existing.authorizationCodeHash !== codeHash || existing.logoutPending) {
+                        throw new XKOVAWorkforceBffError('session_unavailable');
+                    }
+                    await input.transactionStore.replace(key, { ...transaction, status: 'completed' });
+                    return { reference, session: existing };
+                }
+                if (transaction.status === 'completed' ||
+                    !transaction.transactionId ||
+                    !transaction.nonce ||
+                    !transaction.issuer ||
+                    !transaction.audience)
+                    throw new XKOVAWorkforceBffError('session_unavailable');
+                if (!transaction.stagedProofToken) {
+                    if (transaction.providerExchangeStarted)
+                        throw new XKOVAWorkforceBffError('provider_exchange_outcome_unknown');
+                    // Freeze application data before consuming a code. A later retry cannot replace it.
+                    transaction = {
+                        ...transaction,
+                        providerExchangeStarted: {
+                            codeHash,
+                            applicationData: JSON.parse(JSON.stringify({ value: input.applicationData })).value,
+                        },
+                    };
+                    await input.transactionStore.replace(key, transaction);
+                    const proof = await input.exchangeProviderCode({
+                        code,
+                        codeVerifier: transaction.codeVerifier,
+                        redirectUri: transaction.redirectUri,
+                        expectedNonce: transaction.nonce,
+                        issuer: transaction.issuer,
+                        audience: transaction.audience,
+                    });
+                    if (typeof proof.proofToken !== 'string' ||
+                        !proof.proofToken ||
+                        proof.proofToken.length > 65536) {
+                        throw new Error('Invalid workforce provider proof result');
+                    }
+                    transaction = { ...transaction, stagedProofToken: proof.proofToken };
+                    await input.transactionStore.replace(key, transaction);
+                }
+                const material = parseMaterial(await this.postJson('/workforce-auth/exchange', {
+                    transaction_id: transaction.transactionId,
+                    nonce: transaction.nonce,
+                    proof_token: transaction.stagedProofToken,
+                    exchange_attempt_id: transaction.exchangeAttemptId,
+                }, transaction.exchangeAttemptId));
+                const stored = {
+                    clientFingerprint: this.fingerprint,
+                    authorizationCodeHash: codeHash,
+                    material,
+                    applicationExpiresAt: timestamp(material.session, 'absolute_expires_at'),
+                    applicationData: transaction.providerExchangeStarted.applicationData,
+                };
+                await input.sessionStore.put(reference, stored);
+                await input.transactionStore.replace(key, { ...transaction, status: 'completed' });
+                return { reference, session: stored };
+            });
+        });
+    }
+    async getSession(sessionToken) {
+        credential(sessionToken, 'xwfs');
+        return parseSession(await this.getJson('/workforce-auth/session', sessionToken));
+    }
+    async resolveSession(input) {
+        opaque(input.reference);
+        return input.sessionStore.runExclusive(input.reference, async () => {
+            let stored = await input.sessionStore.get(input.reference);
+            if (!stored || stored.logoutPending)
+                return null;
+            this.assertSession(stored);
+            if (stored.applicationExpiresAt <= Date.now())
+                return null;
+            try {
+                if (timestamp(stored.material.session, 'expires_at') <= Date.now() + 30_000) {
+                    const material = parseMaterial(await this.postJson('/workforce-auth/refresh', {
+                        refresh_token: stored.material.refresh_token,
+                        refresh_attempt_token: stored.material.refresh_attempt_token,
+                    }));
+                    assertSameHuman(stored.material.session, material.session);
+                    stored = { ...stored, material };
+                    await input.sessionStore.replace(input.reference, stored);
+                }
+                const session = await this.getSession(stored.material.session_token);
+                assertSameHuman(stored.material.session, session);
+                stored = { ...stored, material: { ...stored.material, session } };
+                await input.sessionStore.replace(input.reference, stored);
+                return stored;
+            }
+            catch (error) {
+                if (error instanceof XKOVAApiError && (error.status === 401 || error.status === 403)) {
+                    await input.sessionStore.replace(input.reference, { ...stored, logoutPending: true });
+                    return null;
+                }
+                throw error;
+            }
+        });
+    }
+    /** Request-scoped resources only. Check the browser's Origin/CSRF before invoking writes. */
+    async resolveResources(input) {
+        const session = await this.resolveSession(input);
+        if (!session)
+            return null;
+        if (input.actionGrant) {
+            opaque(input.actionGrant.grant_token);
+            if (timestamp(input.actionGrant, 'expires_at') <= Date.now())
+                throw new XKOVAWorkforceBffError('session_unavailable');
+        }
+        const bound = XKOVAClient.forWorkforceSession(this.options, {
+            workforceKey: this.options.workforceKey,
+            sessionToken: session.material.session_token,
+            browserOrigin: input.browserOrigin,
+            ...(input.actionGrant && { humanAuthorization: input.actionGrant.grant_token }),
+        });
+        return {
+            session,
+            resources: {
+                treasury: bound.treasury,
+                tokenization: bound.tokenization,
+                wallets: new WorkforceWalletsResource(bound),
+            },
+        };
+    }
+    /** Review the locator returned by human_authorization_required. Never send it to a third-party host. */
+    async inspectAction(input) {
+        opaque(input.authorizationToken);
+        const raw = object(await this.getJson(`/workforce-auth/actions/${encodeURIComponent(input.authorizationToken)}`, input.sessionToken, input.browserOrigin));
+        text(raw, 'operation');
+        text(raw, 'proof_method');
+        object(raw.review);
+        validateReview(raw);
+        return raw;
+    }
+    /** Starts a real provider ceremony after the user reviews the exact request. No action is executed. */
+    async beginActionProof(input) {
+        opaque(input.authorizationToken);
+        const raw = object(await this.postJson(`/workforce-auth/actions/${encodeURIComponent(input.authorizationToken)}/begin`, undefined, undefined, input));
+        if (text(raw, 'nonce') !== input.authorizationToken)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        secureUrl(text(raw, 'issuer'));
+        secureUrl(text(raw, 'authorization_endpoint'));
+        text(raw, 'audience');
+        const maxAge = raw.max_auth_age_seconds;
+        if (!Number.isSafeInteger(maxAge) || Number(maxAge) < 1 || Number(maxAge) > 300)
+            throw new Error('Invalid workforce action policy');
+        strings(raw.required_acr_values);
+        strings(raw.required_amr_values);
+        object(raw.review);
+        validateReview(raw);
+        return raw;
+    }
+    /** Submit the real, freshly verified provider token. A lost response is never automatically retried. */
+    async completeActionProof(input) {
+        opaque(input.authorizationToken);
+        if (input.nonce !== input.authorizationToken)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        if (!input.proofToken || input.proofToken.length > 16384)
+            throw new TypeError('Invalid workforce action proof');
+        const raw = object(await this.postJson(`/workforce-auth/actions/${encodeURIComponent(input.authorizationToken)}/complete`, { nonce: input.nonce, proof_token: input.proofToken }, undefined, input));
+        opaque(text(raw, 'grant_token'));
+        if (timestamp(raw, 'expires_at') <= Date.now())
+            throw new XKOVAWorkforceBffError('session_unavailable');
+        return raw;
+    }
+    async logoutSession(input) {
+        opaque(input.reference);
+        await input.sessionStore.runExclusive(input.reference, async () => {
+            const stored = await input.sessionStore.get(input.reference);
+            if (!stored)
+                return;
+            this.assertSession(stored);
+            if (!stored.logoutPending)
+                await input.sessionStore.replace(input.reference, { ...stored, logoutPending: true });
+            await this.postJson('/workforce-auth/sign-out', {
+                session_token: stored.material.session_token,
+            });
+            await input.sessionStore.delete(input.reference);
+        });
+    }
+    assertSession(session) {
+        if (session.clientFingerprint !== this.fingerprint)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+    }
+    postJson(path, body, idempotencyKey, context) {
+        const client = context
+            ? XKOVAClient.forWorkforceSession(this.options, {
+                ...context,
+                workforceKey: this.options.workforceKey,
+            })
+            : this.client;
+        return client.requestJson({
+            method: 'POST',
+            path,
+            ...(body !== undefined && { body }),
+            headers: { 'X-XKOVA-Workforce-Key': this.options.workforceKey },
+            ...(idempotencyKey !== undefined && { idempotencyKey }),
+        });
+    }
+    getJson(path, sessionToken, browserOrigin) {
+        const client = browserOrigin
+            ? XKOVAClient.forWorkforceSession(this.options, {
+                sessionToken,
+                browserOrigin,
+                workforceKey: this.options.workforceKey,
+            })
+            : this.client;
+        return client.requestJson({
+            method: 'GET',
+            path,
+            headers: {
+                'X-XKOVA-Workforce-Key': this.options.workforceKey,
+                'X-Workforce-Session': sessionToken,
+            },
+        });
+    }
+}
+/** Advisory browser UI data only; provider identity, credentials and grants stay confidential. */
+export function projectXKOVAWorkforceSession(value) {
+    return {
+        signedIn: true,
+        staffId: value.material.session.staff_id,
+        roles: [...value.material.session.roles],
+        expiresAt: value.material.session.expires_at,
+    };
+}
+function parseMaterial(value) {
+    const raw = object(value);
+    const sessionToken = text(raw, 'session_token'), refreshToken = text(raw, 'refresh_token'), attempt = text(raw, 'refresh_attempt_token');
+    credential(sessionToken, 'xwfs');
+    credential(refreshToken, 'xwfr');
+    credential(attempt, 'xwfa');
+    return {
+        session_token: sessionToken,
+        refresh_token: refreshToken,
+        refresh_attempt_token: attempt,
+        session: parseSession(raw.session),
+    };
+}
+function parseSession(value) {
+    const raw = object(value), grants = object(raw.resource_grants);
+    for (const name of ['session_id', 'application_id', 'person_id', 'tenant_id', 'workspace_id']) {
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(text(raw, name))) {
+            throw new Error('Invalid workforce session identity');
+        }
+    }
+    if (!/^stf_[0-9A-Za-z]{22}$/.test(text(raw, 'staff_id')))
+        throw new Error('Invalid workforce staff identity');
+    const expires = timestamp(raw, 'expires_at'), absolute = timestamp(raw, 'absolute_expires_at');
+    if (expires > absolute || typeof raw.action_authorization_enabled !== 'boolean')
+        throw new Error('Invalid workforce session policy');
+    text(raw, 'provider_namespace');
+    text(raw, 'provider_subject');
+    strings(raw.roles);
+    strings(raw.scopes);
+    strings(grants.treasury_wallet_ids);
+    strings(grants.customer_token_ids);
+    if (!strings(grants.treasury_wallet_ids).every((id) => /^vlt_[0-9A-Za-z]{22}$/.test(id)) ||
+        !strings(grants.customer_token_ids).every((id) => /^ctk_[0-9A-Za-z]{22}$/.test(id))) {
+        throw new Error('Invalid workforce resource identity');
+    }
+    return raw;
+}
+function assertSameHuman(before, after) {
+    for (const name of [
+        'session_id',
+        'application_id',
+        'staff_id',
+        'person_id',
+        'tenant_id',
+        'workspace_id',
+        'provider_namespace',
+        'provider_subject',
+    ]) {
+        if (before[name] !== after[name])
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+    }
+}
+function random() {
+    return randomBytes(32).toString('base64url');
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest('base64url');
+}
+function opaque(value) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(value))
+        throw new TypeError('Invalid opaque workforce reference');
+}
+function credential(value, prefix) {
+    if (!new RegExp(`^${prefix}_[A-Za-z0-9_-]{43}$`).test(value))
+        throw new TypeError('Invalid workforce credential');
+}
+function equal(a, b) {
+    const left = Buffer.from(a), right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function secureUrl(value) {
+    const url = new URL(value);
+    if (!isAllowedProtocol(url) || url.username || url.password || url.hash)
+        throw new TypeError('Invalid workforce URL');
+    return url;
+}
+function exactCallback(value) {
+    const url = secureUrl(value);
+    if (url.search)
+        throw new TypeError('Workforce callback cannot contain a query');
+    return url;
+}
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid workforce API response');
+    return value;
+}
+function text(value, key) {
+    const field = value[key];
+    if (typeof field !== 'string' || !field || field.length > 65536)
+        throw new Error('Invalid workforce API response field');
+    return field;
+}
+function strings(value) {
+    if (!Array.isArray(value) ||
+        value.length > 1000 ||
+        !value.every((item) => typeof item === 'string' && item.length > 0 && item.length <= 512)) {
+        throw new Error('Invalid workforce API response list');
+    }
+    return value;
+}
+function timestamp(value, key) {
+    const result = Date.parse(text(value, key));
+    if (!Number.isFinite(result))
+        throw new Error('Invalid workforce API expiry');
+    return result;
+}
+function validateReview(raw) {
+    if (!/^[a-f0-9]{64}$/i.test(text(raw, 'review_digest')) ||
+        timestamp(raw, 'expires_at') <= Date.now()) {
+        throw new XKOVAWorkforceBffError('session_unavailable');
+    }
+}

package/examples/postgres-checkpoint-store.mjs

@@ -0,0 +1,116 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+
+/** Install pg separately. The application owns the pool, schema, retention and key rotation. */
+export class PostgresCheckpointStore {
+  #context = new AsyncLocalStorage();
+  #key;
+
+  constructor(pool, namespace, encryptionKey) {
+    if (!/^[a-z][a-z0-9_-]{0,63}$/.test(namespace)) throw new Error('Invalid store namespace');
+    if (!Buffer.isBuffer(encryptionKey) || encryptionKey.length !== 32)
+      throw new Error('A 32-byte application encryption key is required');
+    this.pool = pool;
+    this.namespace = namespace;
+    this.#key = Buffer.from(encryptionKey);
+  }
+
+  #binding(reference) {
+    return JSON.stringify([this.namespace, reference]);
+  }
+
+  #encrypt(reference, record) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', this.#key, iv);
+    cipher.setAAD(Buffer.from(this.#binding(reference)));
+    const bytes = Buffer.concat([cipher.update(JSON.stringify(record), 'utf8'), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), bytes]);
+  }
+
+  #decrypt(reference, bytes) {
+    if (!Buffer.isBuffer(bytes) || bytes.length < 29) throw new Error('Invalid stored envelope');
+    const decipher = createDecipheriv('aes-256-gcm', this.#key, bytes.subarray(0, 12));
+    decipher.setAAD(Buffer.from(this.#binding(reference)));
+    decipher.setAuthTag(bytes.subarray(12, 28));
+    return JSON.parse(
+      Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString('utf8'),
+    );
+  }
+
+  #db() {
+    return this.#context.getStore()?.client ?? this.pool;
+  }
+
+  async put(reference, record) {
+    await this.#db().query(
+      'INSERT INTO xkova_helper_checkpoints(namespace, reference, envelope, expires_at) VALUES ($1,$2,$3,$4)',
+      [this.namespace, reference, this.#encrypt(reference, record), this.#expiry(record)],
+    );
+  }
+
+  async get(reference) {
+    const result = await this.#db().query(
+      'SELECT envelope FROM xkova_helper_checkpoints WHERE namespace=$1 AND reference=$2 AND expires_at > now()',
+      [this.namespace, reference],
+    );
+    return result.rowCount ? this.#decrypt(reference, result.rows[0].envelope) : null;
+  }
+
+  async replace(reference, record) {
+    const result = await this.#db().query(
+      'UPDATE xkova_helper_checkpoints SET envelope=$3, expires_at=$4 WHERE namespace=$1 AND reference=$2',
+      [this.namespace, reference, this.#encrypt(reference, record), this.#expiry(record)],
+    );
+    if (result.rowCount !== 1) throw new Error('Cannot replace a missing checkpoint');
+  }
+
+  async delete(reference) {
+    await this.#db().query(
+      'DELETE FROM xkova_helper_checkpoints WHERE namespace=$1 AND reference=$2',
+      [this.namespace, reference],
+    );
+  }
+
+  #expiry(record) {
+    const value = record.applicationExpiresAt ?? record.expiresAt;
+    if (!Number.isSafeInteger(value)) throw new Error('Invalid checkpoint expiry');
+    return new Date(value);
+  }
+
+  /** A session lock, with separate autocommit checkpoints, never an outer SQL transaction. */
+  async runExclusive(reference, work) {
+    const existing = this.#context.getStore();
+    if (existing) {
+      if (existing.reference !== reference) throw new Error('Nested references are unsupported');
+      return work();
+    }
+    const client = await this.pool.connect();
+    let locked = false;
+    let discard = false;
+    try {
+      await client.query("SET lock_timeout = '5s'");
+      await client.query("SET statement_timeout = '10s'");
+      await client.query('SELECT pg_advisory_lock(hashtextextended($1, 0))', [
+        this.#binding(reference),
+      ]);
+      locked = true;
+      return await this.#context.run({ client, reference }, work);
+    } finally {
+      try {
+        if (locked) {
+          const result = await client.query(
+            'SELECT pg_advisory_unlock(hashtextextended($1, 0)) AS released',
+            [this.#binding(reference)],
+          );
+          if (result.rows[0]?.released !== true) throw new Error('Checkpoint lock was lost');
+        }
+        await client.query('RESET lock_timeout');
+        await client.query('RESET statement_timeout');
+      } catch {
+        // A connection with an uncertain lock must never return to the pool.
+        discard = true;
+      }
+      client.release(discard);
+    }
+  }
+}

package/examples/postgres-checkpoints.sql

@@ -0,0 +1,9 @@
+-- Apply through your application's normal migration process, to its own database.
+CREATE TABLE xkova_helper_checkpoints (
+  namespace text NOT NULL,
+  reference text NOT NULL,
+  envelope bytea NOT NULL,
+  expires_at timestamptz NOT NULL,
+  PRIMARY KEY (namespace, reference)
+);
+CREATE INDEX xkova_helper_checkpoints_expiry ON xkova_helper_checkpoints (expires_at);