forked from wrenn/wrenn
pptx704
9bf67aa7f7
Replaces the hardcoded CP_HOST_AGENT_ADDR single-agent setup with a DB-driven registration system supporting multiple host agents (BYOC). Key changes: - Host agents register via one-time token, receive a 7-day JWT + 60-day refresh token; heartbeat loop auto-refreshes on 401/403 and pauses all sandboxes if refresh fails - HostClientPool: lazy Connect RPC client cache keyed by host ID, replacing the single static agent client throughout the API and service layers - RoundRobinScheduler: picks an online host for each new sandbox via ListActiveHosts; extensible for future scheduling strategies - HostMonitor (replaces Reconciler): passive heartbeat staleness check marks hosts unreachable and sandboxes missing after 90s; active reconciliation per online host restores missing-but-alive sandboxes and stops orphans - Graceful host delete: returns 409 with affected sandbox list without ?force=true; force-delete destroys sandboxes then evicts pool client - Snapshot delete broadcasts to all online hosts (templates have no host_id) - sandbox.Manager.PauseAll: pauses all running VMs on CP connectivity loss - New migration: host_refresh_tokens table with token rotation (issue-then- revoke ordering to prevent lockout on mid-rotation crash) - New sandbox status 'missing' (reversible, unlike 'stopped') and host status 'unreachable'; both reflected in OpenAPI spec - Fix: refresh token auth failure now returns 401 (was 400 via generic 'invalid' substring match in serviceErrToHTTP)
93 lines
2.5 KiB
Go
93 lines
2.5 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.30.0
|
|
// source: host_refresh_tokens.sql
|
|
|
|
package db
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
)
|
|
|
|
const deleteExpiredHostRefreshTokens = `-- name: DeleteExpiredHostRefreshTokens :exec
|
|
DELETE FROM host_refresh_tokens
|
|
WHERE expires_at < NOW() OR revoked_at IS NOT NULL
|
|
`
|
|
|
|
func (q *Queries) DeleteExpiredHostRefreshTokens(ctx context.Context) error {
|
|
_, err := q.db.Exec(ctx, deleteExpiredHostRefreshTokens)
|
|
return err
|
|
}
|
|
|
|
const getHostRefreshTokenByHash = `-- name: GetHostRefreshTokenByHash :one
|
|
SELECT id, host_id, token_hash, expires_at, created_at, revoked_at FROM host_refresh_tokens
|
|
WHERE token_hash = $1 AND revoked_at IS NULL AND expires_at > NOW()
|
|
`
|
|
|
|
func (q *Queries) GetHostRefreshTokenByHash(ctx context.Context, tokenHash string) (HostRefreshToken, error) {
|
|
row := q.db.QueryRow(ctx, getHostRefreshTokenByHash, tokenHash)
|
|
var i HostRefreshToken
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.HostID,
|
|
&i.TokenHash,
|
|
&i.ExpiresAt,
|
|
&i.CreatedAt,
|
|
&i.RevokedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const insertHostRefreshToken = `-- name: InsertHostRefreshToken :one
|
|
INSERT INTO host_refresh_tokens (id, host_id, token_hash, expires_at)
|
|
VALUES ($1, $2, $3, $4)
|
|
RETURNING id, host_id, token_hash, expires_at, created_at, revoked_at
|
|
`
|
|
|
|
type InsertHostRefreshTokenParams struct {
|
|
ID string `json:"id"`
|
|
HostID string `json:"host_id"`
|
|
TokenHash string `json:"token_hash"`
|
|
ExpiresAt pgtype.Timestamptz `json:"expires_at"`
|
|
}
|
|
|
|
func (q *Queries) InsertHostRefreshToken(ctx context.Context, arg InsertHostRefreshTokenParams) (HostRefreshToken, error) {
|
|
row := q.db.QueryRow(ctx, insertHostRefreshToken,
|
|
arg.ID,
|
|
arg.HostID,
|
|
arg.TokenHash,
|
|
arg.ExpiresAt,
|
|
)
|
|
var i HostRefreshToken
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.HostID,
|
|
&i.TokenHash,
|
|
&i.ExpiresAt,
|
|
&i.CreatedAt,
|
|
&i.RevokedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const revokeHostRefreshToken = `-- name: RevokeHostRefreshToken :exec
|
|
UPDATE host_refresh_tokens SET revoked_at = NOW() WHERE id = $1
|
|
`
|
|
|
|
func (q *Queries) RevokeHostRefreshToken(ctx context.Context, id string) error {
|
|
_, err := q.db.Exec(ctx, revokeHostRefreshToken, id)
|
|
return err
|
|
}
|
|
|
|
const revokeHostRefreshTokensByHost = `-- name: RevokeHostRefreshTokensByHost :exec
|
|
UPDATE host_refresh_tokens SET revoked_at = NOW()
|
|
WHERE host_id = $1 AND revoked_at IS NULL
|
|
`
|
|
|
|
func (q *Queries) RevokeHostRefreshTokensByHost(ctx context.Context, hostID string) error {
|
|
_, err := q.db.Exec(ctx, revokeHostRefreshTokensByHost, hostID)
|
|
return err
|
|
}
|