43ce3a7c53
Align console references and OAuth branding with the compliance-page model, and fix certificate cache eviction, portal OAuth handlers, and magic-link edge cases left after the trust-center rename. Signed-off-by: Bryan Frimin <bryan@probo.com>
98 lines
3.3 KiB
SQL
98 lines
3.3 KiB
SQL
-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
--
|
|
-- Permission to use, copy, modify, and/or distribute this software for any
|
|
-- purpose with or without fee is hereby granted, provided that the above
|
|
-- copyright notice and this permission notice appear in all copies.
|
|
--
|
|
-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
-- PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
-- Backfill managed default domains for compliance pages created before
|
|
-- default-domain provisioning existed. Hostnames use the managed base domain
|
|
-- suffix configured on the database (probo.trust_center_base_domain). Self-
|
|
-- managed installs without that setting are left alone — they do not get a
|
|
-- SaaS default domain invented for them.
|
|
|
|
WITH pending_pages AS (
|
|
SELECT
|
|
tc.id AS trust_center_id,
|
|
tc.tenant_id,
|
|
tc.organization_id,
|
|
tc.slug,
|
|
tc.created_at,
|
|
(tc.slug || '.' || current_setting('probo.trust_center_base_domain', true))::citext AS hostname
|
|
FROM trust_centers tc
|
|
WHERE tc.default_domain_id IS NULL
|
|
AND NULLIF(current_setting('probo.trust_center_base_domain', true), '') IS NOT NULL
|
|
-- Skip hostnames that already exist: minting a certificate or custom
|
|
-- domain for them would violate their unique constraints and abort
|
|
-- the whole migration.
|
|
AND NOT EXISTS (
|
|
SELECT 1
|
|
FROM certificates c
|
|
WHERE c.hostname = (tc.slug || '.' || current_setting('probo.trust_center_base_domain', true))::citext
|
|
)
|
|
AND NOT EXISTS (
|
|
SELECT 1
|
|
FROM custom_domains cd
|
|
WHERE cd.domain = (tc.slug || '.' || current_setting('probo.trust_center_base_domain', true))::citext
|
|
)
|
|
),
|
|
minted_certificates AS (
|
|
INSERT INTO certificates (
|
|
id,
|
|
tenant_id,
|
|
hostname,
|
|
status,
|
|
ssl_retry_count,
|
|
created_at,
|
|
updated_at
|
|
)
|
|
SELECT
|
|
generate_gid(decode_base64_unpadded(pp.tenant_id), 104),
|
|
pp.tenant_id,
|
|
pp.hostname,
|
|
'PENDING'::custom_domain_ssl_status,
|
|
0,
|
|
pp.created_at,
|
|
clock_timestamp()
|
|
FROM pending_pages pp
|
|
RETURNING id, hostname, tenant_id
|
|
),
|
|
minted_domains AS (
|
|
INSERT INTO custom_domains (
|
|
id,
|
|
tenant_id,
|
|
organization_id,
|
|
domain,
|
|
managed,
|
|
certificate_id,
|
|
created_at,
|
|
updated_at
|
|
)
|
|
SELECT
|
|
generate_gid(decode_base64_unpadded(mc.tenant_id), 37),
|
|
mc.tenant_id,
|
|
pp.organization_id,
|
|
pp.hostname,
|
|
true,
|
|
mc.id,
|
|
pp.created_at,
|
|
clock_timestamp()
|
|
FROM minted_certificates mc
|
|
JOIN pending_pages pp ON pp.hostname = mc.hostname
|
|
RETURNING id, domain
|
|
)
|
|
UPDATE trust_centers tc
|
|
SET
|
|
default_domain_id = md.id,
|
|
updated_at = clock_timestamp()
|
|
FROM minted_domains md
|
|
JOIN pending_pages pp ON pp.hostname = md.domain
|
|
WHERE tc.id = pp.trust_center_id;
|