Efremenko Arhip
3a1461315f
Let a signed-in user turn their own machine into a worker without the shared token. The coordinator already binds a JWT-authenticated registration to owner_id as untrusted; this adds the missing pieces. userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest) with create/list/revoke and a public /worker-tokens/exchange that trades a key for a short-lived JWT carrying the owner current role/verified. python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token provider exchanges the key and refreshes the JWT proactively and on 401, so a long-running worker survives token expiry. Static bearer token path is unchanged. coordinator UI: an "add your machine" page that mints a key and shows a ready-to-run command, proxying key management to the userservice; the dashboard gains an owner-scoped "my machines" section. docs: how to run a worker from your account, plus the untrusted/quorum/ verified trust model.
32 lines
1.4 KiB
PL/PgSQL
32 lines
1.4 KiB
PL/PgSQL
BEGIN;
|
|
|
|
-- A worker key is a long-lived credential a user creates to run a worker on
|
|
-- their own machine. Unlike the 24h login JWT, it does not expire on its own:
|
|
-- the worker presents it to /worker-tokens/exchange to mint a short-lived JWT
|
|
-- and refreshes as needed. Only a SHA-256 hash is stored, never the key itself,
|
|
-- so a database leak cannot be replayed as a credential.
|
|
CREATE TABLE worker_keys (
|
|
id uuid PRIMARY KEY,
|
|
user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
-- Human label so a user can tell their machines apart when revoking.
|
|
name text NOT NULL,
|
|
-- Hex SHA-256 of the presented key. The key is high-entropy, so a fast hash
|
|
-- is enough — no per-key salt or bcrypt cost is needed here.
|
|
token_hash text NOT NULL,
|
|
-- The leading, non-secret slice of the key, shown in the UI to identify a
|
|
-- row without ever revealing the secret again.
|
|
prefix text NOT NULL,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
-- Last successful exchange; NULL until first use.
|
|
last_used_at timestamptz,
|
|
-- Set when the user revokes the key; a revoked key never exchanges again.
|
|
revoked_at timestamptz,
|
|
|
|
CONSTRAINT uq_worker_keys_token_hash UNIQUE (token_hash)
|
|
);
|
|
|
|
-- Listing and revoking are always scoped to one owner's live keys.
|
|
CREATE INDEX ix_worker_keys_user_active ON worker_keys (user_id) WHERE revoked_at IS NULL;
|
|
|
|
COMMIT;
|