feat: secure organization Feishu credentials

2026-07-10 23:13:11 +08:00
parent 848f913597
commit 44557da499
18 changed files with 1443 additions and 24 deletions
@@ -0,0 +1,59 @@
+-- ADR-0024: one Organization-scoped customer Feishu application connection
+-- with immutable encrypted credential versions. No Feishu plaintext column is
+-- present in either table.
+
+CREATE TABLE "OrganizationFeishuApplicationConnection" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "appIdentityFingerprint" TEXT NOT NULL,
+    "status" "OrganizationConnectionStatus" NOT NULL DEFAULT 'DRAFT',
+    "activeSecretVersionId" TEXT,
+    "activatedAt" TIMESTAMP(3),
+    "disabledAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "OrganizationFeishuApplicationConnection_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "FeishuApplicationCredentialVersion" (
+    "id" TEXT NOT NULL,
+    "connectionId" TEXT NOT NULL,
+    "version" INTEGER NOT NULL,
+    "envelopeVersion" INTEGER NOT NULL DEFAULT 1,
+    "keyId" TEXT NOT NULL,
+    "envelope" JSONB NOT NULL,
+    "createdByUserId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "retiredAt" TIMESTAMP(3),
+    CONSTRAINT "FeishuApplicationCredentialVersion_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "OrganizationFeishuApplicationConnection_organizationId_key"
+  ON "OrganizationFeishuApplicationConnection"("organizationId");
+CREATE UNIQUE INDEX "OrganizationFeishuApplicationConnection_appIdentityFingerprint_key"
+  ON "OrganizationFeishuApplicationConnection"("appIdentityFingerprint");
+CREATE UNIQUE INDEX "OrganizationFeishuApplicationConnection_activeSecretVersionId_key"
+  ON "OrganizationFeishuApplicationConnection"("activeSecretVersionId");
+CREATE INDEX "OrganizationFeishuApplicationConnection_status_idx"
+  ON "OrganizationFeishuApplicationConnection"("status");
+CREATE UNIQUE INDEX "FeishuApplicationCredentialVersion_connectionId_version_key"
+  ON "FeishuApplicationCredentialVersion"("connectionId", "version");
+CREATE INDEX "FeishuApplicationCredentialVersion_connectionId_retiredAt_idx"
+  ON "FeishuApplicationCredentialVersion"("connectionId", "retiredAt");
+CREATE INDEX "FeishuApplicationCredentialVersion_keyId_idx"
+  ON "FeishuApplicationCredentialVersion"("keyId");
+CREATE INDEX "FeishuApplicationCredentialVersion_createdByUserId_idx"
+  ON "FeishuApplicationCredentialVersion"("createdByUserId");
+
+ALTER TABLE "OrganizationFeishuApplicationConnection"
+  ADD CONSTRAINT "OrganizationFeishuApplicationConnection_organizationId_fkey"
+  FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "FeishuApplicationCredentialVersion"
+  ADD CONSTRAINT "FeishuApplicationCredentialVersion_connectionId_fkey"
+  FOREIGN KEY ("connectionId") REFERENCES "OrganizationFeishuApplicationConnection"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "FeishuApplicationCredentialVersion"
+  ADD CONSTRAINT "FeishuApplicationCredentialVersion_createdByUserId_fkey"
+  FOREIGN KEY ("createdByUserId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "OrganizationFeishuApplicationConnection"
+  ADD CONSTRAINT "OrganizationFeishuApplicationConnection_activeSecretVersionId_fkey"
+  FOREIGN KEY ("activeSecretVersionId") REFERENCES "FeishuApplicationCredentialVersion"("id") ON DELETE RESTRICT ON UPDATE CASCADE;