6 lines
634 B
SQL
6 lines
634 B
SQL
-- 同一凭据最多保留一代旧秘密；截止时间由轮换事务固定，不依赖节点内存。
|
||
ALTER TABLE orbit_credentials
|
||
ADD COLUMN previous_secret_digest BINARY(32) NULL COMMENT '上一代秘密的 SHA-256 摘要；为空表示无过渡令牌，不保存原文',
|
||
ADD COLUMN previous_valid_until DATETIME(6) NULL COMMENT '上一代令牌过渡截止，UTC；不晚于其原到期时间，与旧摘要同时为空或非空',
|
||
ADD CONSTRAINT ck_credential_overlap CHECK ((previous_secret_digest IS NULL AND previous_valid_until IS NULL) OR (previous_secret_digest IS NOT NULL AND previous_valid_until IS NOT NULL));
|