49 lines
1.8 KiB
TypeScript
49 lines
1.8 KiB
TypeScript
export type FreeBetaBoundaryOperation =
|
|
| "create_pairing"
|
|
| "claim_pairing"
|
|
| "cancel_pairing"
|
|
| "connect_device"
|
|
| "revoke_host";
|
|
|
|
export const FREE_BETA_ACCESS_BOUNDARY: ReadonlyArray<{
|
|
operation: FreeBetaBoundaryOperation;
|
|
requiresCurrentEntitlement: boolean;
|
|
preservesExistingHost: boolean;
|
|
}> = [
|
|
{ operation: "create_pairing", requiresCurrentEntitlement: true, preservesExistingHost: true },
|
|
{ operation: "claim_pairing", requiresCurrentEntitlement: true, preservesExistingHost: true },
|
|
{ operation: "cancel_pairing", requiresCurrentEntitlement: false, preservesExistingHost: true },
|
|
{ operation: "connect_device", requiresCurrentEntitlement: false, preservesExistingHost: true },
|
|
{ operation: "revoke_host", requiresCurrentEntitlement: false, preservesExistingHost: false },
|
|
] as const;
|
|
|
|
/**
|
|
* Existing claimed devices remain authenticated after a free policy or invite
|
|
* ends. Entitlement gates new pairing and claim operations instead of silently
|
|
* revoking an already issued device credential.
|
|
*/
|
|
export const AUTHENTICATE_ACTIVE_DEVICE_SQL = `
|
|
UPDATE device_credentials
|
|
SET last_used_at = ?1
|
|
WHERE host_id = ?2 AND token_hash = ?3 AND status = 'active'
|
|
AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?1)
|
|
AND EXISTS (
|
|
SELECT 1 FROM hosts
|
|
WHERE id = ?2 AND lifecycle = 'active' AND slot_state = 'active'
|
|
)
|
|
`;
|
|
|
|
/** Security exits intentionally have no entitlement predicate. */
|
|
export const REVOKE_ACTIVE_DEVICE_CREDENTIALS_SQL = `
|
|
UPDATE device_credentials
|
|
SET status = 'revoked', revoked_at = ?1
|
|
WHERE host_id = ?2 AND status = 'active'
|
|
`;
|
|
|
|
export const DEACTIVATE_OWNED_HOST_SQL = `
|
|
UPDATE hosts
|
|
SET lifecycle = 'deactivated', slot_state = 'released',
|
|
connection_state = 'offline', deactivated_at = ?1
|
|
WHERE id = ?2 AND account_id = ?3 AND lifecycle = 'active'
|
|
`;
|