class

KemalIdentity::Postgres::LinkRepository

Inherits KemalIdentity::Federation::LinkRepository < Reference < Object

Federation::LinkRepository over auth_external_identities.

The unique index on (issuer, subject) is doing the security work here: without it one provider account can be attached to two local ones, and whichever row is found first decides who somebody logs in as. A duplicate is surfaced as an InfrastructureError rather than absorbed.

Constants

COLUMNS = "id, account_id, issuer, subject, created_at, last_authenticated_at"

UNIQUE_VIOLATION = "23505"

Constructors

new(db : DB::Database)

Source

Instance methods

find(issuer : String, subject : String) : Federation::Link | Nil

The account (issuer, subject) belongs to, or nil.

The hot path of a federated login, and the only lookup that may decide who somebody is.

Source

for_account(account_id : String) : Array(Federation::Link)

Every external identity attached to an account, for a management screen. Oldest first.

Source

link(record : Federation::Link) : Nil

Source

touch(issuer : String, subject : String, at : Time) : Bool

Records that this link was just used to authenticate. Returns false for an unknown pair.

Source

unlink(issuer : String, subject : String) : Bool

Removes one link. Returns false if it was not there.

An application that offers this must make sure the account keeps some way in — removing the only link from an account with no password is how somebody is locked out permanently. That check belongs in the application, which is the only thing that knows what else the account has.

Source