Greenfield Go multi-tenant IPFS Pinning Service wire-compatible with the
IPFS Pinning Services API spec. Paired 1:1 with Kubo over localhost RPC,
clustered via embedded NATS JetStream, Postgres source-of-truth with
RLS-enforced tenancy, Fiber + huma v2 for the HTTP surface, Authentik
OIDC for session login with kid-rotated HS256 JWT API tokens.
Feature-complete against the 22-milestone build plan, including the
ship-it v1.0 gap items:
* admin CLIs: drain/uncordon, maintenance, mint-token, rotate-key,
prune-denylist, rebalance --dry-run, cache-stats, cluster-presences
* TTL leader election via NATS KV, fence tokens, JetStream dedup
* rebalancer (plan/apply split), reconciler, requeue sweeper
* ristretto caches with NATS-backed cross-node invalidation
(placements live-nodes + token denylist)
* maintenance watchdog for stuck cluster-pause flag
* Prometheus /metrics with CIDR ACL, HTTP/pin/scheduler/cache gauges
* rate limiting: session (10/min) + anonymous global (120/min)
* integration tests: rebalance, refcount multi-org, RLS belt
* goreleaser (tar + deb/rpm/apk + Alpine Docker) targeting Gitea
Stack: Cobra/Viper, Fiber v2 + huma v2, embedded NATS JetStream,
pgx/sqlc/golang-migrate, ristretto, TypeID, prometheus/client_golang,
testcontainers-go.
175 lines
4.0 KiB
Go
175 lines
4.0 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.30.0
|
|
// source: users.sql
|
|
|
|
package sqlc
|
|
|
|
import (
|
|
"context"
|
|
|
|
"anchorage/internal/pkg/ids"
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
)
|
|
|
|
const addMembership = `-- name: AddMembership :exec
|
|
INSERT INTO memberships (org_id, user_id, role)
|
|
VALUES ($1, $2, $3)
|
|
ON CONFLICT (org_id, user_id) DO UPDATE SET role = EXCLUDED.role
|
|
`
|
|
|
|
type AddMembershipParams struct {
|
|
OrgID ids.OrgID
|
|
UserID ids.UserID
|
|
Role string
|
|
}
|
|
|
|
func (q *Queries) AddMembership(ctx context.Context, arg AddMembershipParams) error {
|
|
_, err := q.db.Exec(ctx, addMembership, arg.OrgID, arg.UserID, arg.Role)
|
|
return err
|
|
}
|
|
|
|
const getUserByEmail = `-- name: GetUserByEmail :one
|
|
SELECT id, authentik_sub, email, display_name, is_sysadmin, created_at, updated_at FROM users WHERE email = $1
|
|
`
|
|
|
|
func (q *Queries) GetUserByEmail(ctx context.Context, email string) (User, error) {
|
|
row := q.db.QueryRow(ctx, getUserByEmail, email)
|
|
var i User
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.AuthentikSub,
|
|
&i.Email,
|
|
&i.DisplayName,
|
|
&i.IsSysadmin,
|
|
&i.CreatedAt,
|
|
&i.UpdatedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const getUserByID = `-- name: GetUserByID :one
|
|
SELECT id, authentik_sub, email, display_name, is_sysadmin, created_at, updated_at FROM users WHERE id = $1
|
|
`
|
|
|
|
func (q *Queries) GetUserByID(ctx context.Context, id ids.UserID) (User, error) {
|
|
row := q.db.QueryRow(ctx, getUserByID, id)
|
|
var i User
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.AuthentikSub,
|
|
&i.Email,
|
|
&i.DisplayName,
|
|
&i.IsSysadmin,
|
|
&i.CreatedAt,
|
|
&i.UpdatedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const listMemberships = `-- name: ListMemberships :many
|
|
SELECT m.org_id, m.user_id, m.role, m.created_at, m.updated_at, o.slug, o.name
|
|
FROM memberships m JOIN orgs o ON o.id = m.org_id
|
|
WHERE m.user_id = $1
|
|
ORDER BY m.org_id
|
|
`
|
|
|
|
type ListMembershipsRow struct {
|
|
OrgID ids.OrgID
|
|
UserID ids.UserID
|
|
Role string
|
|
CreatedAt pgtype.Timestamptz
|
|
UpdatedAt pgtype.Timestamptz
|
|
Slug string
|
|
Name string
|
|
}
|
|
|
|
func (q *Queries) ListMemberships(ctx context.Context, userID ids.UserID) ([]ListMembershipsRow, error) {
|
|
rows, err := q.db.Query(ctx, listMemberships, userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var items []ListMembershipsRow
|
|
for rows.Next() {
|
|
var i ListMembershipsRow
|
|
if err := rows.Scan(
|
|
&i.OrgID,
|
|
&i.UserID,
|
|
&i.Role,
|
|
&i.CreatedAt,
|
|
&i.UpdatedAt,
|
|
&i.Slug,
|
|
&i.Name,
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
items = append(items, i)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return items, nil
|
|
}
|
|
|
|
const promoteSysadmin = `-- name: PromoteSysadmin :exec
|
|
UPDATE users SET is_sysadmin = true WHERE id = $1
|
|
`
|
|
|
|
func (q *Queries) PromoteSysadmin(ctx context.Context, id ids.UserID) error {
|
|
_, err := q.db.Exec(ctx, promoteSysadmin, id)
|
|
return err
|
|
}
|
|
|
|
const removeMembership = `-- name: RemoveMembership :exec
|
|
DELETE FROM memberships WHERE org_id = $1 AND user_id = $2
|
|
`
|
|
|
|
type RemoveMembershipParams struct {
|
|
OrgID ids.OrgID
|
|
UserID ids.UserID
|
|
}
|
|
|
|
func (q *Queries) RemoveMembership(ctx context.Context, arg RemoveMembershipParams) error {
|
|
_, err := q.db.Exec(ctx, removeMembership, arg.OrgID, arg.UserID)
|
|
return err
|
|
}
|
|
|
|
const upsertUserByAuthentikSub = `-- name: UpsertUserByAuthentikSub :one
|
|
INSERT INTO users (id, authentik_sub, email, display_name, is_sysadmin)
|
|
VALUES ($1, $2, $3, $4, $5)
|
|
ON CONFLICT (authentik_sub) DO UPDATE
|
|
SET email = EXCLUDED.email,
|
|
display_name = EXCLUDED.display_name
|
|
RETURNING id, authentik_sub, email, display_name, is_sysadmin, created_at, updated_at
|
|
`
|
|
|
|
type UpsertUserByAuthentikSubParams struct {
|
|
ID ids.UserID
|
|
AuthentikSub *string
|
|
Email string
|
|
DisplayName string
|
|
IsSysadmin bool
|
|
}
|
|
|
|
func (q *Queries) UpsertUserByAuthentikSub(ctx context.Context, arg UpsertUserByAuthentikSubParams) (User, error) {
|
|
row := q.db.QueryRow(ctx, upsertUserByAuthentikSub,
|
|
arg.ID,
|
|
arg.AuthentikSub,
|
|
arg.Email,
|
|
arg.DisplayName,
|
|
arg.IsSysadmin,
|
|
)
|
|
var i User
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.AuthentikSub,
|
|
&i.Email,
|
|
&i.DisplayName,
|
|
&i.IsSysadmin,
|
|
&i.CreatedAt,
|
|
&i.UpdatedAt,
|
|
)
|
|
return i, err
|
|
}
|