Control namespace: `control`

The credential registry: projects' credentials and operator credentials. The memory role holds no privilege here; the registry role reads it.

Tables at a glance

Table	What it holds
credential	What a caller presents, and the project scopes it resolves to.
schema_migration

credential

What a caller presents, and the project scopes it resolves to. Holds a digest and never a token. Lives in the registry schema because the memory service must not be able to read it: the data-plane role has no privilege here, so a memory query cannot widen its own authority.

owner postgres

Column	Type	Null	Default	Comment
`credential_id`	`uuid`	not null
`token_digest`	`bytea`	not null
`token_prefix`	`text`	not null
`name`	`text`	not null
`created_at`	`timestamp with time zone`	not null	`now()`
`revoked_at`	`timestamp with time zone`
`project`	`text`	not null		The one project this credential reaches. Not a set: the reach of a leaked token is a name rather than a list, and every audit row names its project without a second field that could disagree. No foreign key, because the project table is behind the plane boundary this schema exists on the other side of — the reference is validated when a credential is minted.
`access`	`text`	not null	`'read_write'::text`
`kind`	`text`	not null	`'project'::text`	project: reaches one project's memory routes. operator: reaches the management surface and no memory. Read from the registry at every request; the token carries no claim about it.

Constraints

credential_access_check: CHECK ((access = ANY (ARRAY['read_only'::text, 'read_write'::text])))
credential_kind_check: CHECK ((kind = ANY (ARRAY['project'::text, 'operator'::text])))
credential_name_chk: CHECK ((length(name) > 0))
credential_prefix_chk: CHECK (((length(token_prefix) >= 4) AND (length(token_prefix) <= 16)))
credential_project_chk: CHECK (((kind = 'project'::text) = (project <> ''::text)))
credential_access_not_null: NOT NULL access
credential_created_at_not_null: NOT NULL created_at
credential_credential_id_not_null: NOT NULL credential_id
credential_kind_not_null: NOT NULL kind
credential_name_not_null: NOT NULL name
credential_project_not_null: NOT NULL project
credential_token_digest_not_null: NOT NULL token_digest
credential_token_prefix_not_null: NOT NULL token_prefix
credential_pkey: PRIMARY KEY (credential_id)
credential_token_digest_key: UNIQUE (token_digest)

Indexes

credential_live_idx: CREATE INDEX credential_live_idx ON control.credential USING btree (token_digest) WHERE (revoked_at IS NULL)
credential_pkey: CREATE UNIQUE INDEX credential_pkey ON control.credential USING btree (credential_id)
credential_token_digest_key: CREATE UNIQUE INDEX credential_token_digest_key ON control.credential USING btree (token_digest)

Privileges

taisce_control: SELECT

schema_migration