29 lines
1.1 KiB
SQL
29 lines
1.1 KiB
SQL
-- Reconciler ownership claim: vault destruction runs only after an intent is
|
|
-- moved to abandoning under the credential lock. Create/rotate materialize
|
|
-- refuses non-vault_written intents, so a concurrent commit cannot land a
|
|
-- durable version that points at material the reconciler is about to destroy.
|
|
|
|
ALTER TABLE secret_write_intents
|
|
DROP CONSTRAINT secret_write_intents_status_check;
|
|
|
|
ALTER TABLE secret_write_intents
|
|
ADD CONSTRAINT secret_write_intents_status_check CHECK (
|
|
status IN (
|
|
'prepared',
|
|
'vault_written',
|
|
'durable_committed',
|
|
'abandoning',
|
|
'abandoned'
|
|
)
|
|
);
|
|
|
|
ALTER TABLE secret_write_intents
|
|
DROP CONSTRAINT secret_write_intents_written_has_version;
|
|
|
|
ALTER TABLE secret_write_intents
|
|
ADD CONSTRAINT secret_write_intents_written_has_version CHECK (
|
|
(status = 'prepared' AND vault_kv_version IS NULL)
|
|
OR (status IN ('vault_written', 'durable_committed', 'abandoning')
|
|
AND vault_kv_version IS NOT NULL)
|
|
OR status = 'abandoned'
|
|
);
|