14 lines
720 B
SQL
14 lines
720 B
SQL
-- Encrypted application secrets. Ciphertext is protected by the local master
|
|
-- key stored outside SQLite. Plaintext credentials must never be persisted here.
|
|
CREATE TABLE IF NOT EXISTS secret_store (
|
|
secret_id TEXT PRIMARY KEY CHECK (length(secret_id) BETWEEN 1 AND 256),
|
|
provider TEXT NOT NULL CHECK (length(provider) BETWEEN 1 AND 64),
|
|
encryption_version INTEGER NOT NULL CHECK (encryption_version > 0),
|
|
nonce BLOB NOT NULL CHECK (length(nonce) = 12),
|
|
ciphertext BLOB NOT NULL,
|
|
metadata TEXT NOT NULL DEFAULT '{}' CHECK (length(metadata) <= 4096),
|
|
created_at INTEGER NOT NULL,
|
|
updated_at INTEGER NOT NULL
|
|
);
|
|
CREATE INDEX IF NOT EXISTS secret_store_provider ON secret_store(provider);
|