33 lines
1.7 KiB
SQL
33 lines
1.7 KiB
SQL
|
-- Customer PIN (docs/prd-point-coin.md F11, K8). A 6-digit PIN, separate from the
|
||
|
|
-- login password, approves everything that moves EnakPoint or EnakCoin on the
|
||
|
|
-- customer's request. Only its bcrypt hash is stored.
|
||
|
|
ALTER TABLE customers
|
||
|
|
ADD COLUMN pin_hash VARCHAR(255),
|
||
|
|
ADD COLUMN pin_set_at TIMESTAMP WITH TIME ZONE,
|
||
|
|
-- Kept in the database, not a cache, so it cannot be dodged by waiting for a cache
|
||
|
|
-- to expire or by hitting another server (Q17).
|
||
|
|
ADD COLUMN pin_failed_attempts INT NOT NULL DEFAULT 0,
|
||
|
|
ADD COLUMN pin_locked_until TIMESTAMP WITH TIME ZONE,
|
||
|
|
-- Outgoing transfers are held for 24 hours after a PIN reset (Q16).
|
||
|
|
ADD COLUMN transfer_blocked_until TIMESTAMP WITH TIME ZONE,
|
||
|
|
ADD CONSTRAINT chk_customers_pin_failed_attempts CHECK (pin_failed_attempts >= 0);
|
||
|
|
|
||
|
|
-- Security log of PIN events. Not a balance movement, so not in wallet_transactions.
|
||
|
|
CREATE TABLE customer_security_events (
|
||
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||
|
|
customer_id UUID NOT NULL REFERENCES customers(id) ON DELETE RESTRICT,
|
||
|
|
-- PIN_SET, PIN_CHANGED, PIN_RESET, PIN_FAILED, PIN_LOCKED, PIN_REMOVED_BY_ADMIN
|
||
|
|
event VARCHAR(30) NOT NULL,
|
||
|
|
-- The admin, for PIN_REMOVED_BY_ADMIN.
|
||
|
|
actor_user UUID,
|
||
|
|
reason VARCHAR(255),
|
||
|
|
ip_address VARCHAR(45),
|
||
|
|
user_agent VARCHAR(255),
|
||
|
|
created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
|
||
|
|
|
||
|
|
CONSTRAINT chk_customer_security_events_admin CHECK (
|
||
|
|
event <> 'PIN_REMOVED_BY_ADMIN' OR (actor_user IS NOT NULL AND reason IS NOT NULL))
|
||
|
|
);
|
||
|
|
|
||
|
|
CREATE INDEX idx_customer_security_events_customer_id_created_at ON customer_security_events(customer_id, created_at DESC);
|