Moved the Perl wallet modules and tests to DBIx::Class

Moved all the Perl code to use DBIx::Class for the database interface.
This includes updating all database calls, how the schema is generated
and maintained, and the tests in places where some output has changed.
We also remove the schema.t test, as the tests for it are more covered
in the admin.t tests now.

Change-Id: Ie5083432d09a0d9fe364a61c31378b77aa7b3cb7
Reviewed-on: https://gerrit.stanford.edu/598
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

2 files changed, 233 insertions, 201 deletions

diff --git a/perl/Wallet/Object/Base.pm b/perl/Wallet/Object/Base.pm
index 87506f4..5bd89a7 100644
--- a/perl/Wallet/Object/Base.pm
+++ b/perl/Wallet/Object/Base.pm
@@ -24,7 +24,7 @@ use Wallet::ACL;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.05';
+$VERSION = '0.06';
 
 ##############################################################################
 # Constructors
@@ -37,10 +37,11 @@ $VERSION = '0.05';
 # probably be usable as-is by most object types.
 sub new {
     my ($class, $type, $name, $dbh) = @_;
-    my $sql = 'select ob_name from objects where ob_type = ? and ob_name = ?';
-    my $data = $dbh->selectrow_array ($sql, undef, $type, $name);
-    $dbh->commit;
-    die "cannot find ${type}:${name}\n" unless ($data and $data eq $name);
+    my %search = (ob_type => $type,
+                  ob_name => $name);
+    my $object = $dbh->resultset('Object')->find (\%search);
+    die "cannot find ${type}:${name}\n"
+        unless ($object and $object->ob_name eq $name);
     my $self = {
         dbh  => $dbh,
         name => $name,
@@ -59,18 +60,27 @@ sub create {
     $time ||= time;
     die "invalid object type\n" unless $type;
     die "invalid object name\n" unless $name;
+    my $guard = $dbh->txn_scope_guard;
     eval {
-        my $date = strftime ('%Y-%m-%d %T', localtime $time);
-        my $sql = 'insert into objects (ob_type, ob_name, ob_created_by,
-            ob_created_from, ob_created_on) values (?, ?, ?, ?, ?)';
-        $dbh->do ($sql, undef, $type, $name, $user, $host, $date);
-        $sql = "insert into object_history (oh_type, oh_name, oh_action,
-            oh_by, oh_from, oh_on) values (?, ?, 'create', ?, ?, ?)";
-        $dbh->do ($sql, undef, $type, $name, $user, $host, $date);
-        $dbh->commit;
+        my %record = (ob_type         => $type,
+                      ob_name         => $name,
+                      ob_created_by   => $user,
+                      ob_created_from => $host,
+                      ob_created_on   => strftime ('%Y-%m-%d %T',
+                                                   localtime $time));
+        $dbh->resultset('Object')->create (\%record);
+
+        %record = (oh_type   => $type,
+                   oh_name   => $name,
+                   oh_action => 'create',
+                   oh_by     => $user,
+                   oh_from   => $host,
+                   oh_on     => strftime ('%Y-%m-%d %T', localtime $time));
+        $dbh->resultset('ObjectHistory')->create (\%record);
+
+        $guard->commit;
     };
     if ($@) {
-        $dbh->rollback;
         die "cannot create object ${type}:${name}: $@\n";
     }
     my $self = {
@@ -126,30 +136,36 @@ sub log_action {
     # We have two traces to record, one in the object_history table and one in
     # the object record itself.  Commit both changes as a transaction.  We
     # assume that AutoCommit is turned off.
+    my $guard = $self->{dbh}->txn_scope_guard;
     eval {
-        my $date = strftime ('%Y-%m-%d %T', localtime $time);
-        my $sql = 'insert into object_history (oh_type, oh_name, oh_action,
-            oh_by, oh_from, oh_on) values (?, ?, ?, ?, ?, ?)';
-        $self->{dbh}->do ($sql, undef, $self->{type}, $self->{name}, $action,
-                          $user, $host, $date);
+        my %record = (oh_type   => $self->{type},
+                      oh_name   => $self->{name},
+                      oh_action => $action,
+                      oh_by     => $user,
+                      oh_from   => $host,
+                      oh_on     => strftime ('%Y-%m-%d %T', localtime $time));
+        $self->{dbh}->resultset('ObjectHistory')->create (\%record);
+
+        my %search = (ob_type   => $self->{type},
+                      ob_name   => $self->{name});
+        my $object = $self->{dbh}->resultset('Object')->find (\%search);
         if ($action eq 'get') {
-            $sql = 'update objects set ob_downloaded_by = ?,
-                ob_downloaded_from = ?, ob_downloaded_on = ? where
-                ob_type = ? and ob_name = ?';
-            $self->{dbh}->do ($sql, undef, $user, $host, $date, $self->{type},
-                              $self->{name});
+            $object->ob_downloaded_by   ($user);
+            $object->ob_downloaded_from ($host);
+            $object->ob_downloaded_on   (strftime ('%Y-%m-%d %T',
+                                                   localtime $time));
         } elsif ($action eq 'store') {
-            $sql = 'update objects set ob_stored_by = ?, ob_stored_from = ?,
-                ob_stored_on = ? where ob_type = ? and ob_name = ?';
-            $self->{dbh}->do ($sql, undef, $user, $host, $date, $self->{type},
-                              $self->{name});
+            $object->ob_stored_by   ($user);
+            $object->ob_stored_from ($host);
+            $object->ob_stored_on   (strftime ('%Y-%m-%d %T',
+                                               localtime $time));
         }
-        $self->{dbh}->commit;
+        $object->update;
+        $guard->commit;
     };
     if ($@) {
         my $id = $self->{type} . ':' . $self->{name};
         $self->error ("cannot update history for $id: $@");
-        $self->{dbh}->rollback;
         return;
     }
     return 1;
@@ -175,12 +191,18 @@ sub log_set {
     unless ($fields{$field}) {
         die "invalid history field $field";
     }
-    my $date = strftime ('%Y-%m-%d %T', localtime $time);
-    my $sql = "insert into object_history (oh_type, oh_name, oh_action,
-        oh_field, oh_type_field, oh_old, oh_new, oh_by, oh_from, oh_on)
-        values (?, ?, 'set', ?, ?, ?, ?, ?, ?, ?)";
-    $self->{dbh}->do ($sql, undef, $self->{type}, $self->{name}, $field,
-                      $type_field, $old, $new, $user, $host, $date);
+
+    my %record = (oh_type       => $self->{type},
+                  oh_name       => $self->{name},
+                  oh_action     => 'set',
+                  oh_field      => $field,
+                  oh_type_field => $type_field,
+                  oh_old        => $old,
+                  oh_new        => $new,
+                  oh_by         => $user,
+                  oh_from       => $host,
+                  oh_on         => strftime ('%Y-%m-%d %T', localtime $time));
+    $self->{dbh}->resultset('ObjectHistory')->create (\%record);
 }
 
 ##############################################################################
@@ -202,20 +224,21 @@ sub _set_internal {
         $self->error ("cannot modify ${type}:${name}: object is locked");
         return;
     }
+
+    my $guard = $self->{dbh}->txn_scope_guard;
     eval {
-        my $sql = "select ob_$attr from objects where ob_type = ? and
-            ob_name = ?";
-        my $old = $self->{dbh}->selectrow_array ($sql, undef, $type, $name);
-        $sql = "update objects set ob_$attr = ? where ob_type = ? and
-            ob_name = ?";
-        $self->{dbh}->do ($sql, undef, $value, $type, $name);
+        my %search = (ob_type => $type,
+                      ob_name => $name);
+        my $object = $self->{dbh}->resultset('Object')->find (\%search);
+        my $old = $object->get_column ("ob_$attr");
+
+        $object->update ({ "ob_$attr" => $value });
         $self->log_set ($attr, $old, $value, $user, $host, $time);
-        $self->{dbh}->commit;
+        $guard->commit;
     };
     if ($@) {
         my $id = $self->{type} . ':' . $self->{name};
         $self->error ("cannot set $attr on $id: $@");
-        $self->{dbh}->rollback;
         return;
     }
     return 1;
@@ -236,14 +259,13 @@ sub _get_internal {
     my $type = $self->{type};
     my $value;
     eval {
-        my $sql = "select $attr from objects where ob_type = ? and
-            ob_name = ?";
-        $value = $self->{dbh}->selectrow_array ($sql, undef, $type, $name);
-        $self->{dbh}->commit;
+        my %search = (ob_type => $type,
+                      ob_name => $name);
+        my $object = $self->{dbh}->resultset('Object')->find (\%search);
+        $value = $object->get_column ($attr);
     };
     if ($@) {
         $self->error ($@);
-        $self->{dbh}->rollback;
         return;
     }
     return $value;
@@ -356,14 +378,18 @@ sub flag_check {
     my $dbh = $self->{dbh};
     my $value;
     eval {
-        my $sql = 'select fl_flag from flags where fl_type = ? and fl_name = ?
-            and fl_flag = ?';
-        $value = $dbh->selectrow_array ($sql, undef, $type, $name, $flag);
-        $dbh->commit;
+        my %search = (fl_type => $type,
+                      fl_name => $name,
+                      fl_flag => $flag);
+        my $flag = $dbh->resultset('Flag')->find (\%search);
+        if (not defined $flag) {
+            $value = 0;
+        } else {
+            $value = $flag->fl_flag;
+        }
     };
     if ($@) {
         $self->error ("cannot check flag $flag for ${type}:${name}: $@");
-        $dbh->rollback;
         return;
     } else {
         return ($value) ? 1 : 0;
@@ -378,22 +404,21 @@ sub flag_clear {
     my $name = $self->{name};
     my $type = $self->{type};
     my $dbh = $self->{dbh};
+    my $guard = $dbh->txn_scope_guard;
     eval {
-        my $sql = 'select * from flags where fl_type = ? and fl_name = ? and
-            fl_flag = ?';
-        my ($data) = $dbh->selectrow_array ($sql, undef, $type, $name, $flag);
-        unless (defined $data) {
+        my %search = (fl_type => $type,
+                      fl_name => $name,
+                      fl_flag => $flag);
+        my $flag = $dbh->resultset('Flag')->find (\%search);
+        unless (defined $flag) {
             die "flag not set\n";
         }
-        $sql = 'delete from flags where fl_type = ? and fl_name = ? and
-            fl_flag = ?';
-        $dbh->do ($sql, undef, $type, $name, $flag);
-        $self->log_set ('flags', $flag, undef, $user, $host, $time);
-        $dbh->commit;
+        $flag->delete;
+        $self->log_set ('flags', $flag->fl_flag, undef, $user, $host, $time);
+        $guard->commit;
     };
     if ($@) {
         $self->error ("cannot clear flag $flag on ${type}:${name}: $@");
-        $dbh->rollback;
         return;
     }
     return 1;
@@ -407,20 +432,18 @@ sub flag_list {
     undef $self->{error};
     my @flags;
     eval {
-        my $sql = 'select fl_flag from flags where fl_type = ? and
-            fl_name = ? order by fl_flag';
-        my $sth = $self->{dbh}->prepare ($sql);
-        $sth->execute ($self->{type}, $self->{name});
-        my $flag;
-        while (defined ($flag = $sth->fetchrow_array)) {
-            push (@flags, $flag);
+        my %search = (fl_type => $self->{type},
+                      fl_name => $self->{name});
+        my %attrs  = (order_by => 'fl_flag');
+        my @flags_rs = $self->{dbh}->resultset('Flag')->search (\%search,
+                                                                \%attrs);
+        for my $flag (@flags_rs) {
+            push (@flags, $flag->fl_flag);
         }
-        $self->{dbh}->commit;
     };
     if ($@) {
         my $id = $self->{type} . ':' . $self->{name};
         $self->error ("cannot retrieve flags for $id: $@");
-        $self->{dbh}->rollback;
         return;
     } else {
         return @flags;
@@ -435,22 +458,21 @@ sub flag_set {
     my $name = $self->{name};
     my $type = $self->{type};
     my $dbh = $self->{dbh};
+    my $guard = $dbh->txn_scope_guard;
     eval {
-        my $sql = 'select * from flags where fl_type = ? and fl_name = ? and
-            fl_flag = ?';
-        my ($data) = $dbh->selectrow_array ($sql, undef, $type, $name, $flag);
-        if (defined $data) {
+        my %search = (fl_type => $type,
+                      fl_name => $name,
+                      fl_flag => $flag);
+        my $flag = $dbh->resultset('Flag')->find (\%search);
+        if (defined $flag) {
             die "flag already set\n";
         }
-        $sql = 'insert into flags (fl_type, fl_name, fl_flag)
-            values (?, ?, ?)';
-        $dbh->do ($sql, undef, $type, $name, $flag);
-        $self->log_set ('flags', undef, $flag, $user, $host, $time);
-        $dbh->commit;
+        $flag = $dbh->resultset('Flag')->create (\%search);
+        $self->log_set ('flags', undef, $flag->fl_flag, $user, $host, $time);
+        $guard->commit;
     };
     if ($@) {
         $self->error ("cannot set flag $flag on ${type}:${name}: $@");
-        $dbh->rollback;
         return;
     }
     return 1;
@@ -466,11 +488,10 @@ sub format_acl_id {
     my ($self, $id) = @_;
     my $name = $id;
 
-    my $sql = 'select ac_name from acls where ac_id = ?';
-    my $sth = $self->{dbh}->prepare ($sql);
-    $sth->execute ($id);
-    if (my @ref = $sth->fetchrow_array) {
-        $name = $ref[0] . " ($id)";
+    my %search = (ac_id => $id);
+    my $acl_rs = $self->{dbh}->resultset('Acl')->find (\%search);
+    if (defined $acl_rs) {
+        $name = $acl_rs->ac_name . " ($id)";
     }
 
     return $name;
@@ -483,23 +504,29 @@ sub history {
     my ($self) = @_;
     my $output = '';
     eval {
-        my $sql = 'select oh_action, oh_field, oh_type_field, oh_old, oh_new,
-            oh_by, oh_from, oh_on from object_history where oh_type = ? and
-            oh_name = ? order by oh_on';
-        my $sth = $self->{dbh}->prepare ($sql);
-        $sth->execute ($self->{type}, $self->{name});
-        my @data;
-        while (@data = $sth->fetchrow_array) {
-            $output .= "$data[7]  ";
-            my ($old, $new) = @data[3..4];
-            if ($data[0] eq 'set' and $data[1] eq 'flags') {
-                if (defined ($data[4])) {
-                    $output .= "set flag $data[4]";
-                } elsif (defined ($data[3])) {
-                    $output .= "clear flag $data[3]";
+        my %search = (oh_type => $self->{type},
+                      oh_name => $self->{name});
+        my %attrs = (order_by => 'oh_on');
+        my @history = $self->{dbh}->resultset('ObjectHistory')
+            ->search (\%search, \%attrs);
+
+        for my $history_rs (@history) {
+            $output .= sprintf ("%s %s  ", $history_rs->oh_on->ymd,
+                               $history_rs->oh_on->hms);
+
+            my $old    = $history_rs->oh_old;
+            my $new    = $history_rs->oh_new;
+            my $action = $history_rs->oh_action;
+            my $field  = $history_rs->oh_field;
+
+            if ($action eq 'set' and $field eq 'flags') {
+                if (defined ($new)) {
+                    $output .= "set flag $new";
+                } elsif (defined ($old)) {
+                    $output .= "clear flag $old";
                 }
-            } elsif ($data[0] eq 'set' and $data[1] eq 'type_data') {
-                my $attr = $data[2];
+            } elsif ($action eq 'set' and $field eq 'type_data') {
+                my $attr = $history_rs->oh_type_field;
                 if (defined ($old) and defined ($new)) {
                     $output .= "set attribute $attr to $new (was $old)";
                 } elsif (defined ($old)) {
@@ -507,9 +534,8 @@ sub history {
                 } elsif (defined ($new)) {
                     $output .= "add $new to attribute $attr";
                 }
-            } elsif ($data[0] eq 'set'
-                     and ($data[1] eq 'owner' or $data[1] =~ /^acl_/)) {
-                my $field = $data[1];
+            } elsif ($action eq 'set'
+                     and ($field eq 'owner' or $field =~ /^acl_/)) {
                 $old = $self->format_acl_id ($old) if defined ($old);
                 $new = $self->format_acl_id ($new) if defined ($new);
                 if (defined ($old) and defined ($new)) {
@@ -519,8 +545,7 @@ sub history {
                 } elsif (defined ($old)) {
                     $output .= "unset $field (was $old)";
                 }
-            } elsif ($data[0] eq 'set') {
-                my $field = $data[1];
+            } elsif ($action eq 'set') {
                 if (defined ($old) and defined ($new)) {
                     $output .= "set $field to $new (was $old)";
                 } elsif (defined ($new)) {
@@ -529,16 +554,15 @@ sub history {
                     $output .= "unset $field (was $old)";
                 }
             } else {
-                $output .= $data[0];
+                $output .= $action;
             }
-            $output .= "\n    by $data[5] from $data[6]\n";
+            $output .= sprintf ("\n    by %s from %s\n", $history_rs->oh_by,
+                               $history_rs->oh_from);
         }
-        $self->{dbh}->commit;
     };
     if ($@) {
         my $id = $self->{type} . ':' . $self->{name};
         $self->error ("cannot read history for $id: $@");
-        $self->{dbh}->rollback;
         return;
     }
     return $output;
@@ -592,15 +616,14 @@ sub show {
                  [ ob_downloaded_on   => 'Downloaded on'   ]);
     my $fields = join (', ', map { $_->[0] } @attrs);
     my @data;
+    my $object_rs;
     eval {
-        my $sql = "select $fields from objects where ob_type = ? and
-            ob_name = ?";
-        @data = $self->{dbh}->selectrow_array ($sql, undef, $type, $name);
-        $self->{dbh}->commit;
+        my %search = (ob_type => $type,
+                      ob_name => $name);
+        $object_rs = $self->{dbh}->resultset('Object')->find (\%search);
     };
     if ($@) {
         $self->error ("cannot retrieve data for ${type}:${name}: $@");
-        $self->{dbh}->rollback;
         return;
     }
     my $output = '';
@@ -609,15 +632,18 @@ sub show {
     # Format the results.  We use a hack to insert the flags before the first
     # trace field since they're not a field in the object in their own right.
     # The comment should be word-wrapped at 80 columns.
-    for my $i (0 .. $#data) {
-        next unless defined $data[$i];
-        if ($attrs[$i][0] eq 'ob_comment' && length ($data[$i]) > 79 - 17) {
+    for my $i (0 .. $#attrs) {
+        my $field = $attrs[$i][0];
+        my $fieldtext = $attrs[$i][1];
+        next unless my $value = $object_rs->get_column ($field);
+
+        if ($field eq 'ob_comment' && length ($value) > 79 - 17) {
             local $Text::Wrap::columns = 80;
             local $Text::Wrap::unexpand = 0;
-            $data[$i] = wrap (' ' x 17, ' ' x 17, $data[$i]);
-            $data[$i] =~ s/^ {17}//;
+            $value = wrap (' ' x 17, ' ' x 17, $value);
+            $value =~ s/^ {17}//;
         }
-        if ($attrs[$i][0] eq 'ob_created_by') {
+        if ($field eq 'ob_created_by') {
             my @flags = $self->flag_list;
             if (not @flags and $self->error) {
                 return;
@@ -631,15 +657,14 @@ sub show {
             }
             $output .= $attr_output;
         }
-        next unless defined $data[$i];
-        if ($attrs[$i][0] =~ /^ob_(owner|acl_)/) {
-            my $acl = eval { Wallet::ACL->new ($data[$i], $self->{dbh}) };
+        if ($field =~ /^ob_(owner|acl_)/) {
+            my $acl = eval { Wallet::ACL->new ($value, $self->{dbh}) };
             if ($acl and not $@) {
-                $data[$i] = $acl->name || $data[$i];
-                push (@acls, [ $acl, $data[$i] ]);
+                $value = $acl->name || $value;
+                push (@acls, [ $acl, $value ]);
             }
         }
-        $output .= sprintf ("%15s: %s\n", $attrs[$i][1], $data[$i]);
+        $output .= sprintf ("%15s: %s\n", $fieldtext, $value);
     }
     if (@acls) {
         my %seen;
@@ -663,20 +688,31 @@ sub destroy {
         $self->error ("cannot destroy ${type}:${name}: object is locked");
         return;
     }
+    my $guard = $self->{dbh}->txn_scope_guard;
     eval {
-        my $date = strftime ('%Y-%m-%d %T', localtime $time);
-        my $sql = 'delete from flags where fl_type = ? and fl_name = ?';
-        $self->{dbh}->do ($sql, undef, $type, $name);
-        $sql = 'delete from objects where ob_type = ? and ob_name = ?';
-        $self->{dbh}->do ($sql, undef, $type, $name);
-        $sql = "insert into object_history (oh_type, oh_name, oh_action,
-            oh_by, oh_from, oh_on) values (?, ?, 'destroy', ?, ?, ?)";
-        $self->{dbh}->do ($sql, undef, $type, $name, $user, $host, $date);
-        $self->{dbh}->commit;
+
+        # Remove any flags that may exist for the record.
+        my %search = (fl_type => $type,
+                      fl_name => $name);
+        $self->{dbh}->resultset('Flag')->search (\%search)->delete;
+
+        # Remove any object records
+        %search = (ob_type => $type,
+                   ob_name => $name);
+        $self->{dbh}->resultset('Object')->search (\%search)->delete;
+
+        # And create a new history object for the destroy action.
+        my %record = (oh_type => $type,
+                      oh_name => $name,
+                      oh_action => 'destroy',
+                      oh_by     => $user,
+                      oh_from   => $host,
+                      oh_on     => strftime ('%Y-%m-%d %T', localtime $time));
+        $self->{dbh}->resultset('ObjectHistory')->create (\%record);
+        $guard->commit;
     };
     if ($@) {
         $self->error ("cannot destroy ${type}:${name}: $@");
-        $self->{dbh}->rollback;
         return;
     }
     return 1;
@@ -733,7 +769,7 @@ such object exits, throws an exception.  Otherwise, returns an object
 blessed into the class used for the new() call (so subclasses can leave
 this method alone and not override it).
 
-Takes a Wallet::Database object, which is stored in the object and used
+Takes a Wallet::Schema object, which is stored in the object and used
 for any further operations.
 
 =item create(TYPE, NAME, DBH, PRINCIPAL, HOSTNAME [, DATETIME])
diff --git a/perl/Wallet/Object/Keytab.pm b/perl/Wallet/Object/Keytab.pm
index fd3001f..083dae6 100644
--- a/perl/Wallet/Object/Keytab.pm
+++ b/perl/Wallet/Object/Keytab.pm
@@ -40,21 +40,29 @@ sub enctypes_set {
     my @trace = ($user, $host, $time);
     my $name = $self->{name};
     my %enctypes = map { $_ => 1 } @$enctypes;
+    my $guard = $self->{dbh}->txn_scope_guard;
     eval {
-        my $sql = 'select ke_enctype from keytab_enctypes where ke_name = ?';
-        my $sth = $self->{dbh}->prepare ($sql);
-        $sth->execute ($name);
-        my (@current, $entry);
-        while (defined ($entry = $sth->fetchrow_arrayref)) {
-            push (@current, @$entry);
+
+        # Find all enctypes for the given keytab.
+        my %search = (ke_name => $name);
+        my @enctypes = $self->{dbh}->resultset('KeytabEnctype')
+            ->search (\%search);
+        my (@current);
+        for my $enctype_rs (@enctypes) {
+            push (@current, $enctype_rs->ke_enctype);
         }
+
+        # Use the existing enctypes and the enctypes we should have to match
+        # against ones that need to be removed, and note those that already
+        # exist.
         for my $enctype (@current) {
             if ($enctypes{$enctype}) {
                 delete $enctypes{$enctype};
             } else {
-                $sql = 'delete from keytab_enctypes where ke_name = ? and
-                    ke_enctype = ?';
-                $self->{dbh}->do ($sql, undef, $name, $enctype);
+                %search = (ke_name    => $name,
+                           ke_enctype => $enctype);
+                $self->{dbh}->resultset('KeytabEnctype')->find (\%search)
+                    ->delete;
                 $self->log_set ('type_data enctypes', $enctype, undef, @trace);
             }
         }
@@ -64,21 +72,20 @@ sub enctypes_set {
         # doesn't enforce integrity constraints.  We do this in sorted order
         # to make it easier to test.
         for my $enctype (sort keys %enctypes) {
-            $sql = 'select en_name from enctypes where en_name = ?';
-            my $status = $self->{dbh}->selectrow_array ($sql, undef, $enctype);
-            unless ($status) {
+            my %search = (en_name => $enctype);
+            my $enctype_rs = $self->{dbh}->('Enctype')->find (\%search);
+            unless (defined $enctype_rs) {
                 die "unknown encryption type $enctype\n";
             }
-            $sql = 'insert into keytab_enctypes (ke_name, ke_enctype) values
-                (?, ?)';
-            $self->{dbh}->do ($sql, undef, $name, $enctype);
+            my %record = (ke_name    => $name,
+                          ke_enctype => $enctype);
+            $self->{dbh}->resultset('Enctype')->create (\%record);
             $self->log_set ('type_data enctypes', undef, $enctype, @trace);
         }
-        $self->{dbh}->commit;
+        $guard->commit;
     };
     if ($@) {
         $self->error ($@);
-        $self->{dbh}->rollback;
         return;
     }
     return 1;
@@ -92,19 +99,16 @@ sub enctypes_list {
     my ($self) = @_;
     my @enctypes;
     eval {
-        my $sql = 'select ke_enctype from keytab_enctypes where ke_name = ?
-            order by ke_enctype';
-        my $sth = $self->{dbh}->prepare ($sql);
-        $sth->execute ($self->{name});
-        my $entry;
-        while (defined ($entry = $sth->fetchrow_arrayref)) {
-            push (@enctypes, @$entry);
+        my %search = (ke_name => $self->{name});
+        my %attrs = (order_by => 'ke_enctype');
+        my @enctypes_rs = $self->{dbh}->resultset('KeytabEnctype')
+            ->search (\%search, \%attrs);
+        for my $enctype_rs (@enctypes_rs) {
+            push (@enctypes, $enctype_rs->ke_enctype);
         }
-        $self->{dbh}->commit;
     };
     if ($@) {
         $self->error ($@);
-        $self->{dbh}->rollback;
         return;
     }
     return @enctypes;
@@ -132,21 +136,21 @@ sub sync_set {
         $self->error ("unsupported synchronization target $target");
         return;
     } else {
+        my $guard = $self->{dbh}->txn_scope_guard;
         eval {
-            my $sql = 'select ks_target from keytab_sync where ks_name = ?';
-            my $dbh = $self->{dbh};
             my $name = $self->{name};
-            my ($result) = $dbh->selectrow_array ($sql, undef, $name);
-            if ($result) {
-                my $sql = 'delete from keytab_sync where ks_name = ?';
-                $self->{dbh}->do ($sql, undef, $name);
-                $self->log_set ('type_data sync', $result, undef, @trace);
+            my %search = (ks_name => $name);
+            my $sync_rs = $self->dbh->resultset('KeytabSync')
+                ->search (\%search);
+            if (defined $sync_rs) {
+                my $target = $sync_rs->ks_target;
+                $sync_rs->delete;
+                $self->log_set ('type_data sync', $target, undef, @trace);
             }
-            $self->{dbh}->commit;
+            $guard->commit;
         };
         if ($@) {
             $self->error ($@);
-            $self->{dbh}->rollback;
             return;
         }
     }
@@ -161,19 +165,16 @@ sub sync_list {
     my ($self) = @_;
     my @targets;
     eval {
-        my $sql = 'select ks_target from keytab_sync where ks_name = ?
-            order by ks_target';
-        my $sth = $self->{dbh}->prepare ($sql);
-        $sth->execute ($self->{name});
-        my $target;
-        while (defined ($target = $sth->fetchrow_array)) {
-            push (@targets, $target);
+        my %search = (ks_name => $self->{name});
+        my %attrs = (order_by => 'ks_target');
+        my @syncs = $self->dbh->resultset('KeytabSync')->search (\%search,
+                                                                 \%attrs);
+        for my $sync_rs (@syncs) {
+            push (@targets, $sync_rs->ks_target);
         }
-        $self->{dbh}->commit;
     };
     if ($@) {
         $self->error ($@);
-        $self->{dbh}->rollback;
         return;
     }
     return @targets;
@@ -247,11 +248,6 @@ sub new {
     my $kadmin = Wallet::Kadmin->new ();
     $self->{kadmin} = $kadmin;
 
-    # Set a callback for things to do after a fork, specifically for the MIT
-    # kadmin module which forks to kadmin.
-    my $callback = sub { $self->{dbh}->{InactiveDestroy} = 1 };
-    $kadmin->fork_callback ($callback);
-
     $self = $class->SUPER::new ($type, $name, $dbh);
     $self->{kadmin} = $kadmin;
     return $self;
@@ -271,11 +267,6 @@ sub create {
     my $kadmin = Wallet::Kadmin->new ();
     $self->{kadmin} = $kadmin;
 
-    # Set a callback for things to do after a fork, specifically for the MIT
-    # kadmin module which forks to kadmin.
-    my $callback = sub { $self->{dbh}->{InactiveDestroy} = 1 };
-    $kadmin->fork_callback ($callback);
-
     if (not $kadmin->create ($name)) {
         die $kadmin->error, "\n";
     }
@@ -292,16 +283,21 @@ sub destroy {
         $self->error ("cannot destroy $id: object is locked");
         return;
     }
+    my $dbh = $self->{dbh};
+    my $guard = $dbh->txn_scope_guard;
     eval {
-        my $sql = 'delete from keytab_sync where ks_name = ?';
-        $self->{dbh}->do ($sql, undef, $self->{name});
-        $sql = 'delete from keytab_enctypes where ke_name = ?';
-        $self->{dbh}->do ($sql, undef, $self->{name});
-        $self->{dbh}->commit;
+        my %search = (ks_name => $self->{name});
+        my $sync_rs = $dbh->resultset('KeytabSync')->search (\%search);
+        $sync_rs->delete_all if defined $sync_rs;
+
+        %search = (ke_name => $self->{name});
+        my $enctype_rs = $dbh->resultset('KeytabEnctype')->search (\%search);
+        $enctype_rs->delete_all if defined $enctype_rs;
+
+        $guard->commit;
     };
     if ($@) {
         $self->error ($@);
-        $self->{dbh}->rollback;
         return;
     }
     my $kadmin = $self->{kadmin};