feat(auth): add DB-backed login, token management, and idempotent auth migration

2026-04-03 12:55:34 +00:00
parent 5168e52e4b
commit 06b1805b92
28 changed files with 1609 additions and 140 deletions
@@ -0,0 +1,90 @@
+"""add user auth fields and auth tokens
+
+Revision ID: 20260403_0005
+Revises: 20260403_0004
+Create Date: 2026-04-03 03:00:00
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy import inspect
+
+
+revision = "20260403_0005"
+down_revision = "20260403_0004"
+branch_labels = None
+depends_on = None
+
+
+def _table_exists(inspector, table_name: str) -> bool:
+    return table_name in inspector.get_table_names()
+
+
+def _column_exists(inspector, table_name: str, column_name: str) -> bool:
+    return any(column["name"] == column_name for column in inspector.get_columns(table_name))
+
+
+def _index_exists(inspector, table_name: str, index_name: str) -> bool:
+    return any(index["name"] == index_name for index in inspector.get_indexes(table_name))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = inspect(bind)
+
+    if not _column_exists(inspector, "users", "permission"):
+        op.add_column("users", sa.Column("permission", sa.Text(), nullable=False, server_default="read"))
+    if not _column_exists(inspector, "users", "is_active"):
+        op.add_column("users", sa.Column("is_active", sa.Boolean(), nullable=False, server_default=sa.text("TRUE")))
+    if not _column_exists(inspector, "users", "password_hash"):
+        op.add_column("users", sa.Column("password_hash", sa.Text(), nullable=True))
+    if not _column_exists(inspector, "users", "last_login_at"):
+        op.add_column("users", sa.Column("last_login_at", sa.TIMESTAMP(timezone=True), nullable=True))
+
+    if not _table_exists(inspector, "auth_tokens"):
+        op.create_table(
+            "auth_tokens",
+            sa.Column("id", sa.Text(), nullable=False),
+            sa.Column("user_id", sa.Text(), nullable=False),
+            sa.Column("name", sa.Text(), nullable=False),
+            sa.Column("token_prefix", sa.Text(), nullable=False),
+            sa.Column("token_hash", sa.Text(), nullable=False),
+            sa.Column("permission", sa.Text(), nullable=False),
+            sa.Column("token_type", sa.Text(), nullable=False),
+            sa.Column("expires_at", sa.TIMESTAMP(timezone=True), nullable=True),
+            sa.Column("last_used_at", sa.TIMESTAMP(timezone=True), nullable=True),
+            sa.Column("revoked_at", sa.TIMESTAMP(timezone=True), nullable=True),
+            sa.Column("created_at", sa.TIMESTAMP(timezone=True), nullable=False, server_default=sa.text("NOW()")),
+            sa.PrimaryKeyConstraint("id"),
+            sa.UniqueConstraint("token_hash", name="uq_auth_tokens_token_hash"),
+        )
+
+    inspector = inspect(bind)
+    if not _index_exists(inspector, "auth_tokens", "idx_auth_tokens_user_created"):
+        op.create_index("idx_auth_tokens_user_created", "auth_tokens", ["user_id", "created_at"])
+    if not _index_exists(inspector, "auth_tokens", "idx_auth_tokens_hash_active"):
+        op.create_index("idx_auth_tokens_hash_active", "auth_tokens", ["token_hash"])
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = inspect(bind)
+
+    if _table_exists(inspector, "auth_tokens"):
+        if _index_exists(inspector, "auth_tokens", "idx_auth_tokens_hash_active"):
+            op.drop_index("idx_auth_tokens_hash_active", table_name="auth_tokens")
+        if _index_exists(inspector, "auth_tokens", "idx_auth_tokens_user_created"):
+            op.drop_index("idx_auth_tokens_user_created", table_name="auth_tokens")
+        op.drop_table("auth_tokens")
+
+    inspector = inspect(bind)
+    if _column_exists(inspector, "users", "last_login_at"):
+        op.drop_column("users", "last_login_at")
+    if _column_exists(inspector, "users", "password_hash"):
+        op.drop_column("users", "password_hash")
+    if _column_exists(inspector, "users", "is_active"):
+        op.drop_column("users", "is_active")
+    if _column_exists(inspector, "users", "permission"):
+        op.drop_column("users", "permission")