feat(auth): add admin-managed bot API keys with expiry and revocation

migrations/versions/20260403_0006_bot_principals_and_bot_tokens.py

@@ -0,0 +1,79 @@
+"""add bot principals and bot token linkage
+
+Revision ID: 20260403_0006
+Revises: 20260403_0005
+Create Date: 2026-04-03 13:30:00
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy import inspect
+
+
+revision = "20260403_0006"
+down_revision = "20260403_0005"
+branch_labels = None
+depends_on = None
+
+
+def _table_exists(inspector, table_name: str) -> bool:
+    return table_name in inspector.get_table_names()
+
+
+def _column_exists(inspector, table_name: str, column_name: str) -> bool:
+    return any(column["name"] == column_name for column in inspector.get_columns(table_name))
+
+
+def _index_exists(inspector, table_name: str, index_name: str) -> bool:
+    return any(index["name"] == index_name for index in inspector.get_indexes(table_name))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = inspect(bind)
+
+    if not _table_exists(inspector, "bot_principals"):
+        op.create_table(
+            "bot_principals",
+            sa.Column("id", sa.Text(), nullable=False),
+            sa.Column("owner_user_id", sa.Text(), nullable=False),
+            sa.Column("name", sa.Text(), nullable=False),
+            sa.Column("description", sa.Text(), nullable=True),
+            sa.Column("is_active", sa.Boolean(), nullable=False, server_default=sa.text("TRUE")),
+            sa.Column("created_at", sa.TIMESTAMP(timezone=True), nullable=False, server_default=sa.text("NOW()")),
+            sa.Column("updated_at", sa.TIMESTAMP(timezone=True), nullable=False, server_default=sa.text("NOW()")),
+            sa.Column("deactivated_at", sa.TIMESTAMP(timezone=True), nullable=True),
+            sa.PrimaryKeyConstraint("id"),
+            sa.UniqueConstraint("name", name="uq_bot_principals_name"),
+        )
+
+    inspector = inspect(bind)
+    if _table_exists(inspector, "auth_tokens") and not _column_exists(inspector, "auth_tokens", "bot_principal_id"):
+        op.add_column("auth_tokens", sa.Column("bot_principal_id", sa.Text(), nullable=True))
+
+    inspector = inspect(bind)
+    if _table_exists(inspector, "auth_tokens") and not _index_exists(inspector, "auth_tokens", "idx_auth_tokens_bot_created"):
+        op.create_index("idx_auth_tokens_bot_created", "auth_tokens", ["bot_principal_id", "created_at"])
+
+    if _table_exists(inspector, "bot_principals") and not _index_exists(inspector, "bot_principals", "idx_bot_principals_active_created"):
+        op.create_index("idx_bot_principals_active_created", "bot_principals", ["is_active", "created_at"])
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = inspect(bind)
+
+    if _table_exists(inspector, "auth_tokens") and _index_exists(inspector, "auth_tokens", "idx_auth_tokens_bot_created"):
+        op.drop_index("idx_auth_tokens_bot_created", table_name="auth_tokens")
+
+    if _table_exists(inspector, "auth_tokens") and _column_exists(inspector, "auth_tokens", "bot_principal_id"):
+        op.drop_column("auth_tokens", "bot_principal_id")
+
+    inspector = inspect(bind)
+    if _table_exists(inspector, "bot_principals") and _index_exists(inspector, "bot_principals", "idx_bot_principals_active_created"):
+        op.drop_index("idx_bot_principals_active_created", table_name="bot_principals")
+
+    if _table_exists(inspector, "bot_principals"):
+        op.drop_table("bot_principals")