refactor(auth): remove bot owner linkage and enforce bot-level permissions

app/repositories/postgres.py

@@ -47,8 +47,8 @@ _SELECT_AUTH_TOKEN = """
 _SELECT_BOT_PRINCIPAL = """
     SELECT
         id,
-        owner_user_id,
         name,
+        permission,
         description,
         is_active,
         created_at,
@@ -158,8 +158,8 @@ class PostgresPortfolioRepository:
                 """
                 CREATE TABLE IF NOT EXISTS bot_principals (
                     id TEXT PRIMARY KEY,
-                    owner_user_id TEXT NOT NULL,
                     name TEXT NOT NULL UNIQUE,
+                    permission TEXT NOT NULL,
                     description TEXT,
                     is_active BOOLEAN NOT NULL DEFAULT TRUE,
                     created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -169,6 +169,9 @@ class PostgresPortfolioRepository:
                 """
             )
             cur.execute("ALTER TABLE auth_tokens ADD COLUMN IF NOT EXISTS bot_principal_id TEXT")
+            cur.execute("ALTER TABLE bot_principals ADD COLUMN IF NOT EXISTS permission TEXT")
+            cur.execute("UPDATE bot_principals SET permission = 'read' WHERE permission IS NULL")
+            cur.execute("ALTER TABLE bot_principals ALTER COLUMN permission SET NOT NULL")
             cur.execute(
                 """
                 CREATE INDEX IF NOT EXISTS idx_auth_tokens_user_created
@@ -304,8 +307,8 @@ class PostgresPortfolioRepository:
             raise ValueError("봇을 찾을 수 없습니다")
         return BotPrincipal(
             id=row[0],
-            owner_user_id=row[1],
-            name=row[2],
+            name=row[1],
+            permission=row[2],
             description=row[3] if len(row) > 3 else None,
             is_active=bool(row[4]) if len(row) > 4 else True,
             created_at=row[5] if len(row) > 5 else None,
@@ -515,9 +518,10 @@ class PostgresPortfolioRepository:
     ) -> AuthToken:
         self.ensure_schema()
         with self._connect().cursor() as cur:
-            cur.execute("SELECT 1 FROM users WHERE id = %s", (user_id,))
-            if cur.fetchone() is None:
-                raise ValueError("사용자를 찾을 수 없습니다")
+            if token_type != "bot":
+                cur.execute("SELECT 1 FROM users WHERE id = %s", (user_id,))
+                if cur.fetchone() is None:
+                    raise ValueError("사용자를 찾을 수 없습니다")
             if bot_principal_id is not None:
                 cur.execute("SELECT 1 FROM bot_principals WHERE id = %s", (bot_principal_id,))
                 if cur.fetchone() is None:
@@ -562,15 +566,12 @@ class PostgresPortfolioRepository:
     def create_bot_principal(
         self,
         *,
-        owner_user_id: str,
         name: str,
+        permission: str,
         description: str | None = None,
     ) -> BotPrincipal:
         self.ensure_schema()
         with self._connect().cursor() as cur:
-            cur.execute("SELECT 1 FROM users WHERE id = %s", (owner_user_id,))
-            if cur.fetchone() is None:
-                raise ValueError("소유 사용자를 찾을 수 없습니다")
             cur.execute("SELECT 1 FROM bot_principals WHERE name = %s", (name,))
             if cur.fetchone() is not None:
                 raise ValueError(f"이미 존재하는 bot name입니다: {name}")
@@ -578,11 +579,11 @@ class PostgresPortfolioRepository:
             bot_id = str(uuid.uuid4())
             cur.execute(
                 """
-                INSERT INTO bot_principals (id, owner_user_id, name, description)
+                INSERT INTO bot_principals (id, name, permission, description)
                 VALUES (%s, %s, %s, %s)
-                RETURNING id, owner_user_id, name, description, is_active, created_at, updated_at, deactivated_at
+                RETURNING id, name, permission, description, is_active, created_at, updated_at, deactivated_at
                 """,
-                (bot_id, owner_user_id, name, description),
+                (bot_id, name, permission, description),
             )
             row = cur.fetchone()
         return self._row_to_bot_principal(row)
@@ -615,7 +616,7 @@ class PostgresPortfolioRepository:
                 UPDATE bot_principals
                 SET is_active = FALSE, deactivated_at = NOW(), updated_at = NOW()
                 WHERE id = %s
-                RETURNING id, owner_user_id, name, description, is_active, created_at, updated_at, deactivated_at
+                RETURNING id, name, permission, description, is_active, created_at, updated_at, deactivated_at
                 """,
                 (bot_principal_id,),
             )