feat(auth): add opaque bearer sessions

2026-07-13 14:45:36 +08:00
parent 661990b27b
commit 653eda0596
59 changed files with 1408 additions and 408 deletions
--- a/server/alembic/versions/20260713_0002_auth_sessions.py
+++ b/server/alembic/versions/20260713_0002_auth_sessions.py
@@ -0,0 +1,82 @@
+"""add opaque bearer authentication sessions
+
+Revision ID: 20260713_0002
+Revises: 20260713_0001
+Create Date: 2026-07-13 14:20:00
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "20260713_0002"
+down_revision: str | None = "20260713_0001"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "auth_sessions",
+        sa.Column("id", sa.String(length=36), nullable=False),
+        sa.Column("token_hash", sa.String(length=64), nullable=False),
+        sa.Column("tenant_id", sa.String(length=64), nullable=False),
+        sa.Column("principal_type", sa.String(length=20), nullable=False),
+        sa.Column("employee_id", sa.String(length=36), nullable=True),
+        sa.Column("username", sa.String(length=255), nullable=False),
+        sa.Column("metric_session_id", sa.String(length=64), nullable=False),
+        sa.Column(
+            "issued_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "last_seen_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("token_hash", name="uq_auth_sessions_token_hash"),
+    )
+    op.create_index("ix_auth_sessions_tenant_id", "auth_sessions", ["tenant_id"])
+    op.create_index("ix_auth_sessions_principal_type", "auth_sessions", ["principal_type"])
+    op.create_index("ix_auth_sessions_employee_id", "auth_sessions", ["employee_id"])
+    op.create_index("ix_auth_sessions_username", "auth_sessions", ["username"])
+    op.create_index("ix_auth_sessions_metric_session_id", "auth_sessions", ["metric_session_id"])
+    op.create_index("ix_auth_sessions_expires_at", "auth_sessions", ["expires_at"])
+    op.create_index("ix_auth_sessions_revoked_at", "auth_sessions", ["revoked_at"])
+    op.create_index(
+        "ix_auth_sessions_principal_active",
+        "auth_sessions",
+        ["principal_type", "revoked_at", "expires_at"],
+    )
+    op.create_index(
+        "ix_auth_sessions_tenant_username",
+        "auth_sessions",
+        ["tenant_id", "username"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_auth_sessions_tenant_username", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_principal_active", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_revoked_at", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_expires_at", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_metric_session_id", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_username", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_employee_id", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_principal_type", table_name="auth_sessions")
+    op.drop_index("ix_auth_sessions_tenant_id", table_name="auth_sessions")
+    op.drop_table("auth_sessions")