feat(auth): add opaque bearer sessions

server/src/app/models/__init__.py

@@ -1,13 +1,19 @@
+from app.models.agent_asset import (
+    AgentAsset,
+    AgentAssetReview,
+    AgentAssetRuleFeedback,
+    AgentAssetVersion,
+)
 from app.models.agent_conversation import AgentConversation, AgentConversationMessage
-from app.models.agent_asset import AgentAsset, AgentAssetReview, AgentAssetRuleFeedback, AgentAssetVersion
 from app.models.agent_feedback import AgentOperationFeedback
 from app.models.agent_run import AgentRun, AgentToolCall, AgentTraceEvent, SemanticParseLog
 from app.models.approval import ApprovalRecord
 from app.models.audit_log import AuditLog
+from app.models.auth_session import AuthSession
 from app.models.budget import BudgetAllocation, BudgetReservation, BudgetTransaction
-from app.models.employee_change_log import EmployeeChangeLog
-from app.models.employee_behavior_profile import EmployeeBehaviorProfileSnapshot
 from app.models.employee import Employee
+from app.models.employee_behavior_profile import EmployeeBehaviorProfileSnapshot
+from app.models.employee_change_log import EmployeeChangeLog
 from app.models.expense_case import BusinessEvent, ExpenseCase, ExpenseCaseLink
 from app.models.few_shot_sample import FewShotSample
 from app.models.financial_record import (
@@ -44,6 +50,7 @@ __all__ = [
     "AgentTraceEvent",
     "ApprovalRecord",
     "AuditLog",
+    "AuthSession",
     "BudgetAllocation",
     "BudgetReservation",
     "BudgetTransaction",

server/src/app/models/auth_session.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+
+from sqlalchemy import DateTime, Index, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base_class import Base
+
+
+class AuthSession(Base):
+    __tablename__ = "auth_sessions"
+    __table_args__ = (
+        Index("ix_auth_sessions_principal_active", "principal_type", "revoked_at", "expires_at"),
+        Index("ix_auth_sessions_tenant_username", "tenant_id", "username"),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    token_hash: Mapped[str] = mapped_column(String(64), unique=True)
+    tenant_id: Mapped[str] = mapped_column(String(64), default="default", index=True)
+    principal_type: Mapped[str] = mapped_column(String(20), index=True)
+    employee_id: Mapped[str | None] = mapped_column(String(36), nullable=True, index=True)
+    username: Mapped[str] = mapped_column(String(255), index=True)
+    metric_session_id: Mapped[str] = mapped_column(String(64), default="", index=True)
+    issued_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), index=True)
+    revoked_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True, index=True
+    )
+    last_seen_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now()
+    )
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())