feat(api): FastAPI skeleton with two-role RLS auth foundation

Phase 0's API half: a working FastAPI app with register/login/me/logout, backed by a Postgres schema where row-level security is real and independently proven, not just declared. The core design decision, and the reason this lands as one PR instead of several: request-scoped queries run as `velodrome_app` (NOBYPASSRLS), but looking up identity in the first place — login by email, a session by its token hash — has to happen *before* app.user_id can be set, so those specific lookups run as a second role, `velodrome_auth` (BYPASSRLS), used nowhere else in the codebase. See velodrome/db.py's module docstring and apps/api/README.md for the full rationale. This is genuinely one reviewable unit: the migration, the models, and the auth service only make sense evaluated together, since they're three views of the same invariant. tests/test_auth.py::test_rls_blocks_cross_user_session_reads is the test worth reading first — it doesn't trust the RLS policy SQL because it reads correctly, it proves isolation by registering two users and confirming a scoped read of `sessions` for user A returns exactly one row, never two. Bugs found and fixed while actually running this against real Postgres (everything below was verified against a live postgis/postgis:16-3.4 container and a built Docker image, not just read for correctness): - CREATE ROLE's PASSWORD clause is DDL, not DML — it doesn't accept bind parameters (`PASSWORD $1` is a syntax error). Fixed with dollar-quoting. - Postgres roles are cluster-wide, not per-database — a second database in the same cluster hit "role already exists" on a plain CREATE ROLE. Fixed with a DO block catching duplicate_object. - A bare `Mapped[datetime]` on the ORM models infers a naive timestamp, silently disagreeing with the migration's correct `DateTime(timezone=True)` — asyncpg rejected the mismatch at insert time. Fixed once, at the declarative Base level via type_annotation_map, rather than per-column. - The session cookie's `secure` flag was gated on `!= "development"`, so anything else — including local testing and a real deploy running temporarily without TLS in front — got a Secure cookie no HTTP client will ever send back, breaking every authenticated request after login with no visible error. Gated on `== "production"` instead. - `alembic check` initially flagged every PostGIS/TIGER-installed table (dozens of them) as drift, because they're not in our metadata. A schema-based denylist doesn't work — reflected foreign tables come back with schema=None regardless of their real schema. Fixed with an allowlist keyed on target_metadata.tables instead, which is also more robust against future PostGIS versions adding more tables. - The migration itself was missing `nullable=False` on three timestamp columns that the ORM model assumed were never null — a genuine model/migration drift that alembic check caught once the PostGIS noise above was filtered out. Fixed in 0001 directly, since it's never shipped. - Two indexes the migration creates explicitly weren't declared on the ORM models, causing the same kind of drift. Added index=True to match. Deliberately deferred, not forgotten: per-IP/per-account login rate limiting (docs/PLAN.md mentions it; Phase 0's bar is a working skeleton, and this needs its own design pass) and the procrastinate job runner / worker container (nothing to run yet — arrives with the ingestion pipeline). ci.yml updated to match: the api and migrations jobs now provision the same two runtime roles this code actually needs, replacing the single placeholder DATABASE_URL from before any code existed. Verified: ruff check, ruff format --check, and mypy --strict all clean. 12/12 pytest passing against a real Postgres. Full alembic upgrade -> downgrade -1 -> upgrade cycle run twice (once standalone, once inside a two-database cluster to specifically catch the role-collision bug). alembic check clean. Docker image builds and serves real traffic — register and an authenticated GET /me both exercised against the actual built container, not just the test suite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-21 08:14:06 -04:00
parent e7cb06a6bc
commit ddea750792
32 changed files with 3085 additions and 7 deletions
@@ -0,0 +1,89 @@
+"""Alembic environment.
+
+Deliberately independent of velodrome.config.Settings: migrations run as a privileged/owner
+connection (VELODROME_DATABASE_URL_MIGRATE — a superuser or schema-owning role, which trivially
+satisfies "BYPASSRLS" since superusers always bypass RLS), never as either of the two runtime
+roles the app itself uses. Reading env vars directly here, rather than importing the app's
+settings, keeps a migration-only CI job from needing every runtime env var the app requires.
+"""
+
+import asyncio
+import os
+
+import sqlalchemy as sa
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import async_engine_from_config
+
+from alembic import context
+from velodrome.models import Base
+
+config = context.config
+target_metadata = Base.metadata
+
+
+# postgis/postgis ships an entire pre-installed schema of its own (PostGIS core tables plus the
+# TIGER geocoder's tiger/topology schemas — dozens of tables) that Alembic never created and
+# doesn't manage. Without this filter, `alembic check`/autogenerate sees every single one as
+# "should be dropped" simply because it's not in our SQLAlchemy metadata — which would make CI's
+# `alembic check` step permanently useless (always red, for reasons that have nothing to do with
+# an actual drift).
+#
+# A denylist keyed on schema name is NOT reliable here: reflected foreign tables can come back
+# with `schema=None` on their Table object regardless of which schema they actually live in on
+# the server (confirmed against a real postgis/postgis:16-3.4 container — tables that `\dt`
+# clearly shows under the `tiger` schema still reflect with schema=None). An allowlist is the
+# robust version of the same idea: only ever compare tables OUR metadata declares, so a future
+# PostGIS/TIGER version adding more foreign tables can never cause a false positive here.
+def include_object(
+    object: sa.schema.SchemaItem, name: str | None, type_: str, reflected: bool, compare_to: object
+) -> bool:
+    if type_ == "table":
+        return name in target_metadata.tables
+    return True
+
+
+def _migrate_url() -> str:
+    url = os.environ.get("VELODROME_DATABASE_URL_MIGRATE")
+    if not url:
+        # Local-dev convenience only — every real environment (CI, deploy/) sets this explicitly.
+        url = "postgresql+asyncpg://postgres:postgres@localhost:5432/velodrome"
+    return url
+
+
+def run_migrations_offline() -> None:
+    context.configure(
+        url=_migrate_url(),
+        target_metadata=target_metadata,
+        literal_binds=True,
+        dialect_opts={"paramstyle": "named"},
+        include_object=include_object,
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def _do_run_migrations(connection: Connection) -> None:
+    context.configure(
+        connection=connection,
+        target_metadata=target_metadata,
+        include_object=include_object,
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+async def run_migrations_online() -> None:
+    configuration = config.get_section(config.config_ini_section) or {}
+    configuration["sqlalchemy.url"] = _migrate_url()
+    connectable = async_engine_from_config(configuration, prefix="sqlalchemy.")
+
+    async with connectable.connect() as connection:
+        await connection.run_sync(_do_run_migrations)
+
+    await connectable.dispose()
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    asyncio.run(run_migrations_online())
@@ -0,0 +1,24 @@
+"""${message}
+
+Revision ID: ${up_revision}
+Revises: ${down_revision | comma,n}
+Create Date: ${create_date}
+"""
+from collections.abc import Sequence
+
+from alembic import op
+import sqlalchemy as sa
+${imports if imports else ""}
+
+revision: str = ${repr(up_revision)}
+down_revision: str | None = ${repr(down_revision)}
+branch_labels: str | Sequence[str] | None = ${repr(branch_labels)}
+depends_on: str | Sequence[str] | None = ${repr(depends_on)}
+
+
+def upgrade() -> None:
+    ${upgrades if upgrades else "pass"}
+
+
+def downgrade() -> None:
+    ${downgrades if downgrades else "pass"}
@@ -0,0 +1,238 @@
+"""Baseline: identity tables, two runtime DB roles, RLS policies.
+
+This migration creates the schema AND the two application-facing Postgres roles it depends on
+(velodrome_app, velodrome_auth) — see db.py and auth/service.py module docstrings for the full
+rationale. It runs as a privileged/owner connection (VELODROME_DATABASE_URL_MIGRATE), which is
+why it's able to CREATE ROLE and GRANT at all; neither of the two roles it creates could do this
+to itself.
+
+Revision ID: 0001
+Revises:
+Create Date: 2026-09-21
+"""
+
+import os
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql as pg
+
+from alembic import op
+
+revision: str = "0001"
+down_revision: str | None = None
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def _require_password(env_var: str) -> str:
+    value = os.environ.get(env_var)
+    if not value:
+        raise RuntimeError(
+            f"{env_var} must be set before running this migration — see deploy/.env.example. "
+            "There is no default: these are the passwords for real runtime database roles."
+        )
+    return value
+
+
+def _dollar_quoted(password: str) -> str:
+    """Safely embed a password literal in DDL.
+
+    CREATE ROLE's PASSWORD clause is DDL, not DML — it does NOT accept bind parameters over the
+    wire (Postgres rejects `PASSWORD $1` with a syntax error; ask how we know). Dollar-quoting
+    sidesteps manual escaping entirely rather than hand-rolling quote-doubling, which is easy to
+    get subtly wrong for a password an operator chose.
+    """
+    tag = "$velodrome_pw$"
+    if tag in password:
+        raise RuntimeError(
+            f"password must not contain the literal sequence {tag!r} — pick a different one"
+        )
+    return f"{tag}{password}{tag}"
+
+
+def upgrade() -> None:
+    app_password = _require_password("VELODROME_DB_APP_PASSWORD")
+    auth_password = _require_password("VELODROME_DB_AUTH_PASSWORD")
+
+    # --- Runtime roles -------------------------------------------------------------------
+    # velodrome_app:  NOBYPASSRLS — every request-scoped query after identity is established.
+    # velodrome_auth: BYPASSRLS   — ONLY auth/service.py's pre-identity lookups. See db.py.
+    # Roles are cluster-wide in Postgres, not per-database — if this migration ever runs
+    # against a second database sharing the same cluster (exactly what a local dev + test setup
+    # commonly looks like), a plain CREATE ROLE fails with "role already exists" even though
+    # THIS database has never seen the migration before. Postgres has no CREATE ROLE IF NOT
+    # EXISTS, so the standard idiom is catching duplicate_object in a DO block. ALTER ROLE
+    # afterwards keeps the password in sync with the current env var either way, rather than
+    # silently keeping whatever password the role happened to be created with previously.
+    op.execute(
+        f"""
+        DO $$
+        BEGIN
+            CREATE ROLE velodrome_app LOGIN PASSWORD {_dollar_quoted(app_password)}
+                NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+        EXCEPTION WHEN duplicate_object THEN
+            ALTER ROLE velodrome_app WITH LOGIN PASSWORD {_dollar_quoted(app_password)}
+                NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+        END
+        $$;
+        """
+    )
+    op.execute(
+        f"""
+        DO $$
+        BEGIN
+            CREATE ROLE velodrome_auth LOGIN PASSWORD {_dollar_quoted(auth_password)}
+                NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION BYPASSRLS;
+        EXCEPTION WHEN duplicate_object THEN
+            ALTER ROLE velodrome_auth WITH LOGIN PASSWORD {_dollar_quoted(auth_password)}
+                NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION BYPASSRLS;
+        END
+        $$;
+        """
+    )
+
+    # --- Tables ----------------------------------------------------------------------------
+    op.create_table(
+        "users",
+        sa.Column("id", pg.UUID(as_uuid=True), primary_key=True),
+        sa.Column("email", sa.String(320), nullable=False, unique=True),
+        sa.Column("display_name", sa.String(200), nullable=False),
+        sa.Column("password_hash", sa.Text(), nullable=False),
+        sa.Column("role", sa.String(20), nullable=False, server_default="member"),
+        sa.Column("timezone", sa.String(64), nullable=False, server_default="UTC"),
+        sa.Column("unit_system", sa.String(10), nullable=False, server_default="imperial"),
+        sa.Column("is_active", sa.Boolean(), nullable=False, server_default=sa.true()),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()
+        ),
+    )
+
+    op.create_table(
+        "invites",
+        sa.Column("id", pg.UUID(as_uuid=True), primary_key=True),
+        sa.Column("code_hash", sa.LargeBinary(32), nullable=False, unique=True),
+        sa.Column(
+            "created_by",
+            pg.UUID(as_uuid=True),
+            sa.ForeignKey("users.id"),
+            nullable=False,
+        ),
+        sa.Column("email", sa.String(320), nullable=True),
+        sa.Column("role", sa.String(20), nullable=False, server_default="member"),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("max_uses", sa.Integer(), nullable=False, server_default="1"),
+        sa.Column("used_count", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+    op.create_table(
+        "sessions",
+        sa.Column("id", pg.UUID(as_uuid=True), primary_key=True),
+        sa.Column(
+            "user_id",
+            pg.UUID(as_uuid=True),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("token_hash", sa.LargeBinary(32), nullable=False, unique=True),
+        sa.Column("client", sa.String(20), nullable=False, server_default="web"),
+        sa.Column("user_agent", sa.Text(), nullable=True),
+        sa.Column("ip", pg.INET(), nullable=True),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()
+        ),
+        sa.Column(
+            "last_seen_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()
+        ),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.create_index("ix_sessions_user_id", "sessions", ["user_id"])
+
+    op.create_table(
+        "api_tokens",
+        sa.Column("id", pg.UUID(as_uuid=True), primary_key=True),
+        sa.Column(
+            "user_id",
+            pg.UUID(as_uuid=True),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("name", sa.String(200), nullable=False),
+        sa.Column("token_hash", sa.LargeBinary(32), nullable=False, unique=True),
+        sa.Column(
+            "scopes",
+            pg.ARRAY(sa.String()),
+            nullable=False,
+            server_default="{}",
+        ),
+        sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.create_index("ix_api_tokens_user_id", "api_tokens", ["user_id"])
+
+    # --- Grants ------------------------------------------------------------------------------
+    # velodrome_auth needs full read/write on these four tables — it's the only thing that ever
+    # creates a user, a session, or redeems an invite. velodrome_app needs the same grants
+    # because RLS policies (below) restrict WHICH ROWS it sees, not whether the underlying
+    # privilege exists — GRANT and POLICY are two independent layers, both required.
+    # Deliberately NOT granting TRUNCATE: it's a whole-table operation that RLS cannot filter
+    # (Postgres RLS policies do not apply to TRUNCATE at all), so granting it to velodrome_app
+    # would let any bug in ordinary request-handling code wipe an entire table in one statement,
+    # defeating the isolation these policies exist to provide. Neither runtime role needs it —
+    # tests use DELETE for fixture cleanup instead (see tests/conftest.py).
+    for table in ("users", "invites", "sessions", "api_tokens"):
+        op.execute(f"GRANT SELECT, INSERT, UPDATE, DELETE ON {table} TO velodrome_app")
+        op.execute(f"GRANT SELECT, INSERT, UPDATE, DELETE ON {table} TO velodrome_auth")
+
+    # --- Row-level security ------------------------------------------------------------------
+    # Policies below apply to velodrome_app only — velodrome_auth has BYPASSRLS and ignores them
+    # entirely, by design (see module docstring). current_setting('app.user_id', true) returns
+    # NULL when unset, which makes every policy below deny-by-default for an unscoped connection.
+
+    op.execute("ALTER TABLE users ENABLE ROW LEVEL SECURITY")
+    op.execute(
+        "CREATE POLICY own_row ON users FOR ALL "
+        "USING (id = current_setting('app.user_id', true)::uuid) "
+        "WITH CHECK (id = current_setting('app.user_id', true)::uuid)"
+    )
+
+    op.execute("ALTER TABLE sessions ENABLE ROW LEVEL SECURITY")
+    op.execute(
+        "CREATE POLICY own_rows ON sessions FOR ALL "
+        "USING (user_id = current_setting('app.user_id', true)::uuid) "
+        "WITH CHECK (user_id = current_setting('app.user_id', true)::uuid)"
+    )
+
+    op.execute("ALTER TABLE api_tokens ENABLE ROW LEVEL SECURITY")
+    op.execute(
+        "CREATE POLICY own_rows ON api_tokens FOR ALL "
+        "USING (user_id = current_setting('app.user_id', true)::uuid) "
+        "WITH CHECK (user_id = current_setting('app.user_id', true)::uuid)"
+    )
+
+    op.execute("ALTER TABLE invites ENABLE ROW LEVEL SECURITY")
+    op.execute(
+        "CREATE POLICY own_rows ON invites FOR ALL "
+        "USING (created_by = current_setting('app.user_id', true)::uuid) "
+        "WITH CHECK (created_by = current_setting('app.user_id', true)::uuid)"
+    )
+
+
+def downgrade() -> None:
+    for table in ("invites", "api_tokens", "sessions", "users"):
+        op.execute(f"DROP POLICY IF EXISTS own_rows ON {table}")
+        op.execute(f"DROP POLICY IF EXISTS own_row ON {table}")
+
+    # Children before parents (FK order).
+    op.drop_table("api_tokens")
+    op.drop_table("sessions")
+    op.drop_table("invites")
+    op.drop_table("users")
+
+    # Dropping the tables drops the GRANTs that referenced them; the roles themselves remain
+    # until explicitly dropped here.
+    op.execute("DROP ROLE IF EXISTS velodrome_app")
+    op.execute("DROP ROLE IF EXISTS velodrome_auth")