BBergleandClaude Opus 5
e7392a5723
Reverses a shipped, tested, merged decision (D4/PR #2) rather than building on it — see docs/DECISIONS.md D15 for the full record: what was rejected (Postgres as a second container; Postgres+PostGIS bundled inside the single container via a supervisor), what this costs (no database-level RLS, no PostGIS, procrastinate needs replacing — all stated as a concern before this was decided, and reaffirmed anyway, which is the user's call to make about their own instance). The one invariant-critical consequence: isolation between users now rests entirely on the repository-layer scope (db.py's `Scope.select()`), not two layers. CLAUDE.md's invariant #4 is revised accordingly. This is not a downgrade-and-hope — `Scope` is built so an unfiltered query against a user-owned table is structurally harder to write than a scoped one (there is no method on `Scope` that returns one), and tests/test_auth.py::test_scoped_session_blocks_cross_user_reads replaces the old RLS proof with the same empirical standard: it doesn't trust the query builder filters correctly because the code reads correctly, it registers two real users and checks. test_unscoped_session_can_see_every_user_when_misused is the deliberately alarming companion — it demonstrates exactly what a reviewer must now catch, since nothing else will. Six real, non-obvious SQLite behaviours found and fixed by actually running this against a real file, not assumed from docs: - Foreign keys, ON DELETE CASCADE included, are OFF by default per connection — deleting a user silently left orphaned sessions/api_tokens, no error either way. Fixed with PRAGMA foreign_keys=ON on every connect. - Transactions default to DEFERRED, which only takes a write lock on the first actual write — a real check-then-act race for invite redemption (two concurrent redemptions could both read used_count < max_uses as true before either commits). Fixed by disabling the driver's implicit BEGIN and issuing BEGIN IMMEDIATE ourselves — SQLAlchemy's own documented recipe for this, not improvised. - DateTime(timezone=True) does NOT round-trip tzinfo on SQLite — a tz-aware datetime goes in, a naive one comes back out, and every `expires_at < datetime.now(UTC)` comparison in auth/service.py then raises TypeError. Fixed once at the Base level with a UTCDateTime TypeDecorator rather than per-column. - Uuid(as_uuid=True) stores as 32-char hex with NO hyphens on SQLite, not str(uuid)'s hyphenated form. A test fixture that raw-inserted the hyphenated form left rows the ORM's own later UPDATE (via invite.used_count += 1's autoflush) could never match by primary key, updating zero rows and raising StaleDataError. Fixed by using .hex to match exactly what the ORM itself writes. - BEGIN IMMEDIATE applies to every transaction, reads included — a long-lived test fixture that autobegins a transaction via a bare read and never explicitly closes it holds SQLite's exclusive write lock for the rest of the test, and a later scoped_session() call fails with "database is locked". Not an app-code bug (every real session block closes cleanly on exit), but real enough to document since the next person writing a test against the db_auth fixture will hit it too. - Python's sqlite3 module deprecates its own implicit datetime adapter as of 3.12 — silent today, warns on every raw-SQL datetime bind. Only ever hit test fixture code (the ORM path never uses it, confirmed by running the ORM-only health test with warnings promoted to errors and it stayed clean); fixed there with an explicit .isoformat() rather than left for a future Python version to turn into a real failure. Also, since with_for_update() silently no-ops on SQLite (confirmed — SQLAlchemy emits no SQL for it, no error either) rather than actually locking anything: removed it from register()'s invite-redemption query and corrected the comment to attribute the concurrency guarantee to BEGIN IMMEDIATE, where it now actually lives. One PR, not several, for the same reason PR #2 was: the migration, the models, db.py, and the docs recording why are five views of one decision — splitting them wouldn't make review easier, just disconnected. 552 insertions / 548 deletions across 17 files, most of it necessarily touching what PR #2 shipped rather than net-new code. Deliberately deferred, not solved here: PostGIS's replacement for spatial storage, procrastinate's replacement for background jobs, and the EXCLUDE USING gist constraint's replacement for component_installs — none of those tables exist yet (Phase 1-2), so none of it is broken, and docs/DECISIONS.md D15 records exactly what each future phase needs to decide before it can be built. .gitea/workflows/deploy pipeline (PR #4, built for the old 3-container Postgres compose stack) was closed as superseded rather than merged; the single-container image build is follow-up work, not part of this change. Verified: ruff check, ruff format --check, and mypy --strict all clean. 13/13 pytest passing against a real SQLite file, including with DeprecationWarning promoted to an error (confirms the sqlite3 adapter deprecation fix actually holds, not just that it's quiet by default). Full alembic upgrade -> downgrade -1 -> upgrade cycle run clean. alembic check clean with no include_object filter needed at all now (SQLite starts with nothing but what our own migrations create — no PostGIS/TIGER noise to filter out in the first place). CI's exact migration command sequence reproduced locally end to end before touching the workflow file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
106 lines
4.5 KiB
Python
106 lines
4.5 KiB
Python
"""Baseline: identity tables (users, invites, sessions, api_tokens).
|
|
|
|
No roles, no RLS, no GRANTs — SQLite has none of those concepts. Isolation between users is
|
|
enforced entirely at the application layer now; see db.py and CLAUDE.md's invariant #4, and
|
|
docs/DECISIONS.md D15 for the full story of why this migration looks nothing like the Postgres
|
|
version it replaced.
|
|
|
|
Revision ID: 0001
|
|
Revises:
|
|
Create Date: 2026-09-21
|
|
"""
|
|
|
|
from collections.abc import Sequence
|
|
|
|
import sqlalchemy as sa
|
|
|
|
from alembic import op
|
|
|
|
revision: str = "0001"
|
|
down_revision: str | None = None
|
|
branch_labels: str | Sequence[str] | None = None
|
|
depends_on: str | Sequence[str] | None = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"users",
|
|
sa.Column("id", sa.Uuid(as_uuid=True), primary_key=True),
|
|
sa.Column("email", sa.String(320), nullable=False, unique=True),
|
|
sa.Column("display_name", sa.String(200), nullable=False),
|
|
sa.Column("password_hash", sa.Text(), nullable=False),
|
|
sa.Column("role", sa.String(20), nullable=False, server_default="member"),
|
|
sa.Column("timezone", sa.String(64), nullable=False, server_default="UTC"),
|
|
sa.Column("unit_system", sa.String(10), nullable=False, server_default="imperial"),
|
|
sa.Column("is_active", sa.Boolean(), nullable=False, server_default=sa.true()),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
)
|
|
|
|
op.create_table(
|
|
"invites",
|
|
sa.Column("id", sa.Uuid(as_uuid=True), primary_key=True),
|
|
sa.Column("code_hash", sa.LargeBinary(32), nullable=False, unique=True),
|
|
sa.Column(
|
|
"created_by",
|
|
sa.Uuid(as_uuid=True),
|
|
sa.ForeignKey("users.id"),
|
|
nullable=False,
|
|
),
|
|
sa.Column("email", sa.String(320), nullable=True),
|
|
sa.Column("role", sa.String(20), nullable=False, server_default="member"),
|
|
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("max_uses", sa.Integer(), nullable=False, server_default="1"),
|
|
sa.Column("used_count", sa.Integer(), nullable=False, server_default="0"),
|
|
sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
|
|
)
|
|
|
|
op.create_table(
|
|
"sessions",
|
|
sa.Column("id", sa.Uuid(as_uuid=True), primary_key=True),
|
|
sa.Column(
|
|
"user_id",
|
|
sa.Uuid(as_uuid=True),
|
|
sa.ForeignKey("users.id", ondelete="CASCADE"),
|
|
nullable=False,
|
|
),
|
|
sa.Column("token_hash", sa.LargeBinary(32), nullable=False, unique=True),
|
|
sa.Column("client", sa.String(20), nullable=False, server_default="web"),
|
|
sa.Column("user_agent", sa.Text(), nullable=True),
|
|
# Plain string — SQLite has no INET type, and nothing queries the address's structure.
|
|
sa.Column("ip", sa.String(45), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
|
|
)
|
|
op.create_index("ix_sessions_user_id", "sessions", ["user_id"])
|
|
|
|
op.create_table(
|
|
"api_tokens",
|
|
sa.Column("id", sa.Uuid(as_uuid=True), primary_key=True),
|
|
sa.Column(
|
|
"user_id",
|
|
sa.Uuid(as_uuid=True),
|
|
sa.ForeignKey("users.id", ondelete="CASCADE"),
|
|
nullable=False,
|
|
),
|
|
sa.Column("name", sa.String(200), nullable=False),
|
|
sa.Column("token_hash", sa.LargeBinary(32), nullable=False, unique=True),
|
|
# JSON-encoded TEXT — SQLite has no array type; see models/identity.py.
|
|
sa.Column("scopes", sa.JSON(), nullable=False, server_default="[]"),
|
|
sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
|
|
)
|
|
op.create_index("ix_api_tokens_user_id", "api_tokens", ["user_id"])
|
|
|
|
|
|
def downgrade() -> None:
|
|
# Children before parents (FK order) — matters even with ON DELETE CASCADE enforced (see
|
|
# db.py's PRAGMA foreign_keys=ON), since dropping a table Postgres-style doesn't rely on that
|
|
# at all; SQLite's DROP TABLE has no dependency ordering of its own to lean on.
|
|
op.drop_table("api_tokens")
|
|
op.drop_table("sessions")
|
|
op.drop_table("invites")
|
|
op.drop_table("users")
|