BBergleandClaude Opus 5
ddea750792
Phase 0's API half: a working FastAPI app with register/login/me/logout, backed by a Postgres schema where row-level security is real and independently proven, not just declared. The core design decision, and the reason this lands as one PR instead of several: request-scoped queries run as `velodrome_app` (NOBYPASSRLS), but looking up identity in the first place — login by email, a session by its token hash — has to happen *before* app.user_id can be set, so those specific lookups run as a second role, `velodrome_auth` (BYPASSRLS), used nowhere else in the codebase. See velodrome/db.py's module docstring and apps/api/README.md for the full rationale. This is genuinely one reviewable unit: the migration, the models, and the auth service only make sense evaluated together, since they're three views of the same invariant. tests/test_auth.py::test_rls_blocks_cross_user_session_reads is the test worth reading first — it doesn't trust the RLS policy SQL because it reads correctly, it proves isolation by registering two users and confirming a scoped read of `sessions` for user A returns exactly one row, never two. Bugs found and fixed while actually running this against real Postgres (everything below was verified against a live postgis/postgis:16-3.4 container and a built Docker image, not just read for correctness): - CREATE ROLE's PASSWORD clause is DDL, not DML — it doesn't accept bind parameters (`PASSWORD $1` is a syntax error). Fixed with dollar-quoting. - Postgres roles are cluster-wide, not per-database — a second database in the same cluster hit "role already exists" on a plain CREATE ROLE. Fixed with a DO block catching duplicate_object. - A bare `Mapped[datetime]` on the ORM models infers a naive timestamp, silently disagreeing with the migration's correct `DateTime(timezone=True)` — asyncpg rejected the mismatch at insert time. Fixed once, at the declarative Base level via type_annotation_map, rather than per-column. - The session cookie's `secure` flag was gated on `!= "development"`, so anything else — including local testing and a real deploy running temporarily without TLS in front — got a Secure cookie no HTTP client will ever send back, breaking every authenticated request after login with no visible error. Gated on `== "production"` instead. - `alembic check` initially flagged every PostGIS/TIGER-installed table (dozens of them) as drift, because they're not in our metadata. A schema-based denylist doesn't work — reflected foreign tables come back with schema=None regardless of their real schema. Fixed with an allowlist keyed on target_metadata.tables instead, which is also more robust against future PostGIS versions adding more tables. - The migration itself was missing `nullable=False` on three timestamp columns that the ORM model assumed were never null — a genuine model/migration drift that alembic check caught once the PostGIS noise above was filtered out. Fixed in 0001 directly, since it's never shipped. - Two indexes the migration creates explicitly weren't declared on the ORM models, causing the same kind of drift. Added index=True to match. Deliberately deferred, not forgotten: per-IP/per-account login rate limiting (docs/PLAN.md mentions it; Phase 0's bar is a working skeleton, and this needs its own design pass) and the procrastinate job runner / worker container (nothing to run yet — arrives with the ingestion pipeline). ci.yml updated to match: the api and migrations jobs now provision the same two runtime roles this code actually needs, replacing the single placeholder DATABASE_URL from before any code existed. Verified: ruff check, ruff format --check, and mypy --strict all clean. 12/12 pytest passing against a real Postgres. Full alembic upgrade -> downgrade -1 -> upgrade cycle run twice (once standalone, once inside a two-database cluster to specifically catch the role-collision bug). alembic check clean. Docker image builds and serves real traffic — register and an authenticated GET /me both exercised against the actual built container, not just the test suite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
101 lines
4.8 KiB
Python
101 lines
4.8 KiB
Python
"""Identity tables: users, invites, sessions, api_tokens.
|
|
|
|
See docs/PLAN.md "Auth" and "Schema > Tables > Identity" for the design rationale, and
|
|
db.py's module docstring for why two DB roles exist. RLS policies for these tables are created
|
|
in the baseline Alembic migration (alembic/versions/0001_baseline.py), not here — SQLAlchemy
|
|
models describe columns, not database-level security policy, and keeping the policy SQL visible
|
|
and reviewable in the migration is deliberate.
|
|
"""
|
|
|
|
from datetime import datetime
|
|
from uuid import UUID
|
|
|
|
from sqlalchemy import ARRAY, ForeignKey, LargeBinary, String, Text
|
|
from sqlalchemy.dialects.postgresql import INET
|
|
from sqlalchemy.dialects.postgresql import UUID as PGUUID
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
|
from sqlalchemy.sql import func
|
|
|
|
from velodrome.ids import new_id
|
|
from velodrome.models.base import Base
|
|
|
|
|
|
class User(Base):
|
|
__tablename__ = "users"
|
|
|
|
id: Mapped[UUID] = mapped_column(PGUUID(as_uuid=True), primary_key=True, default=new_id)
|
|
email: Mapped[str] = mapped_column(String(320), unique=True, nullable=False)
|
|
display_name: Mapped[str] = mapped_column(String(200), nullable=False)
|
|
password_hash: Mapped[str] = mapped_column(Text, nullable=False)
|
|
role: Mapped[str] = mapped_column(String(20), nullable=False, default="member")
|
|
timezone: Mapped[str] = mapped_column(String(64), nullable=False, default="UTC")
|
|
# Display-only, per CLAUDE.md invariant #3 — storage is always SI, this never touches a query.
|
|
unit_system: Mapped[str] = mapped_column(String(10), nullable=False, default="imperial")
|
|
is_active: Mapped[bool] = mapped_column(nullable=False, default=True)
|
|
created_at: Mapped[datetime] = mapped_column(server_default=func.now(), nullable=False)
|
|
|
|
sessions: Mapped[list["Session"]] = relationship(back_populates="user")
|
|
api_tokens: Mapped[list["ApiToken"]] = relationship(back_populates="user")
|
|
|
|
|
|
class Invite(Base):
|
|
__tablename__ = "invites"
|
|
|
|
id: Mapped[UUID] = mapped_column(PGUUID(as_uuid=True), primary_key=True, default=new_id)
|
|
# sha256 digest of the invite code. The code itself is never stored anywhere — see
|
|
# auth/service.py. 32 bytes for sha256.
|
|
code_hash: Mapped[bytes] = mapped_column(LargeBinary(32), unique=True, nullable=False)
|
|
created_by: Mapped[UUID] = mapped_column(
|
|
PGUUID(as_uuid=True), ForeignKey("users.id"), nullable=False
|
|
)
|
|
email: Mapped[str | None] = mapped_column(String(320), nullable=True)
|
|
role: Mapped[str] = mapped_column(String(20), nullable=False, default="member")
|
|
expires_at: Mapped[datetime] = mapped_column(nullable=False)
|
|
max_uses: Mapped[int] = mapped_column(nullable=False, default=1)
|
|
used_count: Mapped[int] = mapped_column(nullable=False, default=0)
|
|
revoked_at: Mapped[datetime | None] = mapped_column(nullable=True)
|
|
|
|
|
|
class Session(Base):
|
|
__tablename__ = "sessions"
|
|
|
|
id: Mapped[UUID] = mapped_column(PGUUID(as_uuid=True), primary_key=True, default=new_id)
|
|
user_id: Mapped[UUID] = mapped_column(
|
|
PGUUID(as_uuid=True),
|
|
ForeignKey("users.id", ondelete="CASCADE"),
|
|
nullable=False,
|
|
index=True,
|
|
)
|
|
# sha256 of the opaque bearer token. The token itself is returned to the client exactly once,
|
|
# at login, and never stored — see auth/security.py.
|
|
token_hash: Mapped[bytes] = mapped_column(LargeBinary(32), unique=True, nullable=False)
|
|
client: Mapped[str] = mapped_column(String(20), nullable=False, default="web")
|
|
user_agent: Mapped[str | None] = mapped_column(Text, nullable=True)
|
|
ip: Mapped[str | None] = mapped_column(INET, nullable=True)
|
|
created_at: Mapped[datetime] = mapped_column(server_default=func.now(), nullable=False)
|
|
last_seen_at: Mapped[datetime] = mapped_column(server_default=func.now(), nullable=False)
|
|
expires_at: Mapped[datetime] = mapped_column(nullable=False)
|
|
revoked_at: Mapped[datetime | None] = mapped_column(nullable=True)
|
|
|
|
user: Mapped["User"] = relationship(back_populates="sessions")
|
|
|
|
|
|
class ApiToken(Base):
|
|
__tablename__ = "api_tokens"
|
|
|
|
id: Mapped[UUID] = mapped_column(PGUUID(as_uuid=True), primary_key=True, default=new_id)
|
|
user_id: Mapped[UUID] = mapped_column(
|
|
PGUUID(as_uuid=True),
|
|
ForeignKey("users.id", ondelete="CASCADE"),
|
|
nullable=False,
|
|
index=True,
|
|
)
|
|
name: Mapped[str] = mapped_column(String(200), nullable=False)
|
|
token_hash: Mapped[bytes] = mapped_column(LargeBinary(32), unique=True, nullable=False)
|
|
scopes: Mapped[list[str]] = mapped_column(ARRAY(String), nullable=False, default=list)
|
|
last_used_at: Mapped[datetime | None] = mapped_column(nullable=True)
|
|
expires_at: Mapped[datetime | None] = mapped_column(nullable=True)
|
|
revoked_at: Mapped[datetime | None] = mapped_column(nullable=True)
|
|
|
|
user: Mapped["User"] = relationship(back_populates="api_tokens")
|