mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-28 23:57:58 +09:00
Juan DenisandClaude Fable 5
4919ff1cfe
TimestampMixin (byte-identical to the hand-written pair — zero schema migrations) adopted by 52 classes across 44 model files; the utcnow tz-aware migration is now a one-file edit. uuid_pk() replaces the 13 pasted String(36) uuid4 lambdas across 7 files (ai.py's hex variant stays grandfathered, documented). Deviant shapes (indexed created_at, sanitization_profile's default-less updated_at, created-only models) deliberately keep their own columns. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
73 lines
2.8 KiB
Python
73 lines
2.8 KiB
Python
from datetime import datetime
|
|
|
|
from app import db
|
|
from app.models.mixins import TimestampMixin
|
|
from app.models.json_column_mixin import JsonColumnMixin
|
|
|
|
|
|
class ManagedDatabaseUser(TimestampMixin, JsonColumnMixin, db.Model):
|
|
"""A database user/grant ServerKit created on a managed database.
|
|
|
|
Live engines forget nothing, but ServerKit used to: users created through
|
|
the panel left no durable trace, so restarts lost the mapping between a
|
|
managed database and the credentials provisioned for it. This row is that
|
|
trace — it powers the users panel and scopes one-click admin SSO.
|
|
|
|
``is_shadow`` marks short-lived, single-use credentials (e.g. the Adminer
|
|
SSO login) that a reaper drops once ``expires_at`` passes. Passwords are
|
|
NEVER stored here — they cross the API exactly once at creation time.
|
|
"""
|
|
|
|
__tablename__ = 'managed_database_users'
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
managed_database_id = db.Column(
|
|
db.Integer, db.ForeignKey('managed_databases.id', ondelete='CASCADE'),
|
|
nullable=False, index=True,
|
|
)
|
|
username = db.Column(db.String(120), nullable=False)
|
|
# JSON list of grant keywords, e.g. ["ALL"] or ["SELECT", "INSERT"].
|
|
grants = db.Column(db.Text, nullable=False, default='["ALL"]')
|
|
is_shadow = db.Column(db.Boolean, nullable=False, default=False)
|
|
expires_at = db.Column(db.DateTime, nullable=True)
|
|
|
|
# Deleting the managed database removes its user rows (ORM cascade); the
|
|
# engine-side users are dropped explicitly by the service, never implicitly.
|
|
managed_database = db.relationship(
|
|
'ManagedDatabase',
|
|
backref=db.backref('users', cascade='all, delete-orphan'),
|
|
)
|
|
|
|
__table_args__ = (
|
|
db.UniqueConstraint('managed_database_id', 'username',
|
|
name='uq_managed_db_user'),
|
|
)
|
|
|
|
def get_grants(self):
|
|
return self._json_read('grants', [], expect=list)
|
|
|
|
def set_grants(self, grants):
|
|
self._json_write('grants', list(grants or []), falsy='[]')
|
|
|
|
@property
|
|
def is_expired(self):
|
|
return bool(self.expires_at and self.expires_at < datetime.utcnow())
|
|
|
|
def to_dict(self, live=None):
|
|
data = {
|
|
'id': self.id,
|
|
'managed_database_id': self.managed_database_id,
|
|
'username': self.username,
|
|
'grants': self.get_grants(),
|
|
'is_shadow': self.is_shadow,
|
|
'expires_at': self.expires_at.isoformat() if self.expires_at else None,
|
|
'created_at': self.created_at.isoformat() if self.created_at else None,
|
|
'updated_at': self.updated_at.isoformat() if self.updated_at else None,
|
|
}
|
|
if live is not None:
|
|
data['present'] = live.get('present')
|
|
return data
|
|
|
|
def __repr__(self):
|
|
return f'<ManagedDatabaseUser {self.username} db={self.managed_database_id}>'
|