50 lines
1.7 KiB
Python
50 lines
1.7 KiB
Python
"""Create hashed service-account credential storage."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
revision = "0003_identity_credentials"
|
|
down_revision = "0002_control_plane"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
_INDEX = "ix_credentials_service_account_active"
|
|
_TABLE = "service_account_credentials"
|
|
|
|
|
|
def upgrade() -> None:
|
|
"""Create identity storage without retaining bearer secrets."""
|
|
|
|
op.execute(sa.text("CREATE SCHEMA IF NOT EXISTS identity"))
|
|
op.create_table(
|
|
_TABLE,
|
|
sa.Column("id", sa.Uuid(), primary_key=True),
|
|
sa.Column("service_account_id", sa.Uuid(), nullable=False),
|
|
sa.Column("workspace_id", sa.Uuid(), nullable=False),
|
|
sa.Column("issue_sequence", sa.BigInteger(), sa.Identity(), nullable=False),
|
|
sa.Column("token_prefix", sa.String(32), nullable=False),
|
|
sa.Column("token_digest", sa.LargeBinary(32), nullable=False),
|
|
sa.Column("scopes", sa.JSON(), nullable=False),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.UniqueConstraint("token_digest", name="uq_credentials_token_digest"),
|
|
schema="identity",
|
|
)
|
|
op.create_index(
|
|
_INDEX,
|
|
_TABLE,
|
|
["service_account_id", "workspace_id", "revoked_at", "expires_at"],
|
|
schema="identity",
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
"""Remove only this migration's identity table and index."""
|
|
|
|
op.drop_index(_INDEX, table_name=_TABLE, schema="identity")
|
|
op.drop_table(_TABLE, schema="identity")
|
|
op.execute(sa.text("DROP SCHEMA IF EXISTS identity"))
|