peter
827df7494c
- A password reset or change, "log out everywhere" and a revoked untrusted password revoke all of the account's API tokens too (audited): one minted from a stolen session no longer outlives the answer. - A bearer token or link grant with a non-ASCII character is refused (401/403), not a 500. - Making a token's grants or a folder link holds the folder, so a racing delete cannot fail the foreign key; a link's view count is one atomic UPDATE. - A folder link's card counts exactly the files its page lists (one `links.folder_files`). - A file with no extension is served without a trailing dot. - 0106's downgrade names a Hub folder so it never collides with one of the user's folders. - The speed baseline reads share tokens through the app (the database keeps them hashed/encrypted). - Tests: the token scope on the real session stack, the folder poster, the Hub refused for a link, 0106's downgrade data step, 0107 without a key; docs/comments follow (three folder kinds, folder links, key change, the cleanup job's token warnings).
111 lines
4.5 KiB
Python
111 lines
4.5 KiB
Python
"""Machine access to the Files library: API tokens bound to folders, and the Hub folder
|
|
|
|
Revision ID: 0106_api_tokens
|
|
Revises: 0105_job_source_key
|
|
Create Date: 2026-10-14
|
|
|
|
`api_tokens` is a user's token for a machine (a script, the hub): only its SHA-256 is kept, plus the
|
|
first characters to recognise it by, and whether its user was told it is about to run out. `api_token_grants` says what it may do in which folder — list,
|
|
read, write, delete — so a token reaches nothing it was not given, folder by folder.
|
|
|
|
A third folder kind, `hub`: the one folder a user exchanges files with their hub machine through.
|
|
Like a source folder its name is the client's to render; like an own folder a file may be moved in.
|
|
One per user.
|
|
"""
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
revision: str = "0106_api_tokens"
|
|
down_revision: str | None = "0105_job_source_key"
|
|
branch_labels: str | None = None
|
|
depends_on: str | None = None
|
|
|
|
_KIND_OLD = (
|
|
"(kind = 'source' AND source_key IS NOT NULL AND name IS NULL)"
|
|
" OR (kind = 'own' AND name IS NOT NULL AND source_key IS NULL)"
|
|
)
|
|
_KIND_NEW = _KIND_OLD + " OR (kind = 'hub' AND name IS NULL AND source_key IS NULL)"
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.drop_constraint("ck_file_folder_kind", "file_folders", type_="check")
|
|
op.create_check_constraint("ck_file_folder_kind", "file_folders", _KIND_NEW)
|
|
op.create_index(
|
|
"uq_file_folder_hub",
|
|
"file_folders",
|
|
["user_id"],
|
|
unique=True,
|
|
postgresql_where=sa.text("kind = 'hub'"),
|
|
)
|
|
op.create_table(
|
|
"api_tokens",
|
|
sa.Column("id", sa.Integer(), primary_key=True),
|
|
sa.Column(
|
|
"user_id",
|
|
sa.Integer(),
|
|
sa.ForeignKey("users.id", ondelete="CASCADE"),
|
|
nullable=False,
|
|
index=True,
|
|
),
|
|
sa.Column("name", sa.String(80), nullable=False),
|
|
sa.Column("prefix", sa.String(16), nullable=False),
|
|
sa.Column("token_hash", sa.String(64), nullable=False, unique=True),
|
|
sa.Column("expires_at", sa.DateTime(timezone=True)),
|
|
sa.Column("last_used_at", sa.DateTime(timezone=True)),
|
|
sa.Column("expiry_warned", sa.Boolean(), nullable=False, server_default=sa.text("false")),
|
|
sa.Column(
|
|
"created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
|
|
),
|
|
)
|
|
op.create_table(
|
|
"api_token_grants",
|
|
sa.Column("id", sa.Integer(), primary_key=True),
|
|
sa.Column(
|
|
"token_id",
|
|
sa.Integer(),
|
|
sa.ForeignKey("api_tokens.id", ondelete="CASCADE"),
|
|
nullable=False,
|
|
),
|
|
sa.Column(
|
|
"folder_id",
|
|
sa.Integer(),
|
|
sa.ForeignKey("file_folders.id", ondelete="CASCADE"),
|
|
nullable=False,
|
|
index=True,
|
|
),
|
|
sa.Column("can_list", sa.Boolean(), nullable=False, server_default=sa.text("false")),
|
|
sa.Column("can_read", sa.Boolean(), nullable=False, server_default=sa.text("false")),
|
|
sa.Column("can_write", sa.Boolean(), nullable=False, server_default=sa.text("false")),
|
|
sa.Column("can_delete", sa.Boolean(), nullable=False, server_default=sa.text("false")),
|
|
sa.UniqueConstraint("token_id", "folder_id", name="uq_api_token_grant"),
|
|
sa.CheckConstraint(
|
|
"can_list OR can_read OR can_write OR can_delete", name="ck_api_token_grant_some"
|
|
),
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_table("api_token_grants")
|
|
op.drop_table("api_tokens")
|
|
op.drop_index("uq_file_folder_hub", table_name="file_folders")
|
|
# A Hub folder may hold files (their foreign key RESTRICTs a delete): it becomes an own folder,
|
|
# named "Hub <id>" — or "Hub <id> (2)", … when its user already has a folder of that name,
|
|
# which `uq_file_folder_own_name` (per user, case-blind) would refuse.
|
|
conn = op.get_bind()
|
|
hubs = conn.execute(sa.text("SELECT id, user_id FROM file_folders WHERE kind = 'hub'")).all()
|
|
for folder_id, user_id in hubs:
|
|
name, n = f"Hub {folder_id}", 1
|
|
while conn.execute(
|
|
sa.text("SELECT 1 FROM file_folders WHERE user_id = :u AND lower(name) = lower(:n)"),
|
|
{"u": user_id, "n": name},
|
|
).first():
|
|
n += 1
|
|
name = f"Hub {folder_id} ({n})"
|
|
conn.execute(
|
|
sa.text("UPDATE file_folders SET kind = 'own', name = :n WHERE id = :i"),
|
|
{"n": name, "i": folder_id},
|
|
)
|
|
op.drop_constraint("ck_file_folder_kind", "file_folders", type_="check")
|
|
op.create_check_constraint("ck_file_folder_kind", "file_folders", _KIND_OLD)
|