feat(mcp): sqlc queries for mcp_tokens (CRUD + revoke + reaper + purge)

2026-05-08 07:07:47 +08:00
parent 6e43792bd6
commit 39f57df882
4 changed files with 715 additions and 0 deletions
@@ -0,0 +1,82 @@
+-- name: CreateMcpToken :one
+INSERT INTO mcp_tokens (
+  id, token_hash, user_id, name, issuer, scope,
+  acp_session_id, expires_at, created_by
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+RETURNING id, token_hash, user_id, name, issuer, scope,
+          acp_session_id, expires_at, last_used_at, revoked_at,
+          created_by, created_at;
+
+-- name: GetMcpTokenByHash :one
+SELECT id, token_hash, user_id, name, issuer, scope,
+       acp_session_id, expires_at, last_used_at, revoked_at,
+       created_by, created_at
+FROM mcp_tokens
+WHERE token_hash = $1;
+
+-- name: GetMcpTokenByID :one
+SELECT id, token_hash, user_id, name, issuer, scope,
+       acp_session_id, expires_at, last_used_at, revoked_at,
+       created_by, created_at
+FROM mcp_tokens
+WHERE id = $1;
+
+-- name: ListMcpTokens :many
+-- ListMcpTokens：admin 看全部；普通 user 看自己持有的 admin-issued。
+-- callerUserID 为 NULL 表示 admin（不过滤）；非空表示按 (user_id=$1 AND issuer='admin') 过滤。
+-- activeOnly=true 时排除已撤销 / 已过期。
+SELECT id, token_hash, user_id, name, issuer, scope,
+       acp_session_id, expires_at, last_used_at, revoked_at,
+       created_by, created_at
+FROM mcp_tokens
+WHERE
+  (sqlc.narg('caller_user_id')::uuid IS NULL
+   OR (user_id = sqlc.narg('caller_user_id')::uuid AND issuer = 'admin'))
+  AND
+  (NOT sqlc.arg('active_only')::boolean
+   OR (revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())))
+ORDER BY created_at DESC;
+
+-- name: UpdateMcpTokenLastUsed :exec
+UPDATE mcp_tokens
+   SET last_used_at = now()
+ WHERE id = $1;
+
+-- name: RevokeMcpToken :one
+UPDATE mcp_tokens
+   SET revoked_at = now()
+ WHERE id = $1 AND revoked_at IS NULL
+RETURNING id;
+
+-- name: RevokeMcpTokensBySession :many
+-- 给定一个 ACP session 的 ID，把所有引用该 session 的 system token 一次性撤销。
+-- 返回已撤销的 token id 列表（用于 audit 写入逐条）。
+UPDATE mcp_tokens
+   SET revoked_at = now()
+ WHERE acp_session_id = $1
+   AND issuer = 'system'
+   AND revoked_at IS NULL
+RETURNING id;
+
+-- name: ReapStaleSystemTokens :many
+-- 启动期 reaper：所有 system token 中，关联的 acp_sessions 已经是 crashed/exited 的，全部撤销。
+-- ACP 自身的 reaper 必须先把 starting/running 残留转为 crashed，本 query 才能命中。
+UPDATE mcp_tokens t
+   SET revoked_at = now()
+  FROM acp_sessions s
+ WHERE t.acp_session_id = s.id
+   AND t.issuer = 'system'
+   AND t.revoked_at IS NULL
+   AND s.status IN ('crashed','exited')
+RETURNING t.id;
+
+-- name: PurgeMcpTokensExpired :execrows
+-- 后台 jobs runner 用：删 expires_at + retention 之前 / revoked_at + retention 之前的 row。
+-- 单条 query 用 OR 条件，retention 同一份。
+DELETE FROM mcp_tokens
+ WHERE (expires_at IS NOT NULL AND expires_at < $1)
+    OR (revoked_at IS NOT NULL AND revoked_at < $1);
+
+-- name: DeleteMcpTokenByID :exec
+-- 仅供测试用（生产不允许直接物理删；走撤销）。
+DELETE FROM mcp_tokens WHERE id = $1;