From f9f5c15345d4ff304c94c289b341312b6b52fc8b Mon Sep 17 00:00:00 2001
From: Jerry Yan <792602257@qq.com>
Date: Fri, 8 May 2026 07:03:24 +0800
Subject: [PATCH] =?UTF-8?q?feat(mcp):=20add=20migration=200007=20up=20?=
 =?UTF-8?q?=E2=80=94=20mcp=5Ftokens=20table?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 migrations/0007_mcp.up.sql | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 migrations/0007_mcp.up.sql

diff --git a/migrations/0007_mcp.up.sql b/migrations/0007_mcp.up.sql
new file mode 100644
index 0000000..4fac12f
--- /dev/null
+++ b/migrations/0007_mcp.up.sql
@@ -0,0 +1,22 @@
+-- ============ MCP Tokens ============
+CREATE TABLE mcp_tokens (
+  id              UUID PRIMARY KEY,
+  token_hash      BYTEA UNIQUE NOT NULL,                                -- SHA-256(opaque token)
+  user_id         UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name            TEXT NOT NULL,
+  issuer          TEXT NOT NULL,
+  scope           JSONB NOT NULL DEFAULT '{}'::jsonb,                   -- {"tools": [...] | null, "project_ids": [...] | null}
+  acp_session_id  UUID REFERENCES acp_sessions(id) ON DELETE CASCADE,   -- 仅 issuer='system' 填
+  expires_at      TIMESTAMPTZ,                                          -- NULL = 永不过期
+  last_used_at    TIMESTAMPTZ,
+  revoked_at      TIMESTAMPTZ,
+  created_by      UUID NOT NULL REFERENCES users(id),
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  CONSTRAINT mcp_tokens_issuer_check CHECK (issuer IN ('system','admin')),
+  CONSTRAINT mcp_tokens_system_session_required CHECK
+    ((issuer='system' AND acp_session_id IS NOT NULL) OR
+     (issuer='admin'  AND acp_session_id IS NULL))
+);
+CREATE INDEX idx_mcp_tokens_user_active ON mcp_tokens(user_id) WHERE revoked_at IS NULL;
+CREATE INDEX idx_mcp_tokens_session     ON mcp_tokens(acp_session_id) WHERE acp_session_id IS NOT NULL;
+CREATE INDEX idx_mcp_tokens_expires     ON mcp_tokens(expires_at) WHERE revoked_at IS NULL;