feat(cloud-console): add user authentication and administration

2026-07-13 17:54:53 +08:00
parent 035b177128
commit cdef630e67
35 changed files with 4126 additions and 113 deletions
@@ -1,6 +1,14 @@
 from __future__ import annotations

-from sqlalchemy import Index, Integer, String, Text, UniqueConstraint, text
+from sqlalchemy import (
+    ForeignKey,
+    Index,
+    Integer,
+    String,
+    Text,
+    UniqueConstraint,
+    text,
+)
 from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column


@@ -125,3 +133,85 @@ class PluginRow(Base):
    entry_point_kind: Mapped[str] = mapped_column(String, nullable=False)
    target: Mapped[str] = mapped_column(String, nullable=False)
    wired: Mapped[int] = mapped_column(Integer, nullable=False)
+
+
+class UserRow(Base):
+    __tablename__ = "cloud_users"
+    __table_args__ = (
+        UniqueConstraint("username_normalized", name="uq_cloud_users_username_normalized"),
+        Index("ix_cloud_users_enabled_role", "enabled", "role"),
+    )
+
+    id: Mapped[str] = mapped_column(String, primary_key=True)
+    username: Mapped[str] = mapped_column(String, nullable=False)
+    username_normalized: Mapped[str] = mapped_column(String, nullable=False)
+    display_name: Mapped[str] = mapped_column(String, nullable=False)
+    password_hash: Mapped[str] = mapped_column(Text, nullable=False)
+    role: Mapped[str] = mapped_column(String, nullable=False)
+    enabled: Mapped[int] = mapped_column(Integer, nullable=False, default=1, server_default=text("1"))
+    must_change_password: Mapped[int] = mapped_column(
+        Integer,
+        nullable=False,
+        default=0,
+        server_default=text("0"),
+    )
+    authentication_version: Mapped[int] = mapped_column(
+        Integer,
+        nullable=False,
+        default=1,
+        server_default=text("1"),
+    )
+    created_at: Mapped[str] = mapped_column(String, nullable=False)
+    updated_at: Mapped[str] = mapped_column(String, nullable=False)
+    last_login_at: Mapped[str | None] = mapped_column(String, nullable=True)
+
+
+class UserSessionRow(Base):
+    __tablename__ = "cloud_user_sessions"
+    __table_args__ = (
+        UniqueConstraint("token_digest", name="uq_cloud_user_sessions_token_digest"),
+        Index("ix_cloud_user_sessions_user_id", "user_id"),
+        Index("ix_cloud_user_sessions_absolute_expires_at", "absolute_expires_at"),
+    )
+
+    id: Mapped[str] = mapped_column(String, primary_key=True)
+    user_id: Mapped[str] = mapped_column(
+        ForeignKey("cloud_users.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    token_digest: Mapped[str] = mapped_column(String, nullable=False)
+    csrf_digest: Mapped[str] = mapped_column(String, nullable=False)
+    authentication_version: Mapped[int] = mapped_column(Integer, nullable=False)
+    issued_at: Mapped[str] = mapped_column(String, nullable=False)
+    last_seen_at: Mapped[str] = mapped_column(String, nullable=False)
+    idle_expires_at: Mapped[str] = mapped_column(String, nullable=False)
+    absolute_expires_at: Mapped[str] = mapped_column(String, nullable=False)
+    revoked_at: Mapped[str | None] = mapped_column(String, nullable=True)
+
+
+class LoginThrottleRow(Base):
+    __tablename__ = "cloud_login_throttles"
+
+    username_normalized: Mapped[str] = mapped_column(String, primary_key=True)
+    client_bucket: Mapped[str] = mapped_column(String, primary_key=True)
+    failure_count: Mapped[int] = mapped_column(Integer, nullable=False)
+    window_started_at: Mapped[str] = mapped_column(String, nullable=False)
+    last_attempt_at: Mapped[str] = mapped_column(String, nullable=False)
+    blocked_until: Mapped[str | None] = mapped_column(String, nullable=True)
+
+
+class AuthAuditRow(Base):
+    __tablename__ = "cloud_auth_audit_events"
+    __table_args__ = (
+        Index("ix_cloud_auth_audit_events_occurred_at", "occurred_at"),
+        Index("ix_cloud_auth_audit_events_target_user_id", "target_user_id"),
+    )
+
+    id: Mapped[str] = mapped_column(String, primary_key=True)
+    occurred_at: Mapped[str] = mapped_column(String, nullable=False)
+    actor_principal_id: Mapped[str | None] = mapped_column(String, nullable=True)
+    target_user_id: Mapped[str | None] = mapped_column(String, nullable=True)
+    action: Mapped[str] = mapped_column(String, nullable=False)
+    outcome: Mapped[str] = mapped_column(String, nullable=False)
+    correlation_id: Mapped[str | None] = mapped_column(String, nullable=True)
+    metadata_json: Mapped[str] = mapped_column(Text, nullable=False, default="{}")