feat(cloud-console): add user authentication and administration

2026-07-13 17:54:53 +08:00
parent 035b177128
commit cdef630e67
35 changed files with 4126 additions and 113 deletions
@@ -0,0 +1,147 @@
+"""Add persistent Cloud Console user authentication state."""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0003_cloud_user_authentication"
+down_revision = "0002_edge_host_enrollment"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    inspector = sa.inspect(op.get_bind())
+    tables = set(inspector.get_table_names())
+    if "cloud_users" not in tables:
+        op.create_table(
+            "cloud_users",
+            sa.Column("id", sa.String(), primary_key=True),
+            sa.Column("username", sa.String(), nullable=False),
+            sa.Column("username_normalized", sa.String(), nullable=False),
+            sa.Column("display_name", sa.String(), nullable=False),
+            sa.Column("password_hash", sa.Text(), nullable=False),
+            sa.Column("role", sa.String(), nullable=False),
+            sa.Column("enabled", sa.Integer(), nullable=False, server_default=sa.text("1")),
+            sa.Column(
+                "must_change_password",
+                sa.Integer(),
+                nullable=False,
+                server_default=sa.text("0"),
+            ),
+            sa.Column(
+                "authentication_version",
+                sa.Integer(),
+                nullable=False,
+                server_default=sa.text("1"),
+            ),
+            sa.Column("created_at", sa.String(), nullable=False),
+            sa.Column("updated_at", sa.String(), nullable=False),
+            sa.Column("last_login_at", sa.String(), nullable=True),
+            sa.UniqueConstraint(
+                "username_normalized",
+                name="uq_cloud_users_username_normalized",
+            ),
+        )
+        op.create_index(
+            "ix_cloud_users_enabled_role",
+            "cloud_users",
+            ["enabled", "role"],
+        )
+    if "cloud_user_sessions" not in tables:
+        op.create_table(
+            "cloud_user_sessions",
+            sa.Column("id", sa.String(), primary_key=True),
+            sa.Column(
+                "user_id",
+                sa.String(),
+                sa.ForeignKey("cloud_users.id", ondelete="CASCADE"),
+                nullable=False,
+            ),
+            sa.Column("token_digest", sa.String(), nullable=False),
+            sa.Column("csrf_digest", sa.String(), nullable=False),
+            sa.Column("authentication_version", sa.Integer(), nullable=False),
+            sa.Column("issued_at", sa.String(), nullable=False),
+            sa.Column("last_seen_at", sa.String(), nullable=False),
+            sa.Column("idle_expires_at", sa.String(), nullable=False),
+            sa.Column("absolute_expires_at", sa.String(), nullable=False),
+            sa.Column("revoked_at", sa.String(), nullable=True),
+            sa.UniqueConstraint(
+                "token_digest",
+                name="uq_cloud_user_sessions_token_digest",
+            ),
+        )
+        op.create_index(
+            "ix_cloud_user_sessions_user_id",
+            "cloud_user_sessions",
+            ["user_id"],
+        )
+        op.create_index(
+            "ix_cloud_user_sessions_absolute_expires_at",
+            "cloud_user_sessions",
+            ["absolute_expires_at"],
+        )
+    if "cloud_login_throttles" not in tables:
+        op.create_table(
+            "cloud_login_throttles",
+            sa.Column("username_normalized", sa.String(), primary_key=True),
+            sa.Column("client_bucket", sa.String(), primary_key=True),
+            sa.Column("failure_count", sa.Integer(), nullable=False),
+            sa.Column("window_started_at", sa.String(), nullable=False),
+            sa.Column("last_attempt_at", sa.String(), nullable=False),
+            sa.Column("blocked_until", sa.String(), nullable=True),
+        )
+    if "cloud_auth_audit_events" not in tables:
+        op.create_table(
+            "cloud_auth_audit_events",
+            sa.Column("id", sa.String(), primary_key=True),
+            sa.Column("occurred_at", sa.String(), nullable=False),
+            sa.Column("actor_principal_id", sa.String(), nullable=True),
+            sa.Column("target_user_id", sa.String(), nullable=True),
+            sa.Column("action", sa.String(), nullable=False),
+            sa.Column("outcome", sa.String(), nullable=False),
+            sa.Column("correlation_id", sa.String(), nullable=True),
+            sa.Column("metadata_json", sa.Text(), nullable=False, server_default=sa.text("'{}'")),
+        )
+        op.create_index(
+            "ix_cloud_auth_audit_events_occurred_at",
+            "cloud_auth_audit_events",
+            ["occurred_at"],
+        )
+        op.create_index(
+            "ix_cloud_auth_audit_events_target_user_id",
+            "cloud_auth_audit_events",
+            ["target_user_id"],
+        )
+
+
+def downgrade() -> None:
+    inspector = sa.inspect(op.get_bind())
+    tables = set(inspector.get_table_names())
+    if "cloud_auth_audit_events" in tables:
+        op.drop_index(
+            "ix_cloud_auth_audit_events_target_user_id",
+            table_name="cloud_auth_audit_events",
+        )
+        op.drop_index(
+            "ix_cloud_auth_audit_events_occurred_at",
+            table_name="cloud_auth_audit_events",
+        )
+        op.drop_table("cloud_auth_audit_events")
+    if "cloud_login_throttles" in tables:
+        op.drop_table("cloud_login_throttles")
+    if "cloud_user_sessions" in tables:
+        op.drop_index(
+            "ix_cloud_user_sessions_absolute_expires_at",
+            table_name="cloud_user_sessions",
+        )
+        op.drop_index(
+            "ix_cloud_user_sessions_user_id",
+            table_name="cloud_user_sessions",
+        )
+        op.drop_table("cloud_user_sessions")
+    if "cloud_users" in tables:
+        op.drop_index("ix_cloud_users_enabled_role", table_name="cloud_users")
+        op.drop_table("cloud_users")