d4b49b91b4
9845867gave it its own plugin because Tech Tools is browser-only and this needs storage. That was the right reading of the code and the wrong answer for the person using it: Tech Tools is where you go for a utility, and a tool nobody can find is a tool nobody uses. So Tech Tools now has a blueprint, a table and a migration chain where it had none. Its docstring and manifest say why, because "every tool here runs in the browser" was load-bearing documentation and is no longer true. WHAT MOVED /api/securesend -> /api/tools/secrets securesend.create -> tools.secrets securesend0001baseline -> tools0001securesend PLUGIN_TABLE_OWNERS, EXPECTED_HEAD_REVISION, EXEMPT_ENDPOINTS, the universal profile and the api-inventory surface all follow it. THE OLD "NO BACKEND" TEST IS NARROWED, NOT DELETED. It asserted get_blueprint() is None, which is the sort of guard that gets removed when it becomes inconvenient. It now asserts the blueprint serves EXACTLY the three secret routes, with their methods - so a future tool that quietly grows an endpoint or a table has to edit this test, and therefore make the decision on purpose rather than by drift. Asserting methods rather than paths also pins the detail this design turns on: redeeming is POST-ONLY. Chat and mail clients prefetch GET urls to build previews, and a preview that could redeem would consume a one-view secret before its recipient opened the link. Previously that was a comment; now it fails a test. UNINSTALLING THE OLD PLUGIN COULD NOT BE DONE WITH THE PLUGIN TOOLING. `flask plugin uninstall securesend` loads a plugin before uninstalling it, so a plugin whose directory has been deleted cannot be removed by the command that manages plugins - the registry entry had to be edited by hand. Worth fixing separately; it is the same registry-versus-code divergence the device work hit from the other side. MIGRATING A CHAIN THAT HAS ALREADY RUN needs the old table and its version row dropped first, because the relocated chain has no stamp and tries to create a table that exists. Only relevant to anyone who installed securesend during the hour it existed - it did reach the publication repo in4242028- and the fix is DROP TABLE securesendsecrets plus DROP TABLE alembic_version_securesend before running plugin upgrade-all. 1829 tests green. Still backend only: there are no pages yet, so nothing here is reachable by a person.
64 lines
2.8 KiB
Python
64 lines
2.8 KiB
Python
"""tools plugin baseline: the secure send table.
|
|
|
|
Creates the one table this plugin owns. Tech Tools was schemaless until secure
|
|
send arrived: a link that expires and dies on first read has to keep the
|
|
ciphertext somewhere until it is claimed. Not an asset extension: a shared
|
|
credential is a short-lived event rather than a thing the site inventories, so
|
|
there is no assetid and no asset type.
|
|
|
|
Explicit Alembic ops rather than the create_plugin_tables helper, matching the
|
|
backups baseline: the helper builds a per-plugin MetaData filtered to this
|
|
plugin's tables, so the foreign key to the core users table cannot resolve at
|
|
CreateTable-compile time.
|
|
"""
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
# revision identifiers, used by Alembic.
|
|
revision = 'tools0001securesend'
|
|
down_revision = None
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade():
|
|
op.create_table(
|
|
'securesendsecrets',
|
|
sa.Column('secretid', sa.Integer(), nullable=False),
|
|
# 128 bits of randomness as hex. With no login on the read side this is
|
|
# the credential, so it must never be a sequence.
|
|
sa.Column('token', sa.String(length=64), nullable=False),
|
|
sa.Column('ciphertext', sa.Text(), nullable=False),
|
|
sa.Column('iv', sa.String(length=64), nullable=False),
|
|
sa.Column('expiresat', sa.DateTime(), nullable=False),
|
|
sa.Column('viewsremaining', sa.Integer(), nullable=False,
|
|
server_default='1'),
|
|
sa.Column('createdbyuserid', sa.Integer(), nullable=True),
|
|
sa.Column('lastviewedat', sa.DateTime(), nullable=True),
|
|
sa.Column('viewcount', sa.Integer(), nullable=False, server_default='0'),
|
|
sa.Column('createddate', sa.DateTime(), nullable=False),
|
|
sa.Column('modifieddate', sa.DateTime(), nullable=False),
|
|
sa.Column('isactive', sa.Boolean(), nullable=False,
|
|
server_default=sa.true()),
|
|
sa.ForeignKeyConstraint(['createdbyuserid'], ['users.userid'],
|
|
ondelete='SET NULL'),
|
|
sa.PrimaryKeyConstraint('secretid'),
|
|
)
|
|
# Unique, because the token is looked up on every read and two rows sharing
|
|
# one would make a link ambiguous.
|
|
op.create_index('ixsecuresendsecretstoken', 'securesendsecrets',
|
|
['token'], unique=True)
|
|
# Expiry sweeps scan on this.
|
|
op.create_index('ixsecuresendsecretsexpiresat', 'securesendsecrets',
|
|
['expiresat'])
|
|
op.create_index('ixsecuresendsecretscreatedby', 'securesendsecrets',
|
|
['createdbyuserid'])
|
|
|
|
|
|
def downgrade():
|
|
op.drop_index('ixsecuresendsecretscreatedby', table_name='securesendsecrets')
|
|
op.drop_index('ixsecuresendsecretsexpiresat', table_name='securesendsecrets')
|
|
op.drop_index('ixsecuresendsecretstoken', table_name='securesendsecrets')
|
|
op.drop_table('securesendsecrets')
|