da86b3ae0c
API tokens: any user mints named, optionally-expiring tokens (shopdb_pat_..., sha256-stored, secret shown once) at Settings > API Tokens; a before-request shim swaps a valid PAT for a request-scoped JWT of its owner, so the entire existing auth/authz/import-mode stack works unchanged and revoked/expired tokens 401 cleanly. Built for long-running scripts - the legacy import no longer dies when a login JWT expires. Migration 7d21_apitokens; create/revoke audit-logged. Audited integration gaps fixed: Asset.to_dict serializes measuring tools (typedata + pluginid - relationship links to tools resolve); map subtype filter/colors and MapEditor include them; dashboard totals count them; warranty links use a new by-asset route; the measuringtools ADR-010 hooks are real (corrected presentation token, implemented map-overlay endpoint); the login avatar resolves through the employee-photo helper. 737 tests pass; naming green; frontend builds; both features verified live end-to-end. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
62 lines
2.1 KiB
Python
62 lines
2.1 KiB
Python
"""Personal API tokens (apitokens)
|
|
|
|
Adds the apitokens table: personal access tokens that let scripts and
|
|
integrations authenticate as a user without the hourly-expiring login JWT.
|
|
Only the sha256 hash of each secret is stored.
|
|
|
|
Idempotent guard so it is safe on a partially-migrated box; real downgrade.
|
|
|
|
Revision ID: 7d21_apitokens
|
|
Revises: 7d20_relationshiptypepropagations
|
|
Create Date: 2026-07-12
|
|
|
|
"""
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
revision = '7d21_apitokens'
|
|
down_revision = '7d20_relationshiptypepropagations'
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade():
|
|
bind = op.get_bind()
|
|
insp = sa.inspect(bind)
|
|
|
|
if 'apitokens' in insp.get_table_names():
|
|
return
|
|
|
|
op.create_table(
|
|
'apitokens',
|
|
sa.Column('tokenid', sa.Integer(), primary_key=True),
|
|
sa.Column('userid', sa.Integer(), nullable=False),
|
|
sa.Column('name', sa.String(length=100), nullable=False),
|
|
sa.Column('tokenprefix', sa.String(length=16), nullable=True),
|
|
sa.Column('tokenhash', sa.String(length=64), nullable=False),
|
|
sa.Column('expiresat', sa.DateTime(), nullable=True),
|
|
sa.Column('lastusedat', sa.DateTime(), nullable=True),
|
|
sa.Column('createddate', sa.DateTime(), nullable=False),
|
|
sa.Column('modifieddate', sa.DateTime(), nullable=False),
|
|
sa.Column('isactive', sa.Boolean(), nullable=False, server_default='1'),
|
|
sa.ForeignKeyConstraint(['userid'], ['users.userid']),
|
|
sa.UniqueConstraint('tokenhash', name='uq_apitoken_tokenhash'),
|
|
)
|
|
op.create_index('ix_apitokens_userid', 'apitokens', ['userid'])
|
|
op.create_index('ix_apitokens_tokenprefix', 'apitokens', ['tokenprefix'])
|
|
op.create_index('ix_apitokens_tokenhash', 'apitokens', ['tokenhash'])
|
|
|
|
|
|
def downgrade():
|
|
bind = op.get_bind()
|
|
insp = sa.inspect(bind)
|
|
|
|
if 'apitokens' not in insp.get_table_names():
|
|
return
|
|
|
|
op.drop_index('ix_apitokens_tokenhash', table_name='apitokens')
|
|
op.drop_index('ix_apitokens_tokenprefix', table_name='apitokens')
|
|
op.drop_index('ix_apitokens_userid', table_name='apitokens')
|
|
op.drop_table('apitokens')
|