Cam Proudlock
a9d0dfff4a
Flask + Vue rewrite of the classic-ASP shopdb, built as a plugin framework so sister GE Aerospace sites can adopt it. Product version 0.7.0-pre-0.8.0, plugin contract 0.11.0, 966 backend tests. Key entry points: - docs/INSTALL-WINDOWS-IIS.md - tested Windows + IIS install runbook (own-site and subpath deployment methods) - docs/PILOT-DEPLOY.md - production pilot: stand up + import + verify - docs/IMPORT-API.md - schema-agnostic legacy data import contract - scripts/site_imports/wjf/ - West Jefferson reference import loader - docs/adr/ - twelve accepted architecture decision records
50 lines
1.3 KiB
Python
50 lines
1.3 KiB
Python
"""API token permission scopes (apitokens.scopes)
|
|
|
|
Adds a nullable scopes column to apitokens: a JSON array of permission-name
|
|
strings. NULL means the token is unscoped and acts with the full authority of
|
|
its owner (the original behavior). A scoped token grants ONLY the listed
|
|
permissions, intersected with what the owner actually holds, and suspends the
|
|
admin-role bypass so a scoped token minted by an admin is genuinely limited.
|
|
|
|
Idempotent guard so it is safe on a partially-migrated box; real downgrade.
|
|
|
|
Revision ID: 7d22_apitokens_scopes
|
|
Revises: 7d21_apitokens
|
|
Create Date: 2026-07-12
|
|
|
|
"""
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
revision = '7d22_apitokens_scopes'
|
|
down_revision = '7d21_apitokens'
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade():
|
|
bind = op.get_bind()
|
|
insp = sa.inspect(bind)
|
|
|
|
if 'apitokens' not in insp.get_table_names():
|
|
return
|
|
columns = {c['name'] for c in insp.get_columns('apitokens')}
|
|
if 'scopes' in columns:
|
|
return
|
|
|
|
op.add_column('apitokens', sa.Column('scopes', sa.Text(), nullable=True))
|
|
|
|
|
|
def downgrade():
|
|
bind = op.get_bind()
|
|
insp = sa.inspect(bind)
|
|
|
|
if 'apitokens' not in insp.get_table_names():
|
|
return
|
|
columns = {c['name'] for c in insp.get_columns('apitokens')}
|
|
if 'scopes' not in columns:
|
|
return
|
|
|
|
op.drop_column('apitokens', 'scopes')
|