hzhang
54b6103880
- Generic OIDC (Authlib discovery) Authorization Code flow; backend
issues the existing HS256 JWT on success. Unbound identities are
rejected (no auto-provisioning).
- User.oidc_issuer/oidc_subject (unique together) + startup migration.
- PUT/DELETE /users/{id}/oidc-binding (admin or account-manager;
JWT or API key; 409 on conflict). Self-link /auth/oidc/link
(non-OIDC_ONLY only). Public GET /auth/config.
- HARBORFORGE_OIDC_ONLY: /auth/token rejected, create/update ignore
password (passwordless users; API keys + OIDC still work).
- Dockerfile ARG/ENV HARBORFORGE_OIDC_ONLY; authlib+itsdangerous deps;
SessionMiddleware for OIDC state. Fixed _user_response to expose
the new binding fields.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
118 lines
4.2 KiB
Python
118 lines
4.2 KiB
Python
from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey, Enum, Boolean, JSON, Time, UniqueConstraint
|
|
from sqlalchemy.orm import relationship
|
|
from sqlalchemy.sql import func
|
|
from app.core.config import Base
|
|
from app.models.role_permission import Role
|
|
import enum
|
|
|
|
|
|
class TaskType(str, enum.Enum):
|
|
"""Task type enum."""
|
|
ISSUE = "issue"
|
|
MAINTENANCE = "maintenance"
|
|
RESEARCH = "research"
|
|
REVIEW = "review"
|
|
STORY = "story"
|
|
TEST = "test"
|
|
RESOLUTION = "resolution"
|
|
|
|
|
|
class TaskStatus(str, enum.Enum):
|
|
OPEN = "open"
|
|
PENDING = "pending"
|
|
UNDERGOING = "undergoing"
|
|
COMPLETED = "completed"
|
|
CLOSED = "closed"
|
|
|
|
|
|
class TaskPriority(str, enum.Enum):
|
|
LOW = "low"
|
|
MEDIUM = "medium"
|
|
HIGH = "high"
|
|
CRITICAL = "critical"
|
|
|
|
|
|
class Comment(Base):
|
|
__tablename__ = "comments"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
content = Column(Text, nullable=False)
|
|
task_id = Column(Integer, ForeignKey("tasks.id"), nullable=False)
|
|
author_id = Column(Integer, ForeignKey("users.id"), nullable=False)
|
|
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
|
updated_at = Column(DateTime(timezone=True), onupdate=func.now())
|
|
|
|
author = relationship("User", back_populates="comments")
|
|
|
|
|
|
class Project(Base):
|
|
__tablename__ = "projects"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
name = Column(String(100), unique=True, nullable=False)
|
|
project_code = Column(String(16), unique=True, index=True, nullable=True)
|
|
owner_name = Column(String(128), nullable=False)
|
|
sub_projects = Column(String(512), nullable=True)
|
|
related_projects = Column(String(512), nullable=True)
|
|
repo = Column(String(512), nullable=True)
|
|
description = Column(Text, nullable=True)
|
|
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
|
|
|
owner_id = Column(Integer, ForeignKey("users.id"), nullable=False)
|
|
|
|
members = relationship("ProjectMember", back_populates="project", cascade="all, delete-orphan")
|
|
owner = relationship("User", back_populates="owned_projects")
|
|
|
|
|
|
class User(Base):
|
|
__tablename__ = "users"
|
|
__table_args__ = (
|
|
UniqueConstraint("oidc_issuer", "oidc_subject", name="uq_users_oidc_identity"),
|
|
)
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
username = Column(String(50), unique=True, nullable=False)
|
|
email = Column(String(100), unique=True, nullable=False)
|
|
hashed_password = Column(String(255), nullable=True)
|
|
full_name = Column(String(100), nullable=True)
|
|
discord_user_id = Column(String(32), nullable=True)
|
|
# OIDC binding: an hf user is linked to at most one external OIDC identity
|
|
# (issuer + subject). Unique together so one IdP identity maps to one user.
|
|
oidc_issuer = Column(String(255), nullable=True)
|
|
oidc_subject = Column(String(255), nullable=True)
|
|
is_active = Column(Boolean, default=True)
|
|
is_admin = Column(Boolean, default=False)
|
|
role_id = Column(Integer, ForeignKey("roles.id"), nullable=True)
|
|
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
|
|
|
role = relationship("Role", foreign_keys=[role_id])
|
|
owned_projects = relationship("Project", back_populates="owner")
|
|
comments = relationship("Comment", back_populates="author")
|
|
project_memberships = relationship("ProjectMember", back_populates="user")
|
|
agent = relationship("Agent", back_populates="user", uselist=False)
|
|
|
|
@property
|
|
def role_name(self):
|
|
return self.role.name if self.role else None
|
|
|
|
|
|
class ProjectMember(Base):
|
|
__tablename__ = "project_members"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
project_id = Column(Integer, ForeignKey("projects.id"), nullable=False)
|
|
user_id = Column(Integer, ForeignKey("users.id"), nullable=False)
|
|
role_id = Column(Integer, ForeignKey("roles.id"), nullable=False)
|
|
role = relationship("Role")
|
|
|
|
project = relationship("Project", back_populates="members")
|
|
user = relationship("User", back_populates="project_memberships")
|
|
|
|
|
|
class ProjectCodeCounter(Base):
|
|
__tablename__ = "project_code_counters"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
prefix = Column(String(16), unique=True, index=True, nullable=False)
|
|
next_value = Column(Integer, default=0)
|