Algis DumbrisandClaude Opus 4.6
1cb0bb7a8f
- Human Auth: OAuth 2.1 with fosite, user registration, sessions, PKCE - Channels: public/private channels, membership, broadcast, MCP tools - Trace Logging: enhanced traces, REST API, metrics, retention cleanup - Fixed migration numbering: channels=002, trace=003, auth=004 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
2.1 KiB
SQL
52 lines
2.1 KiB
SQL
-- Auth schema extensions for OAuth 2.1
|
|
-- Adds role to users, extends oauth_clients, creates session and auth code tables
|
|
|
|
-- Add role column to users table
|
|
ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'user' CHECK (role IN ('user', 'admin'));
|
|
|
|
-- Add scopes and owner_id columns to oauth_clients
|
|
ALTER TABLE oauth_clients ADD COLUMN scopes TEXT NOT NULL DEFAULT '[]';
|
|
ALTER TABLE oauth_clients ADD COLUMN owner_id INTEGER REFERENCES users(id);
|
|
|
|
-- Web UI sessions
|
|
CREATE TABLE IF NOT EXISTS sessions (
|
|
session_id TEXT PRIMARY KEY,
|
|
user_id INTEGER NOT NULL REFERENCES users(id),
|
|
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
expires_at TIMESTAMP NOT NULL,
|
|
last_active_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE INDEX idx_sessions_user ON sessions(user_id);
|
|
CREATE INDEX idx_sessions_expires ON sessions(expires_at);
|
|
|
|
-- OAuth authorization codes
|
|
CREATE TABLE IF NOT EXISTS oauth_authorization_codes (
|
|
code TEXT PRIMARY KEY,
|
|
client_id TEXT NOT NULL,
|
|
user_id INTEGER NOT NULL REFERENCES users(id),
|
|
redirect_uri TEXT NOT NULL,
|
|
scopes TEXT NOT NULL DEFAULT '',
|
|
code_challenge TEXT NOT NULL DEFAULT '',
|
|
code_challenge_method TEXT NOT NULL DEFAULT '',
|
|
session_data TEXT NOT NULL DEFAULT '{}',
|
|
expires_at TIMESTAMP NOT NULL,
|
|
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
used INTEGER NOT NULL DEFAULT 0
|
|
);
|
|
|
|
CREATE INDEX idx_oauth_auth_codes_client ON oauth_authorization_codes(client_id);
|
|
|
|
-- Extend oauth_tokens: add token_type, session_data, consumed, parent_signature
|
|
ALTER TABLE oauth_tokens ADD COLUMN token_type TEXT NOT NULL DEFAULT 'access';
|
|
ALTER TABLE oauth_tokens ADD COLUMN session_data TEXT NOT NULL DEFAULT '{}';
|
|
ALTER TABLE oauth_tokens ADD COLUMN consumed INTEGER NOT NULL DEFAULT 0;
|
|
ALTER TABLE oauth_tokens ADD COLUMN parent_signature TEXT;
|
|
ALTER TABLE oauth_tokens ADD COLUMN signature TEXT;
|
|
|
|
CREATE INDEX idx_oauth_tokens_signature ON oauth_tokens(signature);
|
|
CREATE INDEX idx_oauth_tokens_type ON oauth_tokens(token_type);
|
|
CREATE INDEX idx_oauth_tokens_parent ON oauth_tokens(parent_signature);
|
|
|
|
INSERT INTO schema_migrations (version) VALUES (4);
|