Senko-san
7a17e3babd
Subsonic auth (t=md5(password+salt), legacy p=) needs a recoverable secret, but login passwords are stored as a one-way argon2 hash. Add a separate, per-user app-password: high-entropy, random, and encrypted at rest with a Fernet key derived from SUBSONIC_SECRET_KEY (never stored in the DB). - SubsonicPasswordCipher + generate_subsonic_password in core.security - users.subsonic_password_enc column (+ Alembic migration), repo + port methods - SubsonicAuthService: verify (t+s / p / p=enc:) and rotate/reveal lifecycle - self-service GET/POST /users/me/subsonic-password + admin rotate endpoint - domain SubsonicCredentials + SubsonicCipher port; deps wiring Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
49 lines
2.0 KiB
Python
49 lines
2.0 KiB
Python
"""ORM models for users and refresh tokens."""
|
|
|
|
import datetime as dt
|
|
import uuid
|
|
|
|
from sqlalchemy import Boolean, DateTime, ForeignKey, String
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
|
|
from app.infrastructure.db.base import Base
|
|
from app.infrastructure.db.models.mixins import TimestampMixin, UUIDPrimaryKeyMixin
|
|
|
|
|
|
class UserModel(UUIDPrimaryKeyMixin, TimestampMixin, Base):
|
|
__tablename__ = "users"
|
|
|
|
username: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
|
|
password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
# Admin is a single flag in Phase 1 — no role system (plan §3.5).
|
|
is_superuser: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
|
|
is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
|
|
# Recoverable Subsonic app-password, Fernet-encrypted at rest. NULL until the
|
|
# user generates one. Never the argon2 login password — see core.security.
|
|
subsonic_password_enc: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
|
|
|
|
|
class RefreshTokenModel(UUIDPrimaryKeyMixin, Base):
|
|
"""A persisted, revocable refresh token (offline-first sessions).
|
|
|
|
Stores only a *hash* of the token, never the raw JWT. Rotated on every
|
|
refresh (old jti revoked, new row added); logout revokes the current jti.
|
|
"""
|
|
|
|
__tablename__ = "refresh_tokens"
|
|
|
|
user_id: Mapped[uuid.UUID] = mapped_column(
|
|
ForeignKey("users.id", ondelete="CASCADE"),
|
|
index=True,
|
|
nullable=False,
|
|
)
|
|
jti: Mapped[uuid.UUID] = mapped_column(unique=True, index=True, nullable=False)
|
|
token_hash: Mapped[str] = mapped_column(String(64), nullable=False)
|
|
expires_at: Mapped[dt.datetime] = mapped_column(DateTime(timezone=True), nullable=False)
|
|
revoked_at: Mapped[dt.datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
|
|
created_at: Mapped[dt.datetime] = mapped_column(
|
|
DateTime(timezone=True),
|
|
default=lambda: dt.datetime.now(dt.UTC),
|
|
nullable=False,
|
|
)
|