dhkatzandClaude Opus 5.5
2b88a52bcb
Tokens for scripts, made, listed and revoked on the account page. Each grants some of the person's own permissions at chosen places (a product of theirs, a catalog whose team they're on, or the hub for moderators); every check is the intersection with what they hold now. Tokens work only on routes that check a permission (session-only routes answer token_not_allowed), are shown once and stored as hashes, note their last use, and mark the audit entries of what they do. Co-Authored-By: Claude Opus 5.5 <[email protected]>
15 lines
736 B
SQL
15 lines
736 B
SQL
CREATE TABLE "api_token" (
|
|
"id" text PRIMARY KEY NOT NULL,
|
|
"user_id" text NOT NULL,
|
|
"name" text NOT NULL,
|
|
"hash" text NOT NULL,
|
|
"grants" jsonb NOT NULL,
|
|
"expires_at" timestamp with time zone NOT NULL,
|
|
"last_used_at" timestamp with time zone,
|
|
"created_at" timestamp with time zone DEFAULT now() NOT NULL,
|
|
"revoked_at" timestamp with time zone
|
|
);
|
|
--> statement-breakpoint
|
|
ALTER TABLE "api_token" ADD CONSTRAINT "api_token_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
|
|
CREATE UNIQUE INDEX "api_token_hash" ON "api_token" USING btree ("hash");--> statement-breakpoint
|
|
CREATE INDEX "api_token_user" ON "api_token" USING btree ("user_id"); |