64 lines
2.4 KiB
Python
64 lines
2.4 KiB
Python
|
"""Sessions people can see and end.
|
||
|
|
|
||
|
|
Revocation lived only in a Redis blacklist. Three problems with that: it failed
|
||
|
|
open, because a Redis outage made the check log a warning and accept the token;
|
||
|
|
it did not survive a flush, so revoked tokens came back; and nothing recorded a
|
||
|
|
session at all, so nobody could be shown where they were signed in.
|
||
|
|
|
||
|
|
Revision ID: e5a7b9c1d003
|
||
|
|
Revises: d4f6a8b0c902
|
||
|
|
"""
|
||
|
|
|
||
|
|
from typing import Sequence, Union
|
||
|
|
|
||
|
|
import sqlalchemy as sa
|
||
|
|
from alembic import op
|
||
|
|
from sqlalchemy.dialects.postgresql import INET, UUID
|
||
|
|
|
||
|
|
revision: str = "e5a7b9c1d003"
|
||
|
|
down_revision: Union[str, Sequence[str], None] = "d4f6a8b0c902"
|
||
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
||
|
|
depends_on: Union[str, Sequence[str], None] = None
|
||
|
|
|
||
|
|
|
||
|
|
def upgrade() -> None:
|
||
|
|
op.create_table(
|
||
|
|
"user_sessions",
|
||
|
|
sa.Column(
|
||
|
|
"id", UUID(as_uuid=True), primary_key=True,
|
||
|
|
server_default=sa.text("gen_random_uuid()"),
|
||
|
|
),
|
||
|
|
sa.Column(
|
||
|
|
"user_id", UUID(as_uuid=True),
|
||
|
|
sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False,
|
||
|
|
),
|
||
|
|
sa.Column("tenant_id", UUID(as_uuid=True), nullable=True),
|
||
|
|
sa.Column("current_jti", UUID(as_uuid=True), nullable=False, unique=True),
|
||
|
|
sa.Column("previous_jti", UUID(as_uuid=True), nullable=True),
|
||
|
|
sa.Column("user_agent", sa.String(512), nullable=True),
|
||
|
|
sa.Column("ip_address", INET(), nullable=True),
|
||
|
|
sa.Column(
|
||
|
|
"created_at", sa.DateTime(timezone=True), nullable=False,
|
||
|
|
server_default=sa.func.now(),
|
||
|
|
),
|
||
|
|
sa.Column(
|
||
|
|
"last_used_at", sa.DateTime(timezone=True), nullable=False,
|
||
|
|
server_default=sa.func.now(),
|
||
|
|
),
|
||
|
|
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
||
|
|
sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
|
||
|
|
sa.Column("revoked_reason", sa.String(40), nullable=True),
|
||
|
|
)
|
||
|
|
op.create_index("ix_user_sessions_user", "user_sessions", ["user_id"])
|
||
|
|
op.create_index("ix_user_sessions_previous_jti", "user_sessions", ["previous_jti"])
|
||
|
|
op.create_index(
|
||
|
|
"ix_user_sessions_live", "user_sessions", ["revoked_at", "expires_at"]
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def downgrade() -> None:
|
||
|
|
op.drop_index("ix_user_sessions_live", table_name="user_sessions")
|
||
|
|
op.drop_index("ix_user_sessions_previous_jti", table_name="user_sessions")
|
||
|
|
op.drop_index("ix_user_sessions_user", table_name="user_sessions")
|
||
|
|
op.drop_table("user_sessions")
|