吉鑫升andClaude Opus 4.8
a417124c21
- approved 放行标记默认 True:新账号首次登录即放行,登录白名单开关打开时只拦截 被管理员显式「取消放行」(approved=False) 的用户;enforce_user_approved 放在 各登录端点拿到 user 后、签发 JWT 前调用,admin 永远放行。 - 同步调整 LoginWhitelistPage / local_provider / models / system_settings / 迁移 20260625_02 / user model / column_additions_mysql.sql 与 CLAUDE.md。 - 更新 backend/backend.zip 构建产物。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
73 lines
3.1 KiB
Python
73 lines
3.1 KiB
Python
"""ORM model for the users table.
|
|
|
|
Lives in the harness persistence package so it is picked up by
|
|
``Base.metadata.create_all()`` alongside ``threads_meta``, ``runs``,
|
|
``run_events``, and ``feedback``. Using the shared engine means:
|
|
|
|
- One SQLite/Postgres database, one connection pool
|
|
- One schema initialisation codepath
|
|
- Consistent async sessions across auth and persistence reads
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import UTC, datetime
|
|
|
|
from sqlalchemy import Boolean, Index, String, text
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
|
|
from deerflow.persistence.base import Base
|
|
from deerflow.persistence.types import BeijingDateTime
|
|
|
|
|
|
class UserRow(Base):
|
|
__tablename__ = "users"
|
|
|
|
# UUIDs are stored as 36-char strings for cross-backend portability.
|
|
id: Mapped[str] = mapped_column(String(36), primary_key=True)
|
|
|
|
email: Mapped[str] = mapped_column(String(191), unique=True, nullable=False, index=True)
|
|
password_hash: Mapped[str | None] = mapped_column(String(128), nullable=True)
|
|
|
|
# "admin" | "user" — kept as plain string to avoid ALTER TABLE pain
|
|
# when new roles are introduced.
|
|
system_role: Mapped[str] = mapped_column(String(16), nullable=False, default="user")
|
|
|
|
created_at: Mapped[datetime] = mapped_column(
|
|
BeijingDateTime(),
|
|
nullable=False,
|
|
default=lambda: datetime.now(UTC),
|
|
)
|
|
|
|
# OAuth linkage (optional). A partial unique index enforces one
|
|
# account per (provider, oauth_id) pair, leaving NULL/NULL rows
|
|
# unconstrained so plain password accounts can coexist.
|
|
oauth_provider: Mapped[str | None] = mapped_column(String(32), nullable=True)
|
|
oauth_id: Mapped[str | None] = mapped_column(String(128), nullable=True)
|
|
|
|
# Auth lifecycle flags
|
|
needs_setup: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
|
|
token_version: Mapped[int] = mapped_column(nullable=False, default=0)
|
|
|
|
# 登录白名单(放行)标记 —— **黑名单模式**。仅当系统设置 ``login_whitelist.enabled``
|
|
# 打开时生效:关 → 忽略此列,人人可登录;开 → 仅 approved=False(被管理员显式
|
|
# 「取消放行」)的用户被拦,其余(含从未登录过的新账号)放行。新账号默认 True
|
|
# (首次登录即放行);存量用户由迁移回填 True。server_default=1 让迁移 ADD COLUMN
|
|
# 时把已存在行置为已放行。
|
|
approved: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default=text("1"))
|
|
|
|
# 岗位 (position) the user is assigned to (1:1). NULL = no explicit
|
|
# position → the user inherits the ``is_default`` position's grants. Drives
|
|
# the subscription sync engine (see ``deerflow.services.position_sync``).
|
|
position_id: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
|
|
|
|
__table_args__ = (
|
|
Index(
|
|
"idx_users_oauth_identity",
|
|
"oauth_provider",
|
|
"oauth_id",
|
|
unique=True,
|
|
sqlite_where=text("oauth_provider IS NOT NULL AND oauth_id IS NOT NULL"),
|
|
),
|
|
)
|