menzeljandClaude Opus 5
e650aa6833
A session token is the wrong credential for automation. It expires in an hour, it is minted by typing a password, and revoking it signs every one of that person's devices out. So automation gets its own credential, revocable on its own, and showing up in the audit log as itself. Three decisions worth recording, because each one is a place this could have been built wrong. **Only a hash is stored.** This is the opposite call from registry passwords one release ago, and for a concrete reason: a registry password has to be handed back to the registry, so it must be recoverable and is encrypted. A token is only ever compared against, so it does not need to be — and not keeping it is the difference between leaking the database and leaking everything the database protects. It is shown once and cannot be recovered; a readable prefix is kept so rows are still identifiable in the UI and the audit log. The hash is SHA-256, deliberately not bcrypt: bcrypt is slow to make guessing low-entropy human passwords expensive, and a token is 256 bits of secrets output, so the cost would buy nothing and would land on every single API request. **The scope is not folded into the User object.** get_current_user returns a session-attached row; downgrading its role in place to represent a read-only token would be written back to the database the next time anything committed that user — logout-everywhere does exactly that. So the token row is stashed on request.state and require_admin consults it, leaving the User untouched. The same lookup caps a token at its owner's authority rather than trusting the scope alone, so a demoted admin's token drops to read-only with them and a disabled account's tokens stop working. **A token cannot make itself permanent.** Creating tokens and creating users now require a signed-in session, via a require_session dependency that rejects token-authenticated requests. Without it, a leaked CI credential could mint a second one and survive its own revocation — the failure mode where revoking the leak does nothing. This is the one behaviour change for existing installs: scripted user creation now needs a login. The WebSocket routes still take JWTs only. They carry logs, the terminal and the deploy console, which a CI job has no use for, and leaving them alone keeps the token surface to the REST API. 19 tests, covering what is stored, that a read token really is read-only while its owner is an admin, that demoting and disabling the owner both take effect, expiry, tampering, the throttle on last-used writes, and that a token can neither mint another nor create a user. Verified end to end against a running app: two tokens, both scopes, revocation, and no plaintext anywhere in the database or the list response. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
67 lines
1.8 KiB
Python
67 lines
1.8 KiB
Python
from __future__ import annotations
|
|
|
|
from datetime import datetime, timezone
|
|
from typing import Optional
|
|
|
|
from sqlmodel import Field, SQLModel
|
|
|
|
|
|
def _now() -> datetime:
|
|
return datetime.now(timezone.utc)
|
|
|
|
|
|
#: What a token is allowed to do. "read" matches the read-only user role even
|
|
#: when the owner is an admin, so a monitoring script can be handed a token that
|
|
#: cannot change anything.
|
|
SCOPES = ["read", "admin"]
|
|
|
|
|
|
class ApiToken(SQLModel, table=True):
|
|
"""A long-lived bearer token for scripts and CI, owned by a user.
|
|
|
|
Only a hash is stored — the token itself is shown once, when it is created,
|
|
and cannot be recovered afterwards. ``prefix`` is the readable front of the
|
|
token (``sp_`` plus eight characters); it identifies the row in the UI and
|
|
in the audit log without being enough to authenticate with.
|
|
"""
|
|
|
|
id: Optional[int] = Field(default=None, primary_key=True)
|
|
name: str
|
|
prefix: str = Field(index=True, unique=True)
|
|
token_hash: str
|
|
scope: str = Field(default="read")
|
|
#: The account the token acts as. Its role caps the token's scope, and a
|
|
#: disabled account disables its tokens.
|
|
user_id: int = Field(index=True)
|
|
expires_at: Optional[datetime] = None
|
|
last_used_at: Optional[datetime] = None
|
|
created_at: datetime = Field(default_factory=_now)
|
|
|
|
|
|
# --- API schemas ---
|
|
|
|
|
|
class ApiTokenCreate(SQLModel):
|
|
name: str
|
|
scope: str = "read"
|
|
#: Days until it expires. None means it does not.
|
|
expires_in_days: Optional[int] = None
|
|
|
|
|
|
class ApiTokenRead(SQLModel):
|
|
id: int
|
|
name: str
|
|
prefix: str
|
|
scope: str
|
|
username: str
|
|
expires_at: Optional[datetime]
|
|
last_used_at: Optional[datetime]
|
|
created_at: datetime
|
|
expired: bool
|
|
|
|
|
|
class ApiTokenCreated(ApiTokenRead):
|
|
"""The create response, and the only time the token itself is returned."""
|
|
|
|
token: str
|