copilot-swe-agent[bot]
531dc968a8
- Add Logto OIDC integration (app/core/logto.py): CookieStorage adapter, create/decode session token helpers, sync_logto_user upsert - New auth endpoints (/api/v1/auth): sign-in, callback, sign-out, me - AuthRedirectMiddleware: protects HTML pages, redirects to /setup when Logto is unconfigured, to /login otherwise - Update require_admin_auth: accepts dmarq_session cookie JWT first, then API key, then Bearer JWT (fully backward compatible) - Update User model: add logto_id, username, picture, created_at, updated_at; make hashed_password nullable for Logto-only users; is_superuser default=True - New Alembic migration d4e5f6a7b8c9 for the above schema changes - Add LOGTO_ENDPOINT / LOGTO_APP_ID / LOGTO_APP_SECRET / LOGTO_REDIRECT_URI settings with logto_configured property - Create login.html (Sign in with Logto button) and setup.html (step-by-step configuration guide) - Update base.html: user menu with avatar/name and sign-out via Alpine.js fetch to /api/v1/auth/me - Update settings.html: remove localStorage adminApiKey; session cookie is sent automatically by browser; add 401 → /login redirect - Update requirements.txt: replace fastapi-users additions with logto + aiohttp - Add test_auth.py: 18 new tests covering session tokens, CookieStorage, sync_logto_user, /me, /sign-in (503), /sign-out cookie clearing - Fix test_security_extra.py: pass Request mock to require_admin_auth; add new test_valid_session_cookie_returns_auth_context Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/b448f585-7646-40f8-ae2d-9986c361e3fd Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
88 lines
2.8 KiB
Python
88 lines
2.8 KiB
Python
"""Add Logto fields to users table.
|
||
|
||
Adds the columns required for Logto OIDC integration and general user-profile
|
||
enhancements:
|
||
|
||
- ``logto_id`` – the Logto subject claim (``sub``); acts as the stable
|
||
external identity reference.
|
||
- ``username`` – optional display username synced from Logto.
|
||
- ``picture`` – profile-picture URL synced from Logto.
|
||
- ``created_at`` – row-creation timestamp.
|
||
- ``updated_at`` – last-update timestamp.
|
||
|
||
``hashed_password`` is made nullable because Logto-authenticated users
|
||
authenticate externally and have no local password.
|
||
|
||
Revision ID: d4e5f6a7b8c9
|
||
Revises: c3d4e5f6a7b8
|
||
Create Date: 2026-03-30 10:00:00.000000
|
||
"""
|
||
|
||
from typing import Sequence, Union
|
||
|
||
import sqlalchemy as sa
|
||
from alembic import op
|
||
|
||
# revision identifiers, used by Alembic.
|
||
revision: str = "d4e5f6a7b8c9"
|
||
down_revision: Union[str, Sequence[str], None] = "c3d4e5f6a7b8"
|
||
branch_labels: Union[str, Sequence[str], None] = None
|
||
depends_on: Union[str, Sequence[str], None] = None
|
||
|
||
|
||
def upgrade() -> None:
|
||
"""Apply schema changes."""
|
||
with op.batch_alter_table("users") as batch_op:
|
||
# New columns
|
||
batch_op.add_column(
|
||
sa.Column("logto_id", sa.String(), nullable=True)
|
||
)
|
||
batch_op.add_column(
|
||
sa.Column("username", sa.String(), nullable=True)
|
||
)
|
||
batch_op.add_column(
|
||
sa.Column("picture", sa.String(), nullable=True)
|
||
)
|
||
batch_op.add_column(
|
||
sa.Column(
|
||
"created_at",
|
||
sa.DateTime(),
|
||
nullable=True,
|
||
server_default=sa.func.now(),
|
||
)
|
||
)
|
||
batch_op.add_column(
|
||
sa.Column(
|
||
"updated_at",
|
||
sa.DateTime(),
|
||
nullable=True,
|
||
server_default=sa.func.now(),
|
||
)
|
||
)
|
||
# Make hashed_password nullable (Logto users have no local password)
|
||
batch_op.alter_column("hashed_password", nullable=True)
|
||
# Set is_superuser default to True (all users are admins for now)
|
||
batch_op.alter_column("is_superuser", server_default=sa.true())
|
||
|
||
# Add unique index on logto_id
|
||
op.create_index(
|
||
op.f("ix_users_logto_id"),
|
||
"users",
|
||
["logto_id"],
|
||
unique=True,
|
||
)
|
||
|
||
|
||
def downgrade() -> None:
|
||
"""Revert schema changes."""
|
||
op.drop_index(op.f("ix_users_logto_id"), table_name="users")
|
||
|
||
with op.batch_alter_table("users") as batch_op:
|
||
batch_op.drop_column("updated_at")
|
||
batch_op.drop_column("created_at")
|
||
batch_op.drop_column("picture")
|
||
batch_op.drop_column("username")
|
||
batch_op.drop_column("logto_id")
|
||
batch_op.alter_column("hashed_password", nullable=False)
|
||
batch_op.alter_column("is_superuser", server_default=sa.false())
|