mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
Tomas Dvorak
e881747388
Add cnp_ personal access tokens so the CLI, MCP server, and external agents authenticate without a browser session — the agent-first spine from ROADMAP2 phase A. Modeled on agent_auth_tokens: raw token shown once, only SHA-256 hash stored. - user_tokens table (goose migration + sqlc), name/prefix/scope/expiry, owner-scoped revoke, last_used_at stamping - middleware: cnp_ bearer resolution, read scope gates mutations with 403 SCOPE_INSUFFICIENT, non-admin scopes cap is_admin even for admin owners — a token never outranks its scope or its owner - GET/POST/DELETE /api/v1/user/tokens + OpenAPI + generated types - Settings UI: create with scope/expiry pickers, one-time token display with copy, list with last-used/expiry, confirm-revoke - docs: OPERATIONS.md section, README feature line Verified end-to-end against live Postgres: create/list/revoke, read scope blocks PUT (403), write PAT on admin owner blocked from admin routes (403), admin scope works, revoked token returns 401. Authored By: TDvorak <[email protected]>
25 lines
694 B
SQL
25 lines
694 B
SQL
-- name: CreateUserToken :one
|
|
INSERT INTO user_tokens (user_id, name, key_prefix, token_hash, scope, expires_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6)
|
|
RETURNING *;
|
|
|
|
-- name: ListUserTokens :many
|
|
SELECT * FROM user_tokens
|
|
WHERE user_id = $1 AND revoked_at IS NULL
|
|
ORDER BY created_at DESC;
|
|
|
|
-- name: GetUserTokenByHash :one
|
|
SELECT * FROM user_tokens
|
|
WHERE token_hash = $1
|
|
AND revoked_at IS NULL
|
|
AND (expires_at IS NULL OR expires_at > NOW())
|
|
LIMIT 1;
|
|
|
|
-- name: TouchUserToken :exec
|
|
UPDATE user_tokens SET last_used_at = NOW()
|
|
WHERE id = $1 AND revoked_at IS NULL;
|
|
|
|
-- name: RevokeUserToken :execrows
|
|
UPDATE user_tokens SET revoked_at = NOW()
|
|
WHERE id = $1 AND user_id = $2 AND revoked_at IS NULL;
|