mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
Add cnp_ personal access tokens so the CLI, MCP server, and external agents authenticate without a browser session — the agent-first spine from ROADMAP2 phase A. Modeled on agent_auth_tokens: raw token shown once, only SHA-256 hash stored. - user_tokens table (goose migration + sqlc), name/prefix/scope/expiry, owner-scoped revoke, last_used_at stamping - middleware: cnp_ bearer resolution, read scope gates mutations with 403 SCOPE_INSUFFICIENT, non-admin scopes cap is_admin even for admin owners — a token never outranks its scope or its owner - GET/POST/DELETE /api/v1/user/tokens + OpenAPI + generated types - Settings UI: create with scope/expiry pickers, one-time token display with copy, list with last-used/expiry, confirm-revoke - docs: OPERATIONS.md section, README feature line Verified end-to-end against live Postgres: create/list/revoke, read scope blocks PUT (403), write PAT on admin owner blocked from admin routes (403), admin scope works, revoked token returns 401. Authored By: TDvorak <[email protected]>
148 lines
3.5 KiB
Go
148 lines
3.5 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.31.1
|
|
// source: user_tokens.sql
|
|
|
|
package sqlcdb
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
const createUserToken = `-- name: CreateUserToken :one
|
|
INSERT INTO user_tokens (user_id, name, key_prefix, token_hash, scope, expires_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6)
|
|
RETURNING id, user_id, name, key_prefix, token_hash, scope, expires_at, last_used_at, revoked_at, created_at
|
|
`
|
|
|
|
type CreateUserTokenParams struct {
|
|
UserID uuid.UUID `json:"user_id"`
|
|
Name string `json:"name"`
|
|
KeyPrefix string `json:"key_prefix"`
|
|
TokenHash string `json:"token_hash"`
|
|
Scope string `json:"scope"`
|
|
ExpiresAt sql.NullTime `json:"expires_at"`
|
|
}
|
|
|
|
func (q *Queries) CreateUserToken(ctx context.Context, arg CreateUserTokenParams) (UserToken, error) {
|
|
row := q.db.QueryRowContext(ctx, createUserToken,
|
|
arg.UserID,
|
|
arg.Name,
|
|
arg.KeyPrefix,
|
|
arg.TokenHash,
|
|
arg.Scope,
|
|
arg.ExpiresAt,
|
|
)
|
|
var i UserToken
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.UserID,
|
|
&i.Name,
|
|
&i.KeyPrefix,
|
|
&i.TokenHash,
|
|
&i.Scope,
|
|
&i.ExpiresAt,
|
|
&i.LastUsedAt,
|
|
&i.RevokedAt,
|
|
&i.CreatedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const getUserTokenByHash = `-- name: GetUserTokenByHash :one
|
|
SELECT id, user_id, name, key_prefix, token_hash, scope, expires_at, last_used_at, revoked_at, created_at FROM user_tokens
|
|
WHERE token_hash = $1
|
|
AND revoked_at IS NULL
|
|
AND (expires_at IS NULL OR expires_at > NOW())
|
|
LIMIT 1
|
|
`
|
|
|
|
func (q *Queries) GetUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error) {
|
|
row := q.db.QueryRowContext(ctx, getUserTokenByHash, tokenHash)
|
|
var i UserToken
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.UserID,
|
|
&i.Name,
|
|
&i.KeyPrefix,
|
|
&i.TokenHash,
|
|
&i.Scope,
|
|
&i.ExpiresAt,
|
|
&i.LastUsedAt,
|
|
&i.RevokedAt,
|
|
&i.CreatedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const listUserTokens = `-- name: ListUserTokens :many
|
|
SELECT id, user_id, name, key_prefix, token_hash, scope, expires_at, last_used_at, revoked_at, created_at FROM user_tokens
|
|
WHERE user_id = $1 AND revoked_at IS NULL
|
|
ORDER BY created_at DESC
|
|
`
|
|
|
|
func (q *Queries) ListUserTokens(ctx context.Context, userID uuid.UUID) ([]UserToken, error) {
|
|
rows, err := q.db.QueryContext(ctx, listUserTokens, userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
items := []UserToken{}
|
|
for rows.Next() {
|
|
var i UserToken
|
|
if err := rows.Scan(
|
|
&i.ID,
|
|
&i.UserID,
|
|
&i.Name,
|
|
&i.KeyPrefix,
|
|
&i.TokenHash,
|
|
&i.Scope,
|
|
&i.ExpiresAt,
|
|
&i.LastUsedAt,
|
|
&i.RevokedAt,
|
|
&i.CreatedAt,
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
items = append(items, i)
|
|
}
|
|
if err := rows.Close(); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return items, nil
|
|
}
|
|
|
|
const revokeUserToken = `-- name: RevokeUserToken :execrows
|
|
UPDATE user_tokens SET revoked_at = NOW()
|
|
WHERE id = $1 AND user_id = $2 AND revoked_at IS NULL
|
|
`
|
|
|
|
type RevokeUserTokenParams struct {
|
|
ID uuid.UUID `json:"id"`
|
|
UserID uuid.UUID `json:"user_id"`
|
|
}
|
|
|
|
func (q *Queries) RevokeUserToken(ctx context.Context, arg RevokeUserTokenParams) (int64, error) {
|
|
result, err := q.db.ExecContext(ctx, revokeUserToken, arg.ID, arg.UserID)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return result.RowsAffected()
|
|
}
|
|
|
|
const touchUserToken = `-- name: TouchUserToken :exec
|
|
UPDATE user_tokens SET last_used_at = NOW()
|
|
WHERE id = $1 AND revoked_at IS NULL
|
|
`
|
|
|
|
func (q *Queries) TouchUserToken(ctx context.Context, id uuid.UUID) error {
|
|
_, err := q.db.ExecContext(ctx, touchUserToken, id)
|
|
return err
|
|
}
|