Michael Chihlas
92fa3bc6ab
First commit in the session-expiration-policy series (see docs/plans/2026-05-13-session-expiration-policy.md). No behavior change yet — this lays the schema + settings groundwork only. - Settings: SESSION_IDLE_MINUTES_DEFAULT=4320 (3d), SESSION_ABSOLUTE_MINUTES_DEFAULT=20160 (14d), plus MIN/MAX bounds so account overrides have envelopes (15min..30d idle, 1h..90d absolute). - accounts table: nullable session_idle_minutes and session_absolute_minutes columns (NULL = use system default), plus a CHECK constraint that rejects idle > absolute when both are set. Partial-override validation lives at the app layer because the DB cannot read Settings. Subsequent commits will: distinguish idle vs invalid-token expiry on the wire, embed auth_time/idle_max/abs_max in refresh JWTs, enforce the absolute cap in /auth/refresh, add the owner-only policy + bulk-revoke endpoints, and surface everything in an AccountSecurity settings page with a session-expiry toast. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
76 lines
4.6 KiB
Python
76 lines
4.6 KiB
Python
import uuid
|
|
from datetime import datetime, timezone
|
|
from typing import Optional, TYPE_CHECKING
|
|
from sqlalchemy import String, DateTime, ForeignKey, Boolean, Integer
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
|
from sqlalchemy.dialects.postgresql import UUID, JSONB
|
|
from app.core.database import Base
|
|
|
|
if TYPE_CHECKING:
|
|
from app.models.user import User
|
|
from app.models.subscription import Subscription
|
|
from app.models.tree import Tree
|
|
from app.models.category import TreeCategory
|
|
from app.models.tag import TreeTag
|
|
from app.models.step_category import StepCategory
|
|
from app.models.step_library import StepLibrary
|
|
from app.models.account_limit_override import AccountLimitOverride
|
|
from app.models.psa_connection import PsaConnection
|
|
|
|
|
|
class Account(Base):
|
|
__tablename__ = "accounts"
|
|
|
|
id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
|
|
name: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
display_code: Mapped[str] = mapped_column(String(8), unique=True, nullable=False)
|
|
owner_id: Mapped[Optional[uuid.UUID]] = mapped_column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="RESTRICT"), nullable=True)
|
|
stripe_customer_id: Mapped[Optional[str]] = mapped_column(String(255), nullable=True)
|
|
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=lambda: datetime.now(timezone.utc))
|
|
updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=lambda: datetime.now(timezone.utc), onupdate=lambda: datetime.now(timezone.utc))
|
|
allow_public_shares: Mapped[bool] = mapped_column(
|
|
Boolean,
|
|
nullable=False,
|
|
default=True,
|
|
server_default="true",
|
|
comment="Policy: engineers can create public shares. Only affects NEW shares (grandfathered)."
|
|
)
|
|
|
|
# Chat retention settings
|
|
chat_retention_days: Mapped[Optional[int]] = mapped_column(
|
|
Integer, nullable=True, default=90, server_default="90"
|
|
)
|
|
chat_retention_max_count: Mapped[Optional[int]] = mapped_column(
|
|
Integer, nullable=True, default=100, server_default="100"
|
|
)
|
|
|
|
# Session policy override (NULL = use Settings.SESSION_*_MINUTES_DEFAULT).
|
|
# Validated at the app layer because the DB cannot see Settings; a DB
|
|
# CHECK constraint covers the both-set case only.
|
|
session_idle_minutes: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
|
|
session_absolute_minutes: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
|
|
|
|
# Custom branding (Task 9)
|
|
branding_logo_url: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
|
|
branding_primary_color: Mapped[Optional[str]] = mapped_column(String(7), nullable=True) # hex like #06b6d4
|
|
branding_company_name: Mapped[Optional[str]] = mapped_column(String(200), nullable=True)
|
|
team_size_bucket: Mapped[Optional[str]] = mapped_column(String(20), nullable=True)
|
|
primary_psa: Mapped[Optional[str]] = mapped_column(String(20), nullable=True)
|
|
|
|
# SSO / SAML groundwork (Task 11)
|
|
sso_enabled: Mapped[bool] = mapped_column(Boolean, default=False, server_default="false")
|
|
sso_provider: Mapped[Optional[str]] = mapped_column(String(20), nullable=True) # "saml" | "oidc"
|
|
sso_config: Mapped[Optional[dict]] = mapped_column(JSONB, nullable=True)
|
|
|
|
# Relationships
|
|
owner: Mapped["User"] = relationship("User", foreign_keys=[owner_id], back_populates="owned_account")
|
|
users: Mapped[list["User"]] = relationship("User", foreign_keys="[User.account_id]", back_populates="account")
|
|
subscription: Mapped[Optional["Subscription"]] = relationship("Subscription", back_populates="account", uselist=False)
|
|
trees: Mapped[list["Tree"]] = relationship("Tree", foreign_keys="[Tree.account_id]", back_populates="account")
|
|
categories: Mapped[list["TreeCategory"]] = relationship("TreeCategory", foreign_keys="[TreeCategory.account_id]", back_populates="account")
|
|
tags: Mapped[list["TreeTag"]] = relationship("TreeTag", foreign_keys="[TreeTag.account_id]", back_populates="account")
|
|
step_categories: Mapped[list["StepCategory"]] = relationship("StepCategory", foreign_keys="[StepCategory.account_id]", back_populates="account")
|
|
step_library: Mapped[list["StepLibrary"]] = relationship("StepLibrary", foreign_keys="[StepLibrary.account_id]", back_populates="account")
|
|
limit_override: Mapped[Optional["AccountLimitOverride"]] = relationship("AccountLimitOverride", back_populates="account", uselist=False)
|
|
psa_connection: Mapped[Optional["PsaConnection"]] = relationship("PsaConnection", back_populates="account", uselist=False)
|