a394a1d464
After migration 174f442795b7 enforces NOT NULL on account_id, all platform/global content must use the sentinel platform account instead of NULL. Three categories of fixes: 1. trees.py: is_default trees now get PLATFORM_ACCOUNT_ID (not None) 2. admin_categories.py: global category CRUD now uses PLATFORM_ACCOUNT_ID 3. categories.py, tags.py, step_categories.py: creation endpoints coerce None → PLATFORM_ACCOUNT_ID; IS NULL filter queries updated to == PLATFORM_ACCOUNT_ID (IS NULL queries returned empty after migration backfilled all global rows to the platform account) Defines PLATFORM_ACCOUNT_ID constant in app/core/service_account.py. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
92 lines
2.9 KiB
Python
92 lines
2.9 KiB
Python
"""ResolutionFlow system service account.
|
|
|
|
This module manages the platform-level service account used as the author
|
|
for system/default content (seeded trees, synced step library entries, etc.).
|
|
|
|
The service account ID is resolved once at startup and cached on app.state
|
|
so that sync operations can use it without a DB query per request.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
import logging
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
SERVICE_ACCOUNT_EMAIL = "noreply@resolutionflow.com"
|
|
SERVICE_ACCOUNT_NAME = "ResolutionFlow"
|
|
|
|
# Well-known UUID for the platform account — owns all default/global content.
|
|
# Created by migration 3a40fe11b427_create_global_content_tables.
|
|
PLATFORM_ACCOUNT_ID = uuid.UUID("00000000-0000-0000-0000-000000000001")
|
|
SYSTEM_ACCOUNT_NAME = "ResolutionFlow System"
|
|
SYSTEM_ACCOUNT_DISPLAY_CODE = "RF-SYS-1"
|
|
|
|
|
|
async def _ensure_system_account(db: AsyncSession) -> uuid.UUID:
|
|
"""Get or create the ResolutionFlow system account. Returns its ID."""
|
|
from app.models.account import Account
|
|
from sqlalchemy import text
|
|
|
|
result = await db.execute(
|
|
select(Account).where(Account.display_code == SYSTEM_ACCOUNT_DISPLAY_CODE)
|
|
)
|
|
account = result.scalar_one_or_none()
|
|
if account is not None:
|
|
return account.id
|
|
|
|
new_account = Account(
|
|
id=uuid.uuid4(),
|
|
name=SYSTEM_ACCOUNT_NAME,
|
|
display_code=SYSTEM_ACCOUNT_DISPLAY_CODE,
|
|
)
|
|
db.add(new_account)
|
|
await db.flush()
|
|
logger.info(f"[service_account] Created system account (id={new_account.id})")
|
|
return new_account.id
|
|
|
|
|
|
async def ensure_service_account(db: AsyncSession) -> uuid.UUID:
|
|
"""Ensure the ResolutionFlow service account exists and return its ID.
|
|
|
|
Idempotent — safe to call on every startup. Creates the account if it
|
|
does not exist. The account has no usable password and is_service_account=True
|
|
so it can never log in via normal auth flows.
|
|
"""
|
|
from app.models.user import User
|
|
|
|
result = await db.execute(
|
|
select(User).where(User.email == SERVICE_ACCOUNT_EMAIL)
|
|
)
|
|
user = result.scalar_one_or_none()
|
|
|
|
if user is not None:
|
|
if not user.is_service_account:
|
|
user.is_service_account = True
|
|
await db.commit()
|
|
return user.id
|
|
|
|
account_id = await _ensure_system_account(db)
|
|
|
|
new_user = User(
|
|
id=uuid.uuid4(),
|
|
email=SERVICE_ACCOUNT_EMAIL,
|
|
name=SERVICE_ACCOUNT_NAME,
|
|
password_hash="!service-account-no-login", # bcrypt can't produce this prefix
|
|
role="engineer",
|
|
is_super_admin=False,
|
|
is_team_admin=False,
|
|
is_active=True,
|
|
is_service_account=True,
|
|
must_change_password=False,
|
|
account_id=account_id,
|
|
account_role="engineer",
|
|
)
|
|
db.add(new_user)
|
|
await db.commit()
|
|
logger.info(f"[service_account] Created service account (id={new_user.id})")
|
|
return new_user.id
|