bvandeusenandClaude Opus 5.5
6a81cf4aac
- users.time_zone (0034). An account without one takes the browser's zone on its first page (POST /account/time-zone/adopt, never over a choice made by hand); the session follows the account on every request. - /account: who you are and the zone every page writes its times in, reached from your name in the sidebar. - formatting.when: 'Today 06:58', 'Yesterday 23:41', 'Tue 6 Oct 14:12', '6 Oct 2025 14:12', 24-hour, in the reader's zone; |ago's hover is the exact local moment instead of UTC; tz_label() for column headers. - Audit log: When (EDT) with exact times, one detail fact a line, on classes. - tzdata in the image, and the airgapped smoke checks a zone resolves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
2.1 KiB
Python
43 lines
2.1 KiB
Python
from __future__ import annotations
|
|
import enum
|
|
import uuid
|
|
from datetime import datetime, timezone
|
|
from sqlalchemy import Boolean, DateTime, Enum, String, UniqueConstraint
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
from .base import Base
|
|
|
|
|
|
class UserRole(str, enum.Enum):
|
|
admin = "admin"
|
|
operator = "operator"
|
|
viewer = "viewer"
|
|
|
|
|
|
# Where a user's identity lives. A local user signs in with a Steward
|
|
# password; an ldap or oidc user is created at their first sign-in, holds an
|
|
# unusable password, and is found again only by (auth_source, external_id) —
|
|
# never by a matching username, so a directory cannot sign in as a local account.
|
|
AUTH_SOURCES = ("local", "ldap", "oidc")
|
|
|
|
|
|
class User(Base):
|
|
__tablename__ = "users"
|
|
__table_args__ = (UniqueConstraint("auth_source", "external_id", name="uq_users_auth_source_external_id"),)
|
|
|
|
id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
|
|
username: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
|
|
email: Mapped[str] = mapped_column(String(255), unique=True, nullable=False)
|
|
password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
role: Mapped[UserRole] = mapped_column(Enum(UserRole), nullable=False, default=UserRole.viewer)
|
|
created_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc)
|
|
)
|
|
is_active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
|
|
auth_source: Mapped[str] = mapped_column(String(16), nullable=False, default="local", server_default="local")
|
|
# The provider's stable id: the LDAP entry DN, or the OIDC `sub`. None for local users.
|
|
external_id: Mapped[str | None] = mapped_column(String(512), nullable=True)
|
|
# The IANA zone this user reads times in (milestone 490), e.g.
|
|
# "America/New_York". Their browser's zone is saved the first time they
|
|
# sign in without one; they change it on the Account page. None reads as UTC.
|
|
time_zone: Mapped[str | None] = mapped_column(String(64), nullable=True)
|