bvandeusenandClaude Opus 4.8
3c76b50a9c
Native clients (Tauri/Android) authenticate sync with a long-lived device bearer token, alongside the existing web session cookie. Backend: - security.py: generate_token() (secrets.token_urlsafe) + hash_token() (SHA-256 — device tokens are already high-entropy, so no slow KDF; keeps per-request bearer auth cheap). Only the hash is stored. - device_tokens table (migration 0016): id, user_id, token_hash (unique), name, created_at, last_used_at. - login_required now accepts `Authorization: Bearer <token>` OR the session cookie. Session path stays DB-free (fast); bearer path looks up the token hash, sets g.user_id, and stamps last_used_at. - Endpoints: POST /api/auth/device-login (public; email+password → token, the native first-link flow), POST /api/auth/devices (session/bearer → token, web "link a device"), GET /api/auth/devices (list), DELETE /api/auth/devices/<id> (revoke). All owner-scoped; token shown once. Frontend: - Per-user (not admin) /account view "Linked devices": create a token (one-time reveal + copy), list devices (name, linked/last-synced), revoke with confirm. Top-bar device icon for all users; devices Pinia store. Tests (DB-free): token hash determinism + uniqueness; device endpoints auth-guard (401 without auth, before DB); device-login input validation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm
37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
"""device_tokens (M8 sync hub, step 2)
|
|
|
|
Revision ID: 0016
|
|
Revises: 0015
|
|
Create Date: 2026-07-23
|
|
|
|
Long-lived bearer tokens for native clients (Tauri/Android) to authenticate sync.
|
|
Only the SHA-256 hash of each token is stored; the plaintext is shown once at
|
|
creation. Owner-scoped + individually revocable.
|
|
"""
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
from sqlalchemy.dialects.postgresql import UUID
|
|
|
|
revision = "0016"
|
|
down_revision = "0015"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"device_tokens",
|
|
sa.Column("id", UUID(as_uuid=True), primary_key=True),
|
|
sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
|
|
sa.Column("token_hash", sa.Text(), nullable=False, unique=True),
|
|
sa.Column("name", sa.Text(), nullable=False, server_default=""),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
|
|
sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
|
|
)
|
|
op.create_index("ix_device_tokens_user", "device_tokens", ["user_id"])
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_index("ix_device_tokens_user", table_name="device_tokens")
|
|
op.drop_table("device_tokens")
|