bvandeusenandClaude Opus 4.8
b46bda38ee
- users.is_admin; first registered user becomes admin; registration gated by the allow_registration setting (first account always allowed). is_admin in /api/auth/* responses; require_admin guard (live DB check). - settings table + code registry (site_name, allow_registration, session_ttl_days) with typed defaults — empty table = all defaults (rule 26). get/set/validate service; GET /api/config (public) + GET/PATCH /api/settings (admin), live session-TTL apply with no restart (rule 25). - Cookie-signing secret now persisted in the DB (before_serving load-or-create), so sessions survive restarts with no volume. Config: DATABASE_URL is the only required env; SECRET_KEY + DATA_DIR are optional break-glass items. - Migration 0003; DB-free tests for settings validation + admin guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm
33 lines
900 B
Python
33 lines
900 B
Python
"""roles + settings
|
|
|
|
Revision ID: 0003
|
|
Revises: 0002
|
|
Create Date: 2026-07-19
|
|
|
|
Adds the admin role bit and the DB-backed settings table. No rows are seeded —
|
|
defaults live in the code registry (thoughtsync.settings), so an empty table
|
|
means every setting is at its default.
|
|
"""
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
revision = "0003"
|
|
down_revision = "0002"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.add_column("users", sa.Column("is_admin", sa.Boolean(), nullable=False, server_default=sa.false()))
|
|
op.create_table(
|
|
"settings",
|
|
sa.Column("key", sa.Text(), primary_key=True),
|
|
sa.Column("value", sa.Text(), nullable=False),
|
|
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_table("settings")
|
|
op.drop_column("users", "is_admin")
|