wizardchen
d60614475e
Introduce unit tests for the tenant API key validation logic, ensuring that scoped keys require capabilities, while full-access keys are validated without them. The tests cover various scenarios, reinforcing the expected behavior of the API key validation function.
53 lines
1.6 KiB
SQL
53 lines
1.6 KiB
SQL
DO $$ BEGIN RAISE NOTICE '[Migration 000065] Creating tenant_api_keys...'; END $$;
|
|
|
|
CREATE TABLE IF NOT EXISTS tenant_api_keys (
|
|
id BIGSERIAL PRIMARY KEY,
|
|
tenant_id INTEGER NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
|
|
name VARCHAR(128) NOT NULL,
|
|
key_hash VARCHAR(64) NOT NULL UNIQUE,
|
|
api_key TEXT NOT NULL DEFAULT '',
|
|
full_access BOOLEAN NOT NULL DEFAULT FALSE,
|
|
knowledge_base_ids JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
-- Bounded per-key grants for non-full-access keys. KB allow-list still
|
|
-- constrains which knowledge bases a scoped key may touch.
|
|
capabilities JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
last_used_at TIMESTAMP,
|
|
expires_at TIMESTAMP,
|
|
revoked_at TIMESTAMP,
|
|
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_tenant_api_keys_tenant
|
|
ON tenant_api_keys(tenant_id);
|
|
CREATE INDEX IF NOT EXISTS idx_tenant_api_keys_revoked_at
|
|
ON tenant_api_keys(revoked_at);
|
|
|
|
INSERT INTO tenant_api_keys (
|
|
tenant_id,
|
|
name,
|
|
key_hash,
|
|
api_key,
|
|
full_access,
|
|
knowledge_base_ids,
|
|
created_at,
|
|
updated_at
|
|
)
|
|
SELECT
|
|
id,
|
|
'Tenant API key',
|
|
'migrated-tenant-' || id::text,
|
|
api_key,
|
|
TRUE,
|
|
'[]'::jsonb,
|
|
CURRENT_TIMESTAMP,
|
|
CURRENT_TIMESTAMP
|
|
FROM tenants
|
|
WHERE COALESCE(api_key, '') <> ''
|
|
ON CONFLICT (key_hash) DO NOTHING;
|
|
|
|
DROP INDEX IF EXISTS idx_tenants_api_key;
|
|
ALTER TABLE tenants DROP COLUMN IF EXISTS api_key;
|
|
|
|
DO $$ BEGIN RAISE NOTICE '[Migration 000065] tenant_api_keys ready'; END $$;
|