8b84378fe1
Elevate MiroFish/CrowdSight from single-container dev to a SaaS foundation: - Local memory backend (Zep-compatible): memory services/models, local graph builder + updater, AgentActivity seam, import-boundary isolation; Zep stays default, local is opt-in behind MEMORY_BACKEND. Semantic parity not yet proven. - Durable product persistence: projects/simulations/reports schema (migration 0007) + tenant/owner-scoped ProductRepository + dual-write + scoped_project read-first + ArtifactStore abstraction; durable JobQueue + worker.py. - SaaS hardening: durable RateLimiter (wired to login), UsageService (LLM accounting), redacted AuditService, idempotency, CORS allowlist, safe API errors, single-use PasswordResetService + endpoints (covers invite-pending). - Exactly 3 roles (super_admin/admin/user) with tenant authz policy. - Admin UI: GET/POST/PATCH /api/admin/users + GET/PUT /api/admin/settings (super-admin only, encrypted/masked); AdminView.vue + SettingsView.vue with admin/super-admin route guards, th/en i18n. - Production deploy topology: multi-stage Dockerfile (frontend build + gunicorn wsgi + nginx SPA-proxy + supervisord worker), backend/wsgi.py, gunicorn dep. Backend 197 passed; frontend 10 tests + build green. ruff unavailable (gap). No commit of credentials; secrets handled via env/.env.example. Deferred: Zep semantic A/B parity, object storage cutover, mobile QA, EasyPanel container build of deploy topology.
80 lines
3.5 KiB
Python
80 lines
3.5 KiB
Python
"""Create SaaS identity and tenant membership tables.
|
|
|
|
Revision ID: 0001_identity
|
|
Revises:
|
|
Create Date: 2026-08-23
|
|
"""
|
|
|
|
from typing import Sequence, Union
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
revision: str = "0001_identity"
|
|
down_revision: Union[str, None] = None
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"organizations",
|
|
sa.Column("id", sa.String(length=64), nullable=False),
|
|
sa.Column("name", sa.String(length=160), nullable=False),
|
|
sa.Column("slug", sa.String(length=80), nullable=False),
|
|
sa.Column("status", sa.String(length=32), server_default=sa.text("'active'"), nullable=False),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.PrimaryKeyConstraint("id"),
|
|
)
|
|
op.create_index("ix_organizations_slug", "organizations", ["slug"], unique=True)
|
|
|
|
op.create_table(
|
|
"users",
|
|
sa.Column("id", sa.String(length=64), nullable=False),
|
|
sa.Column("email_normalized", sa.String(length=320), nullable=False),
|
|
sa.Column(
|
|
"password_hash",
|
|
sa.String(length=512),
|
|
server_default=sa.text("'!invite_pending'"),
|
|
nullable=False,
|
|
),
|
|
sa.Column("status", sa.String(length=32), server_default=sa.text("'active'"), nullable=False),
|
|
sa.Column("auth_version", sa.Integer(), server_default=sa.text("0"), nullable=False),
|
|
sa.Column("locale", sa.String(length=8), server_default=sa.text("'th'"), nullable=False),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.Column("last_login_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.PrimaryKeyConstraint("id"),
|
|
)
|
|
op.create_index("ix_users_email_normalized", "users", ["email_normalized"], unique=True)
|
|
|
|
op.create_table(
|
|
"memberships",
|
|
sa.Column("id", sa.String(length=64), nullable=False),
|
|
sa.Column("user_id", sa.String(length=64), nullable=False),
|
|
sa.Column("organization_id", sa.String(length=64), nullable=False),
|
|
sa.Column("role", sa.String(length=11), nullable=False),
|
|
sa.Column("status", sa.String(length=32), server_default=sa.text("'active'"), nullable=False),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.CheckConstraint(
|
|
"role IN ('super_admin', 'admin', 'user')",
|
|
name="ck_membership_role",
|
|
),
|
|
sa.ForeignKeyConstraint(["organization_id"], ["organizations.id"], ondelete="CASCADE"),
|
|
sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
|
|
sa.PrimaryKeyConstraint("id"),
|
|
sa.UniqueConstraint("user_id", "organization_id", name="uq_membership_user_org"),
|
|
)
|
|
op.create_index("ix_memberships_user_id", "memberships", ["user_id"], unique=False)
|
|
op.create_index("ix_memberships_organization_id", "memberships", ["organization_id"], unique=False)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_index("ix_memberships_organization_id", table_name="memberships")
|
|
op.drop_index("ix_memberships_user_id", table_name="memberships")
|
|
op.drop_table("memberships")
|
|
op.drop_index("ix_users_email_normalized", table_name="users")
|
|
op.drop_table("users")
|
|
op.drop_index("ix_organizations_slug", table_name="organizations")
|
|
op.drop_table("organizations")
|