8b84378fe1
Elevate MiroFish/CrowdSight from single-container dev to a SaaS foundation: - Local memory backend (Zep-compatible): memory services/models, local graph builder + updater, AgentActivity seam, import-boundary isolation; Zep stays default, local is opt-in behind MEMORY_BACKEND. Semantic parity not yet proven. - Durable product persistence: projects/simulations/reports schema (migration 0007) + tenant/owner-scoped ProductRepository + dual-write + scoped_project read-first + ArtifactStore abstraction; durable JobQueue + worker.py. - SaaS hardening: durable RateLimiter (wired to login), UsageService (LLM accounting), redacted AuditService, idempotency, CORS allowlist, safe API errors, single-use PasswordResetService + endpoints (covers invite-pending). - Exactly 3 roles (super_admin/admin/user) with tenant authz policy. - Admin UI: GET/POST/PATCH /api/admin/users + GET/PUT /api/admin/settings (super-admin only, encrypted/masked); AdminView.vue + SettingsView.vue with admin/super-admin route guards, th/en i18n. - Production deploy topology: multi-stage Dockerfile (frontend build + gunicorn wsgi + nginx SPA-proxy + supervisord worker), backend/wsgi.py, gunicorn dep. Backend 197 passed; frontend 10 tests + build green. ruff unavailable (gap). No commit of credentials; secrets handled via env/.env.example. Deferred: Zep semantic A/B parity, object storage cutover, mobile QA, EasyPanel container build of deploy topology.
108 lines
6.2 KiB
Python
108 lines
6.2 KiB
Python
"""Add durable jobs, idempotency records, and audit logs."""
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
revision = "0004_operations"
|
|
down_revision = "0003_memory"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"jobs",
|
|
sa.Column("id", sa.String(length=64), nullable=False),
|
|
sa.Column("organization_id", sa.String(length=64), nullable=False),
|
|
sa.Column("owner_user_id", sa.String(length=64), nullable=True),
|
|
sa.Column("project_id", sa.String(length=128), nullable=True),
|
|
sa.Column("graph_id", sa.String(length=128), nullable=True),
|
|
sa.Column("operation", sa.String(length=120), nullable=False),
|
|
sa.Column("status", sa.String(length=32), server_default=sa.text("'queued'"), nullable=False),
|
|
sa.Column("progress", sa.Integer(), server_default=sa.text("0"), nullable=False),
|
|
sa.Column("error_code", sa.String(length=120), nullable=True),
|
|
sa.Column("result_ref", sa.String(length=512), nullable=True),
|
|
sa.Column("idempotency_key", sa.String(length=128), nullable=True),
|
|
sa.Column("attempt", sa.Integer(), server_default=sa.text("0"), nullable=False),
|
|
sa.Column("settings_version", sa.String(length=128), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.Column("finished_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.CheckConstraint(
|
|
"status IN ('queued', 'running', 'succeeded', 'failed', 'cancelled')",
|
|
name="ck_jobs_status",
|
|
),
|
|
sa.ForeignKeyConstraint(["organization_id"], ["organizations.id"], ondelete="CASCADE"),
|
|
sa.ForeignKeyConstraint(["owner_user_id"], ["users.id"], ondelete="SET NULL"),
|
|
sa.PrimaryKeyConstraint("id"),
|
|
)
|
|
op.create_index("ix_jobs_organization_id", "jobs", ["organization_id"], unique=False)
|
|
op.create_index("ix_jobs_owner_user_id", "jobs", ["owner_user_id"], unique=False)
|
|
op.create_index("ix_jobs_project_id", "jobs", ["project_id"], unique=False)
|
|
op.create_index("ix_jobs_graph_id", "jobs", ["graph_id"], unique=False)
|
|
op.create_index("ix_jobs_org_status_created", "jobs", ["organization_id", "status", "created_at"], unique=False)
|
|
op.create_index("ix_jobs_org_owner", "jobs", ["organization_id", "owner_user_id"], unique=False)
|
|
|
|
op.create_table(
|
|
"idempotency_records",
|
|
sa.Column("id", sa.String(length=64), nullable=False),
|
|
sa.Column("organization_id", sa.String(length=64), nullable=False),
|
|
sa.Column("user_id", sa.String(length=64), nullable=False),
|
|
sa.Column("key", sa.String(length=128), nullable=False),
|
|
sa.Column("request_hash", sa.String(length=64), nullable=False),
|
|
sa.Column("status", sa.String(length=32), server_default=sa.text("'reserved'"), nullable=False),
|
|
sa.Column("response_status", sa.Integer(), nullable=True),
|
|
sa.Column("response_body", sa.JSON(), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("completed_at", sa.DateTime(timezone=True), nullable=True),
|
|
sa.ForeignKeyConstraint(["organization_id"], ["organizations.id"], ondelete="CASCADE"),
|
|
sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
|
|
sa.PrimaryKeyConstraint("id"),
|
|
sa.UniqueConstraint("organization_id", "user_id", "key", name="uq_idempotency_org_user_key"),
|
|
)
|
|
op.create_index("ix_idempotency_records_organization_id", "idempotency_records", ["organization_id"], unique=False)
|
|
op.create_index("ix_idempotency_records_user_id", "idempotency_records", ["user_id"], unique=False)
|
|
op.create_index("ix_idempotency_expiry", "idempotency_records", ["expires_at"], unique=False)
|
|
|
|
op.create_table(
|
|
"audit_logs",
|
|
sa.Column("id", sa.String(length=64), nullable=False),
|
|
sa.Column("organization_id", sa.String(length=64), nullable=False),
|
|
sa.Column("actor_user_id", sa.String(length=64), nullable=True),
|
|
sa.Column("action", sa.String(length=160), nullable=False),
|
|
sa.Column("target_type", sa.String(length=80), nullable=False),
|
|
sa.Column("target_id", sa.String(length=160), nullable=True),
|
|
sa.Column("metadata", sa.JSON(), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.ForeignKeyConstraint(["organization_id"], ["organizations.id"], ondelete="CASCADE"),
|
|
sa.ForeignKeyConstraint(["actor_user_id"], ["users.id"], ondelete="SET NULL"),
|
|
sa.PrimaryKeyConstraint("id"),
|
|
)
|
|
op.create_index("ix_audit_logs_organization_id", "audit_logs", ["organization_id"], unique=False)
|
|
op.create_index("ix_audit_logs_actor_user_id", "audit_logs", ["actor_user_id"], unique=False)
|
|
op.create_index("ix_audit_org_created", "audit_logs", ["organization_id", "created_at"], unique=False)
|
|
op.create_index("ix_audit_org_target", "audit_logs", ["organization_id", "target_type", "target_id"], unique=False)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_index("ix_audit_org_target", table_name="audit_logs")
|
|
op.drop_index("ix_audit_org_created", table_name="audit_logs")
|
|
op.drop_index("ix_audit_logs_actor_user_id", table_name="audit_logs")
|
|
op.drop_index("ix_audit_logs_organization_id", table_name="audit_logs")
|
|
op.drop_table("audit_logs")
|
|
|
|
op.drop_index("ix_idempotency_expiry", table_name="idempotency_records")
|
|
op.drop_index("ix_idempotency_records_user_id", table_name="idempotency_records")
|
|
op.drop_index("ix_idempotency_records_organization_id", table_name="idempotency_records")
|
|
op.drop_table("idempotency_records")
|
|
|
|
op.drop_index("ix_jobs_org_owner", table_name="jobs")
|
|
op.drop_index("ix_jobs_org_status_created", table_name="jobs")
|
|
op.drop_index("ix_jobs_graph_id", table_name="jobs")
|
|
op.drop_index("ix_jobs_project_id", table_name="jobs")
|
|
op.drop_index("ix_jobs_owner_user_id", table_name="jobs")
|
|
op.drop_index("ix_jobs_organization_id", table_name="jobs")
|
|
op.drop_table("jobs")
|