62 lines
2.1 KiB
Python
62 lines
2.1 KiB
Python
|
"""add TOTP fields to auth_users and create auth_recovery_code table
|
||
|
|
|
||
|
|
Revision ID: 20260621_08_totp
|
||
|
|
Revises: 20260621_07_auth_login_throttle
|
||
|
|
Create Date: 2026-06-21 00:00:00.000000
|
||
|
|
"""
|
||
|
|
|
||
|
|
from typing import Sequence, Union
|
||
|
|
|
||
|
|
import sqlalchemy as sa
|
||
|
|
from alembic import op
|
||
|
|
|
||
|
|
|
||
|
|
revision: str = "20260621_08_totp"
|
||
|
|
down_revision: Union[str, None] = "20260621_07_auth_login_throttle"
|
||
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
||
|
|
depends_on: Union[str, Sequence[str], None] = None
|
||
|
|
|
||
|
|
|
||
|
|
def upgrade() -> None:
|
||
|
|
# Add totp_secret (nullable) to auth_users — existing rows get NULL, which is correct.
|
||
|
|
op.add_column("auth_users", sa.Column("totp_secret", sa.String(length=64), nullable=True))
|
||
|
|
# Add totp_enabled (NOT NULL) with server_default="0" so existing rows default to false.
|
||
|
|
op.add_column(
|
||
|
|
"auth_users",
|
||
|
|
sa.Column(
|
||
|
|
"totp_enabled",
|
||
|
|
sa.Boolean(),
|
||
|
|
nullable=False,
|
||
|
|
server_default="0",
|
||
|
|
),
|
||
|
|
)
|
||
|
|
|
||
|
|
# Create auth_recovery_code table for one-time TOTP recovery codes.
|
||
|
|
op.create_table(
|
||
|
|
"auth_recovery_code",
|
||
|
|
sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
|
||
|
|
sa.Column("user_id", sa.Integer(), nullable=False),
|
||
|
|
sa.Column("code_hash", sa.String(length=255), nullable=False),
|
||
|
|
sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
|
||
|
|
sa.ForeignKeyConstraint(["user_id"], ["auth_users.id"]),
|
||
|
|
sa.PrimaryKeyConstraint("id"),
|
||
|
|
)
|
||
|
|
op.create_index(
|
||
|
|
op.f("ix_auth_recovery_code_user_id"),
|
||
|
|
"auth_recovery_code",
|
||
|
|
["user_id"],
|
||
|
|
unique=False,
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def downgrade() -> None:
|
||
|
|
# Drop auth_recovery_code table first (has FK to auth_users).
|
||
|
|
op.drop_index(op.f("ix_auth_recovery_code_user_id"), table_name="auth_recovery_code")
|
||
|
|
op.drop_table("auth_recovery_code")
|
||
|
|
|
||
|
|
# Drop the two TOTP columns from auth_users.
|
||
|
|
# Use batch_alter_table for SQLite compatibility (alembic's portable column-drop path).
|
||
|
|
with op.batch_alter_table("auth_users") as batch_op:
|
||
|
|
batch_op.drop_column("totp_enabled")
|
||
|
|
batch_op.drop_column("totp_secret")
|