i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 01:10:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: align management token oauth permissions and jsonb schema

Browse Source
This commit is contained in:
Entropy.Xu
2026-05-10 01:47:48 +08:00
parent 4a64d078f3
commit 545299fc62
11 changed files with 308 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
crates/aether-data/migrations/postgres/20260403000000_baseline.sql
View File

@@ -351,7 +351,8 @@ CREATE TABLE IF NOT EXISTS public.management_tokens (
token_prefix character varying(12),
name character varying(100) NOT NULL,
description text,
allowed_ips json,
allowed_ips jsonb,
permissions jsonb,
expires_at timestamp with time zone,
last_used_at timestamp with time zone,
last_used_ip character varying(45),
@@ -359,7 +360,7 @@ CREATE TABLE IF NOT EXISTS public.management_tokens (
is_active boolean DEFAULT true NOT NULL,
created_at timestamp with time zone DEFAULT now() NOT NULL,
updated_at timestamp with time zone DEFAULT now() NOT NULL,
CONSTRAINT check_allowed_ips_not_empty CHECK (((allowed_ips IS NULL) OR ((allowed_ips)::text = 'null'::text) OR (json_array_length(allowed_ips) > 0)))
CONSTRAINT check_allowed_ips_not_empty CHECK (CASE WHEN ((allowed_ips IS NULL) OR (allowed_ips = 'null'::jsonb)) THEN true WHEN (jsonb_typeof(allowed_ips) = 'array'::text) THEN (jsonb_array_length(allowed_ips) > 0) ELSE false END)
);

18
crates/aether-data/migrations/postgres/20260509000000_normalize_management_token_jsonb.sql Normal file
View File

@@ -0,0 +1,18 @@
ALTER TABLE public.management_tokens
DROP CONSTRAINT IF EXISTS check_allowed_ips_not_empty;
ALTER TABLE public.management_tokens
ADD COLUMN IF NOT EXISTS permissions jsonb;
ALTER TABLE public.management_tokens
ALTER COLUMN allowed_ips TYPE jsonb USING allowed_ips::jsonb,
ALTER COLUMN permissions TYPE jsonb USING permissions::jsonb;
ALTER TABLE public.management_tokens
ADD CONSTRAINT check_allowed_ips_not_empty CHECK (
CASE
WHEN allowed_ips IS NULL OR allowed_ips = 'null'::jsonb THEN TRUE
WHEN jsonb_typeof(allowed_ips) = 'array' THEN jsonb_array_length(allowed_ips) > 0
ELSE FALSE
END
);

5
crates/aether-data/schema/bootstrap/postgres/001_types_and_tables.sql
View File

@@ -352,7 +352,8 @@ CREATE TABLE IF NOT EXISTS public.management_tokens (
token_prefix character varying(12),
name character varying(100) NOT NULL,
description text,
allowed_ips json,
allowed_ips jsonb,
permissions jsonb,
expires_at timestamp with time zone,
last_used_at timestamp with time zone,
last_used_ip character varying(45),
@@ -360,7 +361,7 @@ CREATE TABLE IF NOT EXISTS public.management_tokens (
is_active boolean DEFAULT true NOT NULL,
created_at timestamp with time zone DEFAULT now() NOT NULL,
updated_at timestamp with time zone DEFAULT now() NOT NULL,
CONSTRAINT check_allowed_ips_not_empty CHECK (((allowed_ips IS NULL) OR ((allowed_ips)::text = 'null'::text) OR (json_array_length(allowed_ips) > 0)))
CONSTRAINT check_allowed_ips_not_empty CHECK (CASE WHEN ((allowed_ips IS NULL) OR (allowed_ips = 'null'::jsonb)) THEN true WHEN (jsonb_typeof(allowed_ips) = 'array'::text) THEN (jsonb_array_length(allowed_ips) > 0) ELSE false END)
);

5
crates/aether-data/schema/drivers/postgres/baseline/001_types_and_tables.sql
View File

@@ -351,7 +351,8 @@ CREATE TABLE IF NOT EXISTS public.management_tokens (
token_prefix character varying(12),
name character varying(100) NOT NULL,
description text,
allowed_ips json,
allowed_ips jsonb,
permissions jsonb,
expires_at timestamp with time zone,
last_used_at timestamp with time zone,
last_used_ip character varying(45),
@@ -359,7 +360,7 @@ CREATE TABLE IF NOT EXISTS public.management_tokens (
is_active boolean DEFAULT true NOT NULL,
created_at timestamp with time zone DEFAULT now() NOT NULL,
updated_at timestamp with time zone DEFAULT now() NOT NULL,
CONSTRAINT check_allowed_ips_not_empty CHECK (((allowed_ips IS NULL) OR ((allowed_ips)::text = 'null'::text) OR (json_array_length(allowed_ips) > 0)))
CONSTRAINT check_allowed_ips_not_empty CHECK (CASE WHEN ((allowed_ips IS NULL) OR (allowed_ips = 'null'::jsonb)) THEN true WHEN (jsonb_typeof(allowed_ips) = 'array'::text) THEN (jsonb_array_length(allowed_ips) > 0) ELSE false END)
);

2
crates/aether-data/src/lifecycle/bootstrap/postgres.rs
View File

@@ -7,7 +7,7 @@ use tracing::info;
// Generated by build.rs from schema/bootstrap/postgres.
pub(crate) static EMPTY_DATABASE_SNAPSHOT_SQL: &str =
include_str!(concat!(env!("OUT_DIR"), "/empty_database_snapshot.sql"));
pub(crate) const EMPTY_DATABASE_SNAPSHOT_CUTOFF_VERSION: i64 = 20260508000000;
pub(crate) const EMPTY_DATABASE_SNAPSHOT_CUTOFF_VERSION: i64 = 20260509000000;
const PUBLIC_BASE_TABLE_COUNT_SQL: &str = r#"
SELECT COUNT(*)::BIGINT

40
crates/aether-data/src/lifecycle/migrate/tests.rs
View File

@@ -294,6 +294,7 @@ fn empty_database_snapshot_covers_current_cutoff_versions() {
20260507000000,
20260507120000,
20260508000000,
20260509000000,
]
);
}
@@ -394,6 +395,44 @@ fn provider_api_keys_api_formats_remains_nullable_in_baselines() {
.contains("pak.allow_auth_channel_mismatch_formats IS NULL"));
}
#[test]
fn management_tokens_json_columns_are_normalized_to_jsonb_in_postgres_schema_paths() {
let normalization_migration = POSTGRES_MIGRATOR
.iter()
.find(|migration| migration.version == 20260509000000)
.expect("management token jsonb normalization migration should be embedded");
assert!(normalization_migration
.sql
.contains("ALTER COLUMN allowed_ips TYPE jsonb USING allowed_ips::jsonb"));
assert!(normalization_migration
.sql
.contains("ALTER COLUMN permissions TYPE jsonb USING permissions::jsonb"));
assert!(normalization_migration
.sql
.contains("jsonb_array_length(allowed_ips) > 0"));
assert!(EMPTY_DATABASE_SNAPSHOT_SQL.contains("allowed_ips jsonb,"));
assert!(EMPTY_DATABASE_SNAPSHOT_SQL.contains("permissions jsonb,"));
assert!(EMPTY_DATABASE_SNAPSHOT_SQL.contains("jsonb_array_length(allowed_ips)"));
let bootstrap_schema =
include_str!("../../../schema/bootstrap/postgres/001_types_and_tables.sql");
assert!(bootstrap_schema.contains("allowed_ips jsonb,"));
assert!(bootstrap_schema.contains("permissions jsonb,"));
assert!(bootstrap_schema.contains("jsonb_array_length(allowed_ips)"));
let driver_schema =
include_str!("../../../schema/drivers/postgres/baseline/001_types_and_tables.sql");
assert!(driver_schema.contains("allowed_ips jsonb,"));
assert!(driver_schema.contains("permissions jsonb,"));
assert!(driver_schema.contains("jsonb_array_length(allowed_ips)"));
let generated_identity =
include_str!("../../../schema/generated/postgres/baseline/001_identity.sql");
assert!(generated_identity.contains("allowed_ips jsonb,"));
assert!(generated_identity.contains("permissions jsonb,"));
}
#[test]
fn provider_api_keys_api_key_is_nullable() {
let baseline_migration = POSTGRES_MIGRATOR
@@ -1022,6 +1061,7 @@ fn pending_migrations_from_applied_skips_versions_already_applied() {
20260507000000,
20260507120000,
20260508000000,
20260509000000,
]
);
}

10
crates/aether-data/src/repository/management_tokens/postgres.rs
View File

@@ -123,8 +123,8 @@ VALUES (
$4,
$5,
$6,
$7,
$8,
$7::jsonb,
$8::jsonb,
CASE
WHEN $9::bigint IS NULL THEN NULL
ELSE to_timestamp($9::double precision)
@@ -158,10 +158,10 @@ SET name = COALESCE($2, name),
END,
allowed_ips = CASE
WHEN $5 THEN NULL
WHEN $6::json IS NULL THEN allowed_ips
ELSE $6
WHEN $6::jsonb IS NULL THEN allowed_ips
ELSE $6::jsonb
END,
permissions = COALESCE($7::json, permissions),
permissions = COALESCE($7::jsonb, permissions),
expires_at = CASE
WHEN $8 THEN NULL
WHEN $9::bigint IS NULL THEN expires_at