Merge remote-tracking branch 'upstream/aether-rust-pioneer' into fix-management-token-oauth-jsonb

# Conflicts:
#	crates/aether-data/src/lifecycle/bootstrap/postgres.rs
#	crates/aether-data/src/lifecycle/migrate/tests.rs

crates/aether-data/schema/bootstrap/postgres/001_types_and_tables.sql

@@ -1239,8 +1239,11 @@ CREATE TABLE IF NOT EXISTS public.users (
     password_hash character varying(255),
     role public.userrole DEFAULT 'user'::public.userrole NOT NULL,
     allowed_providers json,
+    allowed_providers_mode text DEFAULT 'unrestricted'::text NOT NULL,
     allowed_api_formats json,
+    allowed_api_formats_mode text DEFAULT 'unrestricted'::text NOT NULL,
     allowed_models json,
+    allowed_models_mode text DEFAULT 'unrestricted'::text NOT NULL,
     model_capability_settings json,
     is_active boolean DEFAULT true NOT NULL,
     is_deleted boolean DEFAULT false NOT NULL,
@@ -1252,11 +1255,48 @@ CREATE TABLE IF NOT EXISTS public.users (
     ldap_username character varying(255),
     email_verified boolean NOT NULL,
     rate_limit integer,
+    rate_limit_mode text DEFAULT 'system'::text NOT NULL,
     metadata json
 );
 
 
 
+--
+-- Name: user_groups; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE IF NOT EXISTS public.user_groups (
+    id character varying(36) NOT NULL,
+    name character varying(100) NOT NULL,
+    normalized_name character varying(100) NOT NULL,
+    description text,
+    priority integer DEFAULT 0 NOT NULL,
+    allowed_providers json,
+    allowed_providers_mode text DEFAULT 'inherit'::text NOT NULL,
+    allowed_api_formats json,
+    allowed_api_formats_mode text DEFAULT 'inherit'::text NOT NULL,
+    allowed_models json,
+    allowed_models_mode text DEFAULT 'inherit'::text NOT NULL,
+    rate_limit integer,
+    rate_limit_mode text DEFAULT 'inherit'::text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+
+
+--
+-- Name: user_group_members; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE IF NOT EXISTS public.user_group_members (
+    group_id character varying(36) NOT NULL,
+    user_id character varying(36) NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+
+
 --
 -- Name: video_tasks; Type: TABLE; Schema: public; Owner: -
 --

crates/aether-data/schema/bootstrap/postgres/003_constraints.sql

@@ -972,6 +972,111 @@ END $mig$;
 
 
 
+--
+-- Name: user_group_members user_group_members_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_group_members
+    ADD CONSTRAINT user_group_members_pkey PRIMARY KEY (group_id, user_id);
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
+--
+-- Name: user_groups user_groups_allowed_api_formats_mode_check; Type: CHECK CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_groups
+    ADD CONSTRAINT user_groups_allowed_api_formats_mode_check CHECK (allowed_api_formats_mode IN ('inherit', 'unrestricted', 'specific', 'deny_all'));
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
+--
+-- Name: user_groups user_groups_allowed_models_mode_check; Type: CHECK CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_groups
+    ADD CONSTRAINT user_groups_allowed_models_mode_check CHECK (allowed_models_mode IN ('inherit', 'unrestricted', 'specific', 'deny_all'));
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
+--
+-- Name: user_groups user_groups_allowed_providers_mode_check; Type: CHECK CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_groups
+    ADD CONSTRAINT user_groups_allowed_providers_mode_check CHECK (allowed_providers_mode IN ('inherit', 'unrestricted', 'specific', 'deny_all'));
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
+--
+-- Name: user_groups user_groups_normalized_name_key; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_groups
+    ADD CONSTRAINT user_groups_normalized_name_key UNIQUE (normalized_name);
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
+--
+-- Name: user_groups user_groups_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_groups
+    ADD CONSTRAINT user_groups_pkey PRIMARY KEY (id);
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
+--
+-- Name: user_groups user_groups_rate_limit_mode_check; Type: CHECK CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_groups
+    ADD CONSTRAINT user_groups_rate_limit_mode_check CHECK (rate_limit_mode IN ('inherit', 'system', 'custom'));
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
 --
 -- Name: user_oauth_links user_oauth_links_pkey; Type: CONSTRAINT; Schema: public; Owner: -
 --

crates/aether-data/schema/bootstrap/postgres/004_indexes.sql

@@ -1021,6 +1021,22 @@ CREATE INDEX IF NOT EXISTS ix_system_configs_id ON public.system_configs USING b
 
 
 
+--
+-- Name: user_group_members_user_id_idx; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX IF NOT EXISTS user_group_members_user_id_idx ON public.user_group_members USING btree (user_id);
+
+
+
+--
+-- Name: user_groups_priority_name_idx; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX IF NOT EXISTS user_groups_priority_name_idx ON public.user_groups USING btree (priority DESC, name, id);
+
+
+
 --
 -- Name: ix_usage_created_at; Type: INDEX; Schema: public; Owner: -
 --

crates/aether-data/schema/bootstrap/postgres/005_foreign_keys.sql

@@ -612,6 +612,36 @@ END $mig$;
 
 
 
+--
+-- Name: user_group_members user_group_members_group_id_fk; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_group_members
+    ADD CONSTRAINT user_group_members_group_id_fk FOREIGN KEY (group_id) REFERENCES public.user_groups(id) ON DELETE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
+--
+-- Name: user_group_members user_group_members_user_id_fk; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+DO $mig$ BEGIN
+  ALTER TABLE ONLY public.user_group_members
+    ADD CONSTRAINT user_group_members_user_id_fk FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+  WHEN duplicate_table THEN NULL;
+  WHEN invalid_table_definition THEN NULL;
+END $mig$;
+
+
+
 --
 -- Name: user_oauth_links user_oauth_links_provider_type_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
 --

crates/aether-data/schema/bootstrap/postgres/006_footer.sql

@@ -1,5 +1,44 @@
 -- Restore a normal lookup path before sqlx records this migration in the
 -- same transaction. sqlx inserts into `_sqlx_migrations` unqualified.
+INSERT INTO public.user_groups (
+    id,
+    name,
+    normalized_name,
+    description,
+    priority,
+    allowed_providers_mode,
+    allowed_api_formats_mode,
+    allowed_models_mode,
+    rate_limit_mode
+)
+VALUES (
+    '00000000-0000-0000-0000-000000000001',
+    'Default',
+    'default',
+    'Default unrestricted group for all users',
+    0,
+    'unrestricted',
+    'unrestricted',
+    'unrestricted',
+    'system'
+)
+ON CONFLICT (id) DO NOTHING;
+
+INSERT INTO public.system_configs (id, key, value, description)
+VALUES (
+    '00000000-0000-0000-0000-000000000002',
+    'default_user_group_id',
+    '"00000000-0000-0000-0000-000000000001"'::json,
+    'Default unrestricted user group'
+)
+ON CONFLICT (key) DO NOTHING;
+
+INSERT INTO public.user_group_members (group_id, user_id)
+SELECT '00000000-0000-0000-0000-000000000001', id
+FROM public.users
+WHERE is_deleted IS FALSE
+ON CONFLICT (group_id, user_id) DO NOTHING;
+
 SELECT pg_catalog.set_config('search_path', 'public', true);
 
 

crates/aether-data/schema/generated/mysql/baseline/001_identity.sql

@@ -13,10 +13,14 @@ CREATE TABLE IF NOT EXISTS users (
     `is_active` TINYINT(1) NOT NULL DEFAULT 1,
     `is_deleted` TINYINT(1) NOT NULL DEFAULT 0,
     `allowed_models` JSON,
+    `allowed_models_mode` VARCHAR(32) NOT NULL DEFAULT 'unrestricted',
     `allowed_providers` JSON,
+    `allowed_providers_mode` VARCHAR(32) NOT NULL DEFAULT 'unrestricted',
     `allowed_api_formats` JSON,
+    `allowed_api_formats_mode` VARCHAR(32) NOT NULL DEFAULT 'unrestricted',
     `model_capability_settings` JSON,
     `rate_limit` INT,
+    `rate_limit_mode` VARCHAR(32) NOT NULL DEFAULT 'system',
     `metadata` JSON,
     `created_at` BIGINT NOT NULL,
     `updated_at` BIGINT NOT NULL,
@@ -28,6 +32,35 @@ CREATE TABLE IF NOT EXISTS users (
     UNIQUE KEY users_username_key (`username`)
 );
 
+CREATE TABLE IF NOT EXISTS user_groups (
+    `id` VARCHAR(64) NOT NULL,
+    `name` VARCHAR(100) NOT NULL,
+    `normalized_name` VARCHAR(100) NOT NULL,
+    `description` LONGTEXT,
+    `priority` INT NOT NULL DEFAULT 0,
+    `allowed_providers` JSON,
+    `allowed_providers_mode` VARCHAR(32) NOT NULL DEFAULT 'inherit',
+    `allowed_api_formats` JSON,
+    `allowed_api_formats_mode` VARCHAR(32) NOT NULL DEFAULT 'inherit',
+    `allowed_models` JSON,
+    `allowed_models_mode` VARCHAR(32) NOT NULL DEFAULT 'inherit',
+    `rate_limit` INT,
+    `rate_limit_mode` VARCHAR(32) NOT NULL DEFAULT 'inherit',
+    `created_at` BIGINT NOT NULL,
+    `updated_at` BIGINT NOT NULL,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY user_groups_normalized_name_key (`normalized_name`),
+    KEY user_groups_priority_name_idx (`priority`, `name`, `id`)
+);
+
+CREATE TABLE IF NOT EXISTS user_group_members (
+    `group_id` VARCHAR(64) NOT NULL,
+    `user_id` VARCHAR(64) NOT NULL,
+    `created_at` BIGINT NOT NULL,
+    PRIMARY KEY (`group_id`, `user_id`),
+    KEY user_group_members_user_id_idx (`user_id`)
+);
+
 CREATE TABLE IF NOT EXISTS api_keys (
     `id` VARCHAR(64) NOT NULL,
     `user_id` VARCHAR(64) NOT NULL,

crates/aether-data/schema/generated/postgres/baseline/001_identity.sql

@@ -13,10 +13,14 @@ CREATE TABLE IF NOT EXISTS public.users (
     is_active boolean DEFAULT true NOT NULL,
     is_deleted boolean DEFAULT false NOT NULL,
     allowed_models jsonb,
+    allowed_models_mode character varying(32) DEFAULT 'unrestricted' NOT NULL,
     allowed_providers jsonb,
+    allowed_providers_mode character varying(32) DEFAULT 'unrestricted' NOT NULL,
     allowed_api_formats jsonb,
+    allowed_api_formats_mode character varying(32) DEFAULT 'unrestricted' NOT NULL,
     model_capability_settings jsonb,
     rate_limit integer,
+    rate_limit_mode character varying(32) DEFAULT 'system' NOT NULL,
     metadata jsonb,
     created_at bigint NOT NULL,
     updated_at bigint NOT NULL,
@@ -29,6 +33,37 @@ ALTER TABLE ONLY public.users ADD CONSTRAINT users_pkey PRIMARY KEY (id);
 ALTER TABLE ONLY public.users ADD CONSTRAINT users_email_key UNIQUE (email);
 ALTER TABLE ONLY public.users ADD CONSTRAINT users_username_key UNIQUE (username);
 
+CREATE TABLE IF NOT EXISTS public.user_groups (
+    id character varying(64) NOT NULL,
+    name character varying(100) NOT NULL,
+    normalized_name character varying(100) NOT NULL,
+    description text,
+    priority integer DEFAULT 0 NOT NULL,
+    allowed_providers jsonb,
+    allowed_providers_mode character varying(32) DEFAULT 'inherit' NOT NULL,
+    allowed_api_formats jsonb,
+    allowed_api_formats_mode character varying(32) DEFAULT 'inherit' NOT NULL,
+    allowed_models jsonb,
+    allowed_models_mode character varying(32) DEFAULT 'inherit' NOT NULL,
+    rate_limit integer,
+    rate_limit_mode character varying(32) DEFAULT 'inherit' NOT NULL,
+    created_at bigint NOT NULL,
+    updated_at bigint NOT NULL
+);
+
+ALTER TABLE ONLY public.user_groups ADD CONSTRAINT user_groups_pkey PRIMARY KEY (id);
+ALTER TABLE ONLY public.user_groups ADD CONSTRAINT user_groups_normalized_name_key UNIQUE (normalized_name);
+CREATE INDEX IF NOT EXISTS user_groups_priority_name_idx ON public.user_groups USING btree (priority, name, id);
+
+CREATE TABLE IF NOT EXISTS public.user_group_members (
+    group_id character varying(64) NOT NULL,
+    user_id character varying(64) NOT NULL,
+    created_at bigint NOT NULL
+);
+
+ALTER TABLE ONLY public.user_group_members ADD CONSTRAINT user_group_members_pkey PRIMARY KEY (group_id, user_id);
+CREATE INDEX IF NOT EXISTS user_group_members_user_id_idx ON public.user_group_members USING btree (user_id);
+
 CREATE TABLE IF NOT EXISTS public.api_keys (
     id character varying(64) NOT NULL,
     user_id character varying(64) NOT NULL,

crates/aether-data/schema/generated/sqlite/baseline/001_identity.sql

@@ -13,10 +13,14 @@ CREATE TABLE IF NOT EXISTS users (
     is_active INTEGER NOT NULL DEFAULT 1,
     is_deleted INTEGER NOT NULL DEFAULT 0,
     allowed_models TEXT,
+    allowed_models_mode TEXT NOT NULL DEFAULT 'unrestricted',
     allowed_providers TEXT,
+    allowed_providers_mode TEXT NOT NULL DEFAULT 'unrestricted',
     allowed_api_formats TEXT,
+    allowed_api_formats_mode TEXT NOT NULL DEFAULT 'unrestricted',
     model_capability_settings TEXT,
     rate_limit INTEGER,
+    rate_limit_mode TEXT NOT NULL DEFAULT 'system',
     metadata TEXT,
     created_at INTEGER NOT NULL,
     updated_at INTEGER NOT NULL,
@@ -27,6 +31,34 @@ CREATE TABLE IF NOT EXISTS users (
     UNIQUE (username)
 );
 
+CREATE TABLE IF NOT EXISTS user_groups (
+    id TEXT PRIMARY KEY NOT NULL,
+    name TEXT NOT NULL,
+    normalized_name TEXT NOT NULL,
+    description TEXT,
+    priority INTEGER NOT NULL DEFAULT 0,
+    allowed_providers TEXT,
+    allowed_providers_mode TEXT NOT NULL DEFAULT 'inherit',
+    allowed_api_formats TEXT,
+    allowed_api_formats_mode TEXT NOT NULL DEFAULT 'inherit',
+    allowed_models TEXT,
+    allowed_models_mode TEXT NOT NULL DEFAULT 'inherit',
+    rate_limit INTEGER,
+    rate_limit_mode TEXT NOT NULL DEFAULT 'inherit',
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (normalized_name)
+);
+CREATE INDEX IF NOT EXISTS user_groups_priority_name_idx ON user_groups (priority, name, id);
+
+CREATE TABLE IF NOT EXISTS user_group_members (
+    group_id TEXT NOT NULL,
+    user_id TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (group_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS user_group_members_user_id_idx ON user_group_members (user_id);
+
 CREATE TABLE IF NOT EXISTS api_keys (
     id TEXT PRIMARY KEY NOT NULL,
     user_id TEXT NOT NULL,

crates/aether-data/schema/logical/001_identity.toml

@@ -64,16 +64,34 @@ name = "allowed_models"
 type = "json"
 nullable = true
 
+[[table.users.columns]]
+name = "allowed_models_mode"
+type = "text"
+length = 32
+default = "unrestricted"
+
 [[table.users.columns]]
 name = "allowed_providers"
 type = "json"
 nullable = true
 
+[[table.users.columns]]
+name = "allowed_providers_mode"
+type = "text"
+length = 32
+default = "unrestricted"
+
 [[table.users.columns]]
 name = "allowed_api_formats"
 type = "json"
 nullable = true
 
+[[table.users.columns]]
+name = "allowed_api_formats_mode"
+type = "text"
+length = 32
+default = "unrestricted"
+
 [[table.users.columns]]
 name = "model_capability_settings"
 type = "json"
@@ -84,6 +102,12 @@ name = "rate_limit"
 type = "int32"
 nullable = true
 
+[[table.users.columns]]
+name = "rate_limit_mode"
+type = "text"
+length = 32
+default = "system"
+
 [[table.users.columns]]
 name = "metadata"
 type = "json"
@@ -122,6 +146,119 @@ columns = ["email"]
 name = "users_username_key"
 columns = ["username"]
 
+[table.user_groups]
+domain = "identity"
+order = 15
+primary_key = ["id"]
+
+[[table.user_groups.columns]]
+name = "id"
+type = "text_id"
+length = 64
+
+[[table.user_groups.columns]]
+name = "name"
+type = "text"
+length = 100
+
+[[table.user_groups.columns]]
+name = "normalized_name"
+type = "text"
+length = 100
+
+[[table.user_groups.columns]]
+name = "description"
+type = "long_text"
+nullable = true
+
+[[table.user_groups.columns]]
+name = "priority"
+type = "int32"
+default = 0
+
+[[table.user_groups.columns]]
+name = "allowed_providers"
+type = "json"
+nullable = true
+
+[[table.user_groups.columns]]
+name = "allowed_providers_mode"
+type = "text"
+length = 32
+default = "inherit"
+
+[[table.user_groups.columns]]
+name = "allowed_api_formats"
+type = "json"
+nullable = true
+
+[[table.user_groups.columns]]
+name = "allowed_api_formats_mode"
+type = "text"
+length = 32
+default = "inherit"
+
+[[table.user_groups.columns]]
+name = "allowed_models"
+type = "json"
+nullable = true
+
+[[table.user_groups.columns]]
+name = "allowed_models_mode"
+type = "text"
+length = 32
+default = "inherit"
+
+[[table.user_groups.columns]]
+name = "rate_limit"
+type = "int32"
+nullable = true
+
+[[table.user_groups.columns]]
+name = "rate_limit_mode"
+type = "text"
+length = 32
+default = "inherit"
+
+[[table.user_groups.columns]]
+name = "created_at"
+type = "unix_seconds"
+
+[[table.user_groups.columns]]
+name = "updated_at"
+type = "unix_seconds"
+
+[[table.user_groups.uniques]]
+name = "user_groups_normalized_name_key"
+columns = ["normalized_name"]
+
+[[table.user_groups.indexes]]
+name = "user_groups_priority_name_idx"
+columns = ["priority", "name", "id"]
+
+[table.user_group_members]
+domain = "identity"
+order = 16
+primary_key = ["group_id", "user_id"]
+
+[[table.user_group_members.columns]]
+name = "group_id"
+type = "text_id"
+length = 64
+
+[[table.user_group_members.columns]]
+name = "user_id"
+type = "text_id"
+length = 64
+
+[[table.user_group_members.columns]]
+name = "created_at"
+type = "unix_seconds"
+
+[[table.user_group_members.indexes]]
+name = "user_group_members_user_id_idx"
+columns = ["user_id"]
+
 [table.api_keys]
 domain = "identity"
 order = 20