16ee4e0cb3
- Added models for `OAuthClient`, `OAuthState`, and `OAuthAccount`. - Created Pydantic schemas to support OAuth flows, client management, and linked accounts. - Implemented skeleton endpoints for OAuth Provider mode: authorization, token, and revocation. - Updated router imports to include new `/oauth` and `/oauth/provider` routes. - Added Alembic migration script to create OAuth-related database tables. - Enhanced `users` table to allow OAuth-only accounts by making `password_hash` nullable.
43 lines
1.6 KiB
Python
43 lines
1.6 KiB
Python
from sqlalchemy import Boolean, Column, DateTime, String
|
|
from sqlalchemy.dialects.postgresql import JSONB
|
|
from sqlalchemy.orm import relationship
|
|
|
|
from .base import Base, TimestampMixin, UUIDMixin
|
|
|
|
|
|
class User(Base, UUIDMixin, TimestampMixin):
|
|
__tablename__ = "users"
|
|
|
|
email = Column(String(255), unique=True, nullable=False, index=True)
|
|
# Nullable to support OAuth-only users who never set a password
|
|
password_hash = Column(String(255), nullable=True)
|
|
first_name = Column(String(100), nullable=False, default="user")
|
|
last_name = Column(String(100), nullable=True)
|
|
phone_number = Column(String(20))
|
|
is_active = Column(Boolean, default=True, nullable=False, index=True)
|
|
is_superuser = Column(Boolean, default=False, nullable=False, index=True)
|
|
preferences = Column(JSONB)
|
|
locale = Column(String(10), nullable=True, index=True)
|
|
deleted_at = Column(DateTime(timezone=True), nullable=True, index=True)
|
|
|
|
# Relationships
|
|
user_organizations = relationship(
|
|
"UserOrganization", back_populates="user", cascade="all, delete-orphan"
|
|
)
|
|
oauth_accounts = relationship(
|
|
"OAuthAccount", back_populates="user", cascade="all, delete-orphan"
|
|
)
|
|
|
|
@property
|
|
def has_password(self) -> bool:
|
|
"""Check if user can login with password (not OAuth-only)."""
|
|
return self.password_hash is not None
|
|
|
|
@property
|
|
def can_remove_oauth(self) -> bool:
|
|
"""Check if user can safely remove an OAuth account link."""
|
|
return self.has_password or len(self.oauth_accounts) > 1
|
|
|
|
def __repr__(self):
|
|
return f"<User {self.email}>"
|