309 lines
11 KiB
Python
309 lines
11 KiB
Python
"""Split external-system grants from connections and add definition governance.
|
|
|
|
Revision ID: 0027
|
|
Revises: 0026
|
|
Create Date: 2026-08-07
|
|
"""
|
|
|
|
from typing import Sequence, Union
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
from sqlalchemy.dialects import postgresql
|
|
|
|
revision: str = "0027"
|
|
down_revision: Union[str, None] = "0026"
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("revision", sa.Integer(), server_default="1", nullable=False),
|
|
)
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("owner_type", sa.Text(), server_default="platform", nullable=False),
|
|
)
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("owner_user_id", postgresql.UUID(as_uuid=True), nullable=True),
|
|
)
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("visibility", sa.Text(), server_default="selected", nullable=False),
|
|
)
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("trust_level", sa.Text(), server_default="managed", nullable=False),
|
|
)
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("review_status", sa.Text(), server_default="active", nullable=False),
|
|
)
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("egress_policy_id", sa.Text(), nullable=True),
|
|
)
|
|
op.create_foreign_key(
|
|
"fk_external_system_definitions_owner_user",
|
|
"external_system_definitions",
|
|
"users",
|
|
["owner_user_id"],
|
|
["user_id"],
|
|
ondelete="SET NULL",
|
|
)
|
|
op.drop_constraint(
|
|
"uq_external_system_definition_provider_name",
|
|
"external_system_definitions",
|
|
type_="unique",
|
|
)
|
|
op.create_index(
|
|
"uq_external_system_definition_platform_name",
|
|
"external_system_definitions",
|
|
["provider", "name"],
|
|
unique=True,
|
|
postgresql_where=sa.text("owner_type = 'platform'"),
|
|
)
|
|
op.create_index(
|
|
"uq_external_system_definition_user_name",
|
|
"external_system_definitions",
|
|
["owner_user_id", "provider", "name"],
|
|
unique=True,
|
|
postgresql_where=sa.text("owner_type = 'user'"),
|
|
)
|
|
op.execute("UPDATE external_system_definitions SET visibility = access_mode")
|
|
op.execute(
|
|
"""
|
|
UPDATE external_system_definitions d
|
|
SET config = (d.config - 'allowed_post_operations') || jsonb_build_object(
|
|
'operation_mode',
|
|
CASE WHEN d.provider = 'factory_mes' THEN 'upstream_managed' ELSE 'query' END,
|
|
'operation_policies',
|
|
COALESCE(
|
|
(
|
|
SELECT jsonb_object_agg(operation_id, 'read')
|
|
FROM (
|
|
SELECT jsonb_array_elements_text(
|
|
COALESCE(d.config->'allowed_post_operations', '[]'::jsonb)
|
|
) AS operation_id
|
|
UNION
|
|
SELECT operation_id
|
|
FROM (VALUES ('bi_dataset_exec')) defaults(operation_id)
|
|
WHERE d.provider = 'factory_mes'
|
|
) policies
|
|
),
|
|
'{}'::jsonb
|
|
)
|
|
)
|
|
"""
|
|
)
|
|
|
|
op.create_table(
|
|
"external_system_grants",
|
|
sa.Column("definition_id", postgresql.UUID(as_uuid=True), nullable=False),
|
|
sa.Column("user_id", postgresql.UUID(as_uuid=True), nullable=False),
|
|
sa.Column("granted_by", postgresql.UUID(as_uuid=True), nullable=True),
|
|
sa.Column(
|
|
"created_at",
|
|
sa.DateTime(timezone=True),
|
|
server_default=sa.text("now()"),
|
|
nullable=False,
|
|
),
|
|
sa.ForeignKeyConstraint(
|
|
["definition_id"],
|
|
["external_system_definitions.definition_id"],
|
|
ondelete="CASCADE",
|
|
),
|
|
sa.ForeignKeyConstraint(["user_id"], ["users.user_id"], ondelete="CASCADE"),
|
|
sa.ForeignKeyConstraint(["granted_by"], ["users.user_id"], ondelete="SET NULL"),
|
|
sa.PrimaryKeyConstraint("definition_id", "user_id"),
|
|
)
|
|
op.execute(
|
|
"""
|
|
INSERT INTO external_system_grants (definition_id, user_id, granted_by)
|
|
SELECT DISTINCT es.definition_id, es.user_id, d.created_by
|
|
FROM external_systems es
|
|
JOIN external_system_definitions d ON d.definition_id = es.definition_id
|
|
WHERE d.access_mode = 'selected'
|
|
"""
|
|
)
|
|
|
|
op.add_column(
|
|
"external_systems",
|
|
sa.Column("credential_hint", sa.Text(), server_default="***", nullable=False),
|
|
)
|
|
op.add_column(
|
|
"external_systems",
|
|
sa.Column(
|
|
"verified_revision", sa.Integer(), server_default="0", nullable=False
|
|
),
|
|
)
|
|
op.add_column("external_systems", sa.Column("last_error", sa.Text(), nullable=True))
|
|
op.execute(
|
|
"""
|
|
UPDATE external_systems es
|
|
SET verified_revision = d.revision
|
|
FROM external_system_definitions d
|
|
WHERE d.definition_id = es.definition_id
|
|
AND es.status IN ('active', 'invalid')
|
|
AND es.credentials <> '{}'::jsonb
|
|
"""
|
|
)
|
|
op.execute("DELETE FROM external_systems WHERE status = 'pending'")
|
|
op.drop_column("external_systems", "config")
|
|
op.drop_column("external_systems", "connector")
|
|
op.drop_column("external_systems", "provider")
|
|
op.drop_column("external_system_definitions", "access_mode")
|
|
op.create_table(
|
|
"external_system_audits",
|
|
sa.Column("audit_id", postgresql.UUID(as_uuid=True), nullable=False),
|
|
sa.Column("user_id", postgresql.UUID(as_uuid=True), nullable=False),
|
|
sa.Column("task_id", postgresql.UUID(as_uuid=True), nullable=True),
|
|
sa.Column("external_system_id", postgresql.UUID(as_uuid=True), nullable=True),
|
|
sa.Column("definition_id", postgresql.UUID(as_uuid=True), nullable=True),
|
|
sa.Column("definition_revision", sa.Integer(), nullable=False),
|
|
sa.Column("event", sa.Text(), nullable=False),
|
|
sa.Column("operation_id", sa.Text(), nullable=True),
|
|
sa.Column("outcome", sa.Text(), nullable=False),
|
|
sa.Column("status_code", sa.Integer(), nullable=True),
|
|
sa.Column("duration_ms", sa.Integer(), nullable=False),
|
|
sa.Column("response_bytes", sa.BigInteger(), nullable=True),
|
|
sa.Column(
|
|
"detail",
|
|
postgresql.JSONB(astext_type=sa.Text()),
|
|
server_default=sa.text("'{}'::jsonb"),
|
|
nullable=False,
|
|
),
|
|
sa.Column(
|
|
"created_at",
|
|
sa.DateTime(timezone=True),
|
|
server_default=sa.text("now()"),
|
|
nullable=False,
|
|
),
|
|
sa.ForeignKeyConstraint(["user_id"], ["users.user_id"], ondelete="CASCADE"),
|
|
sa.ForeignKeyConstraint(["task_id"], ["tasks.task_id"], ondelete="SET NULL"),
|
|
sa.ForeignKeyConstraint(
|
|
["external_system_id"],
|
|
["external_systems.external_system_id"],
|
|
ondelete="SET NULL",
|
|
),
|
|
sa.ForeignKeyConstraint(
|
|
["definition_id"],
|
|
["external_system_definitions.definition_id"],
|
|
ondelete="SET NULL",
|
|
),
|
|
sa.PrimaryKeyConstraint("audit_id"),
|
|
)
|
|
op.create_index(
|
|
"ix_external_system_audits_user_created",
|
|
"external_system_audits",
|
|
["user_id", "created_at"],
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_index(
|
|
"ix_external_system_audits_user_created",
|
|
table_name="external_system_audits",
|
|
)
|
|
op.drop_table("external_system_audits")
|
|
op.add_column(
|
|
"external_system_definitions",
|
|
sa.Column("access_mode", sa.Text(), server_default="selected", nullable=False),
|
|
)
|
|
op.execute("UPDATE external_system_definitions SET access_mode = visibility")
|
|
op.add_column(
|
|
"external_systems",
|
|
sa.Column(
|
|
"provider", sa.Text(), server_default="generic_openapi", nullable=False
|
|
),
|
|
)
|
|
op.add_column(
|
|
"external_systems",
|
|
sa.Column("connector", sa.Text(), server_default="openapi", nullable=False),
|
|
)
|
|
op.add_column(
|
|
"external_systems",
|
|
sa.Column(
|
|
"config",
|
|
postgresql.JSONB(astext_type=sa.Text()),
|
|
server_default=sa.text("'{}'::jsonb"),
|
|
nullable=False,
|
|
),
|
|
)
|
|
op.execute(
|
|
"""
|
|
UPDATE external_systems es
|
|
SET provider = d.provider
|
|
FROM external_system_definitions d
|
|
WHERE d.definition_id = es.definition_id
|
|
"""
|
|
)
|
|
op.execute(
|
|
"""
|
|
INSERT INTO external_systems (
|
|
external_system_id, user_id, definition_id, provider, connector, name,
|
|
credentials, config, status
|
|
)
|
|
SELECT md5(g.definition_id::text || ':' || g.user_id::text)::uuid,
|
|
g.user_id, g.definition_id, d.provider, 'openapi',
|
|
d.name, '{}'::jsonb, '{}'::jsonb, 'pending'
|
|
FROM external_system_grants g
|
|
JOIN external_system_definitions d ON d.definition_id = g.definition_id
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM external_systems es
|
|
WHERE es.user_id = g.user_id AND es.definition_id = g.definition_id
|
|
)
|
|
"""
|
|
)
|
|
op.execute(
|
|
"""
|
|
UPDATE external_system_definitions d
|
|
SET config = (d.config - 'operation_policies' - 'operation_mode') || jsonb_build_object(
|
|
'allowed_post_operations',
|
|
COALESCE(
|
|
(
|
|
SELECT jsonb_agg(operation_id)
|
|
FROM jsonb_object_keys(
|
|
COALESCE(d.config->'operation_policies', '{}'::jsonb)
|
|
) operation_id
|
|
),
|
|
'[]'::jsonb
|
|
)
|
|
)
|
|
"""
|
|
)
|
|
op.alter_column("external_systems", "provider", server_default=None)
|
|
op.alter_column("external_systems", "config", server_default=None)
|
|
op.drop_column("external_systems", "last_error")
|
|
op.drop_column("external_systems", "verified_revision")
|
|
op.drop_column("external_systems", "credential_hint")
|
|
op.drop_table("external_system_grants")
|
|
op.drop_constraint(
|
|
"fk_external_system_definitions_owner_user",
|
|
"external_system_definitions",
|
|
type_="foreignkey",
|
|
)
|
|
op.drop_index(
|
|
"uq_external_system_definition_user_name",
|
|
table_name="external_system_definitions",
|
|
)
|
|
op.drop_index(
|
|
"uq_external_system_definition_platform_name",
|
|
table_name="external_system_definitions",
|
|
)
|
|
op.create_unique_constraint(
|
|
"uq_external_system_definition_provider_name",
|
|
"external_system_definitions",
|
|
["provider", "name"],
|
|
)
|
|
op.drop_column("external_system_definitions", "egress_policy_id")
|
|
op.drop_column("external_system_definitions", "review_status")
|
|
op.drop_column("external_system_definitions", "trust_level")
|
|
op.drop_column("external_system_definitions", "visibility")
|
|
op.drop_column("external_system_definitions", "owner_user_id")
|
|
op.drop_column("external_system_definitions", "owner_type")
|
|
op.drop_column("external_system_definitions", "revision")
|