191 lines
7.6 KiB
Python
191 lines
7.6 KiB
Python
from __future__ import annotations
|
|
|
|
from datetime import datetime
|
|
from typing import Any
|
|
import uuid
|
|
|
|
from sqlalchemy import DateTime, Index, Integer, JSON, String, Text, UniqueConstraint
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
|
|
from govoplan_core.db.base import Base, TimestampMixin
|
|
|
|
|
|
def new_uuid() -> str:
|
|
return str(uuid.uuid4())
|
|
|
|
|
|
class DevicePublicKey(Base, TimestampMixin):
|
|
__tablename__ = "identity_trust_device_keys"
|
|
__table_args__ = (
|
|
UniqueConstraint("tenant_id", "key_id", name="uq_identity_trust_device_key"),
|
|
UniqueConstraint(
|
|
"tenant_id",
|
|
"idempotency_key",
|
|
name="uq_identity_trust_device_idempotency",
|
|
),
|
|
Index(
|
|
"ix_identity_trust_device_account",
|
|
"tenant_id",
|
|
"account_id",
|
|
"status",
|
|
),
|
|
)
|
|
|
|
id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
|
|
tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
|
|
identity_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
account_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
device_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
key_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
algorithm: Mapped[str] = mapped_column(String(120), nullable=False)
|
|
public_jwk: Mapped[dict[str, Any]] = mapped_column(JSON, nullable=False)
|
|
purpose: Mapped[str] = mapped_column(String(40), nullable=False)
|
|
assurance_level: Mapped[str] = mapped_column(String(80), nullable=False)
|
|
attestation_ref: Mapped[str | None] = mapped_column(String(1000), nullable=True)
|
|
status: Mapped[str] = mapped_column(
|
|
String(30), default="active", nullable=False, index=True
|
|
)
|
|
epoch: Mapped[int] = mapped_column(Integer, default=1, nullable=False)
|
|
registration_digest: Mapped[str] = mapped_column(String(64), nullable=False)
|
|
idempotency_key: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
registered_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False
|
|
)
|
|
expires_at: Mapped[datetime | None] = mapped_column(
|
|
DateTime(timezone=True), nullable=True, index=True
|
|
)
|
|
revoked_at: Mapped[datetime | None] = mapped_column(
|
|
DateTime(timezone=True), nullable=True, index=True
|
|
)
|
|
revocation_reason: Mapped[str | None] = mapped_column(Text, nullable=True)
|
|
created_by: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
|
updated_by: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
|
|
|
|
|
class TrustKeyEpoch(Base, TimestampMixin):
|
|
__tablename__ = "identity_trust_key_epochs"
|
|
__table_args__ = (
|
|
UniqueConstraint(
|
|
"tenant_id",
|
|
"subject_kind",
|
|
"subject_id",
|
|
"epoch",
|
|
name="uq_identity_trust_key_epoch",
|
|
),
|
|
UniqueConstraint(
|
|
"tenant_id",
|
|
"idempotency_key",
|
|
name="uq_identity_trust_epoch_idempotency",
|
|
),
|
|
Index(
|
|
"ix_identity_trust_epoch_current",
|
|
"tenant_id",
|
|
"subject_kind",
|
|
"subject_id",
|
|
"state",
|
|
),
|
|
)
|
|
|
|
id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
|
|
tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
|
|
subject_kind: Mapped[str] = mapped_column(String(40), nullable=False, index=True)
|
|
subject_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
epoch: Mapped[int] = mapped_column(Integer, nullable=False)
|
|
previous_epoch: Mapped[int | None] = mapped_column(Integer, nullable=True)
|
|
state: Mapped[str] = mapped_column(String(30), nullable=False, index=True)
|
|
history_policy: Mapped[str] = mapped_column(String(80), nullable=False)
|
|
reason: Mapped[str] = mapped_column(Text, nullable=False)
|
|
access_decision_ref: Mapped[str] = mapped_column(String(1000), nullable=False)
|
|
idempotency_key: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
request_digest: Mapped[str] = mapped_column(String(64), nullable=False)
|
|
effective_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False
|
|
)
|
|
created_by: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
|
|
|
|
|
class AssuranceEvidence(Base, TimestampMixin):
|
|
__tablename__ = "identity_trust_assurance_evidence"
|
|
__table_args__ = (
|
|
UniqueConstraint(
|
|
"tenant_id",
|
|
"evidence_ref",
|
|
name="uq_identity_trust_assurance_ref",
|
|
),
|
|
Index(
|
|
"ix_identity_trust_assurance_account",
|
|
"tenant_id",
|
|
"account_id",
|
|
"verified_at",
|
|
),
|
|
)
|
|
|
|
id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
|
|
tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
|
|
account_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
device_key_id: Mapped[str | None] = mapped_column(
|
|
String(255), nullable=True, index=True
|
|
)
|
|
evidence_ref: Mapped[str] = mapped_column(String(1000), nullable=False)
|
|
assurance_level: Mapped[str] = mapped_column(String(80), nullable=False)
|
|
provider_id: Mapped[str] = mapped_column(String(120), nullable=False)
|
|
verified_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False
|
|
)
|
|
expires_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False, index=True
|
|
)
|
|
provenance: Mapped[dict[str, Any]] = mapped_column(
|
|
JSON, default=dict, nullable=False
|
|
)
|
|
recorded_by: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
|
|
|
|
|
class KeyAccessDecisionRecord(Base, TimestampMixin):
|
|
__tablename__ = "identity_trust_key_access_decisions"
|
|
__table_args__ = (
|
|
UniqueConstraint(
|
|
"tenant_id",
|
|
"decision_ref",
|
|
name="uq_identity_trust_key_access_decision",
|
|
),
|
|
Index(
|
|
"ix_identity_trust_key_access_subject",
|
|
"tenant_id",
|
|
"subject_kind",
|
|
"subject_id",
|
|
"created_at",
|
|
),
|
|
)
|
|
|
|
id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
|
|
tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
|
|
decision_ref: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
request_digest: Mapped[str] = mapped_column(String(64), nullable=False)
|
|
account_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
device_key_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
subject_kind: Mapped[str] = mapped_column(String(40), nullable=False, index=True)
|
|
subject_id: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
|
|
key_epoch: Mapped[int] = mapped_column(Integer, nullable=False)
|
|
access_decision_ref: Mapped[str] = mapped_column(String(1000), nullable=False)
|
|
purpose: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
allowed: Mapped[bool] = mapped_column(nullable=False)
|
|
reason: Mapped[str] = mapped_column(Text, nullable=False)
|
|
resource_ref: Mapped[str | None] = mapped_column(String(1000), nullable=True)
|
|
function_assignment_id: Mapped[str | None] = mapped_column(
|
|
String(255), nullable=True
|
|
)
|
|
delegation_id: Mapped[str | None] = mapped_column(String(255), nullable=True)
|
|
provenance: Mapped[dict[str, Any]] = mapped_column(
|
|
JSON, default=dict, nullable=False
|
|
)
|
|
|
|
|
|
__all__ = [
|
|
"AssuranceEvidence",
|
|
"DevicePublicKey",
|
|
"KeyAccessDecisionRecord",
|
|
"TrustKeyEpoch",
|
|
"new_uuid",
|
|
]
|