feat: add authentication and user management with Authentik integration

- Add PostgreSQL database with async SQLAlchemy - Add Alembic migrations for schema management - Add User, Role, UserPreferences, ApiKey models - Add auth endpoints: /auth/me, /auth/users, /auth/users/sync-from-authentik - Add token validation via Authentik userinfo endpoint - Add bulk user sync from Authentik admin API - Add database health check to diagnostics 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-01 20:25:03 +01:00
parent cdb6344013
commit 4f45f9bf37
22 changed files with 1753 additions and 23 deletions
@@ -0,0 +1,138 @@
+"""Create auth tables
+
+Revision ID: 001
+Revises:
+Create Date: 2026-01-01
+
+Creates the initial authentication and authorization tables:
+- users: User accounts synced from Authentik
+- roles: Domain-scoped permission roles
+- user_roles: User-Role association table
+- user_preferences: User settings and preferences
+- api_keys: API key authentication
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "001"
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Users table
+    op.create_table(
+        "users",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("authentik_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("email", sa.String(255), nullable=False),
+        sa.Column("name", sa.String(255), nullable=False),
+        sa.Column("avatar_url", sa.String(500), nullable=True),
+        sa.Column("api_keys_enabled", sa.Boolean(), nullable=False, server_default="true"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("last_login", sa.DateTime(timezone=True), nullable=True),
+    )
+    op.create_index("ix_users_authentik_id", "users", ["authentik_id"], unique=True)
+    op.create_index("ix_users_email", "users", ["email"], unique=True)
+
+    # Roles table
+    op.create_table(
+        "roles",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("name", sa.String(100), nullable=False, comment="Role name in format domain:action"),
+        sa.Column("domain", sa.String(50), nullable=False, comment="Permission domain"),
+        sa.Column("action", sa.String(20), nullable=False, comment="Permission action"),
+        sa.Column("authentik_group", sa.String(255), nullable=True, comment="Corresponding Authentik group name"),
+    )
+    op.create_index("ix_roles_name", "roles", ["name"], unique=True)
+    op.create_index("ix_roles_domain", "roles", ["domain"])
+    op.create_index("ix_roles_authentik_group", "roles", ["authentik_group"], unique=True)
+
+    # User-Role association table
+    op.create_table(
+        "user_roles",
+        sa.Column("user_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column("role_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("roles.id", ondelete="CASCADE"), primary_key=True),
+    )
+
+    # User preferences table
+    op.create_table(
+        "user_preferences",
+        sa.Column("user_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column("theme", sa.String(20), nullable=False, server_default="system", comment="Theme preference"),
+        sa.Column("default_room", sa.String(50), nullable=False, server_default="front-hall", comment="Default room"),
+        sa.Column("preferences_json", postgresql.JSONB(), nullable=False, server_default="{}"),
+    )
+
+    # API keys table
+    op.create_table(
+        "api_keys",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("user_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("name", sa.String(100), nullable=False, comment="Human-readable key name"),
+        sa.Column("key_hash", sa.String(255), nullable=False, comment="SHA-256 hash of the API key"),
+        sa.Column("key_prefix", sa.String(8), nullable=False, comment="First 8 chars for identification"),
+        sa.Column("scopes", postgresql.ARRAY(sa.String()), nullable=True, comment="Optional scope restriction"),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_api_keys_user_id", "api_keys", ["user_id"])
+
+    # Seed initial roles (domain:action combinations)
+    roles_table = sa.table(
+        "roles",
+        sa.column("id", postgresql.UUID),
+        sa.column("name", sa.String),
+        sa.column("domain", sa.String),
+        sa.column("action", sa.String),
+        sa.column("authentik_group", sa.String),
+    )
+
+    domains = [
+        "control-room",
+        "library",
+        "media",
+        "ai",
+        "housekeeper",
+        "developer",
+        "documents",
+        "gaming",
+        "admin",
+    ]
+    actions = ["viewer", "user", "editor", "admin"]
+
+    roles_data = []
+    for domain in domains:
+        for action in actions:
+            role_name = f"{domain}:{action}"
+            authentik_group = f"tatlock-{domain}-{action}"
+            roles_data.append({
+                "id": sa.text("gen_random_uuid()"),
+                "name": role_name,
+                "domain": domain,
+                "action": action,
+                "authentik_group": authentik_group,
+            })
+
+    # Insert roles using raw SQL for UUID generation
+    for role in roles_data:
+        op.execute(
+            f"""
+            INSERT INTO roles (id, name, domain, action, authentik_group)
+            VALUES (gen_random_uuid(), '{role["name"]}', '{role["domain"]}', '{role["action"]}', '{role["authentik_group"]}')
+            """
+        )
+
+
+def downgrade() -> None:
+    op.drop_table("api_keys")
+    op.drop_table("user_preferences")
+    op.drop_table("user_roles")
+    op.drop_table("roles")
+    op.drop_table("users")