雷电芽衣
edf9d73c3e
Mirror the Console registration feature: native hook catalog with activation plans, one-command install that embeds both credentials in exclusively created owner-only files (mktemp on POSIX, icacls on Windows), sh/PowerShell tabs, never-expiring default token, focus-visible styles, merged i18n keys, and the matching e2e specs. The server previously answered /v1/auth/token with the 7-day Better Auth session token and ignored ttl_seconds. It now issues opaque 32-byte API tokens stored as SHA-256 hashes (migration 003), honours ttl_seconds with null meaning no expiry, and resolves bearer values as API tokens before session validation. Issuance requires a session credential. Claude-Session: https://claude.ai/code/session_01QoUjdc7HGKTsgj5GhG8HvF
25 lines
614 B
PL/PgSQL
25 lines
614 B
PL/PgSQL
-- Opaque API tokens stored as SHA-256 hashes.
|
|
|
|
BEGIN;
|
|
|
|
CREATE TABLE IF NOT EXISTS api_tokens (
|
|
token_id TEXT NOT NULL PRIMARY KEY,
|
|
user_id TEXT NOT NULL REFERENCES users (user_id),
|
|
org_id TEXT NOT NULL REFERENCES organizations (org_id),
|
|
token_hash TEXT NOT NULL UNIQUE,
|
|
issued_at BIGINT NOT NULL,
|
|
expires_at BIGINT
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_api_tokens_user_id ON api_tokens (user_id);
|
|
|
|
INSERT INTO schema_versions (version, applied_at, description)
|
|
VALUES (
|
|
3,
|
|
EXTRACT(EPOCH FROM NOW())::BIGINT * 1000,
|
|
'Opaque API tokens'
|
|
)
|
|
ON CONFLICT (version) DO NOTHING;
|
|
|
|
COMMIT;
|