1445043649
107 lines
4.4 KiB
Python
107 lines
4.4 KiB
Python
"""SQLAlchemy-backed external user repository (Stage 1 PR1).
|
|
|
|
Built but NOT yet wired to any auth path — the X-External-User-Id
|
|
passthrough that calls ``upsert`` lands in a later track-2 PR. ``upsert``
|
|
is idempotent on (service_account_id, external_id).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
from datetime import UTC, datetime
|
|
from typing import Any
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
|
|
|
|
from deerflow.persistence.external_user.model import ExternalUserRow
|
|
|
|
|
|
class ExternalUserRepository:
|
|
def __init__(self, session_factory: async_sessionmaker[AsyncSession]) -> None:
|
|
self._sf = session_factory
|
|
|
|
@staticmethod
|
|
def _row_to_dict(row: ExternalUserRow) -> dict[str, Any]:
|
|
return {
|
|
"id": row.id,
|
|
"workspace_id": row.workspace_id,
|
|
"service_account_id": row.service_account_id,
|
|
"external_id": row.external_id,
|
|
"display_name": row.display_name,
|
|
"metadata": dict(row.metadata_json or {}),
|
|
"created_at": row.created_at.isoformat() if row.created_at else None,
|
|
"last_seen_at": row.last_seen_at.isoformat() if row.last_seen_at else None,
|
|
}
|
|
|
|
async def get(self, external_user_id: str) -> dict[str, Any] | None:
|
|
async with self._sf() as session:
|
|
row = await session.get(ExternalUserRow, external_user_id)
|
|
return self._row_to_dict(row) if row else None
|
|
|
|
async def get_by_external_id(self, *, service_account_id: str, external_id: str) -> dict[str, Any] | None:
|
|
async with self._sf() as session:
|
|
result = await session.execute(
|
|
select(ExternalUserRow).where(
|
|
ExternalUserRow.service_account_id == service_account_id,
|
|
ExternalUserRow.external_id == external_id,
|
|
)
|
|
)
|
|
row = result.scalar_one_or_none()
|
|
return self._row_to_dict(row) if row else None
|
|
|
|
async def list_by_workspace(self, workspace_id: str) -> list[dict[str, Any]]:
|
|
async with self._sf() as session:
|
|
result = await session.execute(select(ExternalUserRow).where(ExternalUserRow.workspace_id == workspace_id).order_by(ExternalUserRow.created_at.desc()))
|
|
return [self._row_to_dict(r) for r in result.scalars()]
|
|
|
|
async def upsert(
|
|
self,
|
|
*,
|
|
workspace_id: str,
|
|
service_account_id: str,
|
|
external_id: str,
|
|
display_name: str | None = None,
|
|
metadata: dict[str, Any] | None = None,
|
|
) -> dict[str, Any]:
|
|
"""Insert a new external user or refresh ``last_seen_at`` on an
|
|
existing (service_account_id, external_id) row.
|
|
|
|
``display_name`` and ``metadata`` are only written when explicitly
|
|
passed (non-None); ``None`` means "leave unchanged" — you cannot
|
|
clear ``display_name`` back to None via this method. ``workspace_id``
|
|
is only used on insert; it is ignored on update."""
|
|
now = datetime.now(UTC)
|
|
async with self._sf() as session:
|
|
result = await session.execute(
|
|
select(ExternalUserRow).where(
|
|
ExternalUserRow.service_account_id == service_account_id,
|
|
ExternalUserRow.external_id == external_id,
|
|
)
|
|
)
|
|
row = result.scalar_one_or_none()
|
|
if row is None:
|
|
row = ExternalUserRow(
|
|
id=str(uuid.uuid4()),
|
|
workspace_id=workspace_id,
|
|
service_account_id=service_account_id,
|
|
external_id=external_id,
|
|
display_name=display_name,
|
|
metadata_json=metadata or {},
|
|
created_at=now,
|
|
last_seen_at=now,
|
|
)
|
|
# NOTE: concurrent inserts of the same pair will raise IntegrityError
|
|
# from uq_external_users_sa_external — the future auth caller should
|
|
# catch it and re-read rather than treat it as fatal.
|
|
session.add(row)
|
|
else:
|
|
row.last_seen_at = now
|
|
if display_name is not None:
|
|
row.display_name = display_name
|
|
if metadata is not None:
|
|
row.metadata_json = metadata
|
|
await session.commit()
|
|
await session.refresh(row)
|
|
return self._row_to_dict(row)
|