hansjone/netx
1
0
Fork 0
mirror of https://github.com/hansjone/netx.git synced 2026-10-09 03:10:46 +08:00
Code Issues Projects Releases 1 Packages Wiki Activity Actions 2
netx/docs/ALEMBIC.md
oliver 20c2fcd496 Harden auth with revocable sessions, cookies, and single-login default. 
Issue short-lived access JWTs backed by AuthSession rows, HttpOnly cookies with refresh rotation, idle timeout, session management UI, WebCRT ownership caps, and optional Redis login rate limits; new logins revoke other sessions by default.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-06 14:13:37 +08:00

1.8 KiB
Raw Blame History

Alembic (schema migrations)

Schema evolution uses Alembic. On API startup, netx automatically runs alembic upgrade head (same patches as netx_api/schema_patches.py). You normally do not need extra env flags.

What happens on boot

  1. create_all — create any missing tables from ORM metadata
  2. alembic upgrade head — apply revisions (idempotent brownfield patches)
  3. Auth column safety-net ensures (before admin bootstrap)
  4. Legacy inline ALTER block is skipped by default (already covered by Alembic)

Commands (optional / CI)

cd netx
.\.venv\Scripts\alembic.exe upgrade head
.\.venv\Scripts\alembic.exe current
.\.venv\Scripts\alembic.exe history

Brownfield DB that already received old startup DDL

First boot after this change will run upgrade head. Patches are idempotent. If Alembic history was never stamped and you prefer to mark current without re-running:

.\.venv\Scripts\alembic.exe stamp head

Env overrides (usually leave defaults)

Variable Default Meaning
NETX_ALEMBIC_UPGRADE_ON_START true Run alembic upgrade head on API start. Set false only if a separate migrate job owns upgrades.
NETX_SKIP_LEGACY_STARTUP_DDL true Skip the duplicate inline ALTER path. Set false only as emergency fallback.
NETX_DATABASE_URL — Same URL Alembic reads via netx_api.config.settings.

Revisions

Revision Purpose
20260802_scopes app_user.scopes / api_token.scopes
20260802_legacy Shared brownfield patches (alarms, inventory, managed_ne, topology, port traffic, key-alert, …)
20260806_auth_session Revocable JWT login sessions (auth_session)
20260806_auth_refresh Refresh token columns on auth_session