mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-30 14:57:59 +00:00
zooqueenandHanzo Dev
472b2a4643
A person is admitted when IAM says they administer the app's org, or when an ADMIN vouches for them: through a membership that came from that ADMIN's invitation, or through such an invitation pending for their verified address. The rule (isAdmitted, with vouches: an ADMIN who is not disabled) decides every IAM sign-in, linked or new. A linked account that fails it is refused and its sessions and API tokens are deleted. Sessions and API tokens work only while their holder is linked to IAM, not disabled and admitted (credentialIsCurrent over readStanding); a team token's holder is the organisation's owner. Accepting an invitation needs its sender to vouch for it now, and the membership records that sender as the member's inviter. The cutoff is the migration that ships with this: 1_iam_only_sign_in deletes every session and API token and adds OrganisationMember.invitedById beside OrganisationMemberInvite.inviterId, NULL for every row already standing, so nothing from before it vouches for anyone. IAM_ONLY_SINCE goes. IAM_PROVIDER names the one provider in lib. The e2e fixture admits its users through one ADMIN voucher. Tests cover the decision for returning and first sign-ins, vouching, credentials, and the migration against real SQLite. Co-authored-by: Hanzo Dev <[email protected]>
13 lines
791 B
SQL
13 lines
791 B
SQL
-- Who sent each invitation. NULL for every invitation already standing: those
|
|
-- were sent under the old sign-in rules and admit nobody.
|
|
ALTER TABLE "OrganisationMemberInvite" ADD COLUMN "inviterId" INTEGER CONSTRAINT "OrganisationMemberInvite_inviterId_fkey" REFERENCES "User" ("id") ON DELETE SET NULL ON UPDATE CASCADE;
|
|
|
|
-- Who invited each member. NULL for every membership already standing, for the
|
|
-- same reason.
|
|
ALTER TABLE "OrganisationMember" ADD COLUMN "invitedById" INTEGER CONSTRAINT "OrganisationMember_invitedById_fkey" REFERENCES "User" ("id") ON DELETE SET NULL ON UPDATE CASCADE;
|
|
|
|
-- Every session and API token was issued under the old sign-in rules. People
|
|
-- sign in again through Hanzo IAM; integrations mint new tokens.
|
|
DELETE FROM "Session";
|
|
DELETE FROM "ApiToken";
|