codexLB-up 1.25.0b10__py3-none-any.whl

app/db/alembic/versions/20260908_000000_add_subscription_overflow.py

@@ -0,0 +1,140 @@
+"""add subscription overflow designation and model source pins
+
+Schema-only groundwork for subscription-exhaustion overflow to a designated
+model source (#2123, WP-A): two nullable ``dashboard_settings`` columns (the
+designated source id and the drain deadline armed when that designation is
+cleared) and the ``model_source_pins`` table later stages use to keep
+conversations sticky to the source they overflowed to. Nothing reads the new
+columns or table yet; this revision is inert.
+
+Revision ID: 20260908_000000_add_subscription_overflow
+Revises: 20260830_000000_add_quota_warmup_claim_expiry
+Create Date: 2026-09-08
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+from sqlalchemy.engine.interfaces import ReflectedIndex
+
+revision = "20260908_000000_add_subscription_overflow"
+down_revision = "20260830_000000_add_quota_warmup_claim_expiry"
+branch_labels = None
+depends_on = None
+
+_SETTINGS_TABLE = "dashboard_settings"
+_PINS_TABLE = "model_source_pins"
+_PINS_INDEX = "ix_model_source_pins_purge_at"
+
+
+def _settings_columns() -> tuple[sa.Column, ...]:
+    # Fresh Column objects per call: a Column binds to the table it is added to,
+    # so module-level instances could not be reused across upgrades in one process.
+    return (
+        # No foreign key on purpose: a dangling id means "off" (precedent:
+        # single_account_id).
+        sa.Column("subscription_overflow_source_id", sa.String(), nullable=True),
+        # Naive UTC like every other dashboard_settings timestamp; the app
+        # compares it against utcnow().
+        sa.Column("subscription_overflow_drain_until", sa.DateTime(), nullable=True),
+    )
+
+
+def _column_names(connection: Connection, table_name: str) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table_name):
+        return set()
+    return {str(column["name"]) for column in inspector.get_columns(table_name) if column.get("name") is not None}
+
+
+def _reflected_index(connection: Connection, table_name: str, index_name: str) -> ReflectedIndex | None:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table_name):
+        return None
+    for index in inspector.get_indexes(table_name):
+        if index.get("name") == index_name:
+            return index
+    return None
+
+
+def _index_targets_purge_at(index: ReflectedIndex) -> bool:
+    # A same-named index on other columns (or a unique one) is a decoy: it must
+    # be replaced, not accepted by name.
+    return tuple(index.get("column_names") or ()) == ("purge_at",) and not index.get("unique")
+
+
+def _postgresql_index_is_invalid(connection: Connection, index_name: str) -> bool:
+    return bool(
+        connection.execute(
+            sa.text(
+                "SELECT 1 FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+                "WHERE c.relname = :name AND NOT i.indisvalid"
+            ),
+            {"name": index_name},
+        ).scalar()
+    )
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+
+    existing_columns = _column_names(bind, _SETTINGS_TABLE)
+    missing_columns = [column for column in _settings_columns() if column.name not in existing_columns]
+    if existing_columns and missing_columns:
+        with op.batch_alter_table(_SETTINGS_TABLE) as batch_op:
+            for column in missing_columns:
+                batch_op.add_column(column)
+
+    if not sa.inspect(bind).has_table(_PINS_TABLE):
+        op.create_table(
+            _PINS_TABLE,
+            sa.Column("pin_key", sa.String(), nullable=False),
+            # thread | anchor | bounce, a plain string: the routing stage owns the values.
+            sa.Column("kind", sa.String(), nullable=False),
+            # No foreign key on purpose: rows must outlive a deleted source for
+            # the drain window instead of cascading away.
+            sa.Column("source_id", sa.String(), nullable=False),
+            sa.Column("api_key_id", sa.String(), nullable=True),
+            # Timezone-aware like file_account_pins: the database clock is
+            # authoritative for pin expiry and tombstone comparisons.
+            sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("purge_at", sa.DateTime(timezone=True), nullable=False),
+            sa.PrimaryKeyConstraint("pin_key"),
+        )
+
+    # Guarded independently of the table step: a database where the table
+    # already exists (partial dump, out-of-band creation) still needs the
+    # purge-at index. The table is created empty by this same revision, so a
+    # plain in-transaction index suffices; CONCURRENTLY would buy nothing.
+    # An existing same-named index is only accepted when it is the index this
+    # revision would create: one on exactly ``purge_at`` that is, on
+    # PostgreSQL, not left invalid by an interrupted out-of-band CONCURRENTLY
+    # build. Anything else is dropped and rebuilt.
+    existing_index = _reflected_index(bind, _PINS_TABLE, _PINS_INDEX)
+    if existing_index is not None:
+        if _index_targets_purge_at(existing_index) and (
+            bind.dialect.name != "postgresql" or not _postgresql_index_is_invalid(bind, _PINS_INDEX)
+        ):
+            return
+        op.drop_index(_PINS_INDEX, table_name=_PINS_TABLE)
+    op.create_index(_PINS_INDEX, _PINS_TABLE, ["purge_at"], unique=False)
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+
+    if sa.inspect(bind).has_table(_PINS_TABLE):
+        if _reflected_index(bind, _PINS_TABLE, _PINS_INDEX) is not None:
+            op.drop_index(_PINS_INDEX, table_name=_PINS_TABLE)
+        op.drop_table(_PINS_TABLE)
+
+    existing_columns = _column_names(bind, _SETTINGS_TABLE)
+    present_columns = [column.name for column in _settings_columns() if column.name in existing_columns]
+    if present_columns:
+        with op.batch_alter_table(_SETTINGS_TABLE) as batch_op:
+            for column_name in present_columns:
+                batch_op.drop_column(column_name)

app/db/alembic/versions/20260908_000000_replace_upstream_stream_transport_default_sentinel.py

@@ -0,0 +1,50 @@
+"""Replace the upstream_stream_transport "default" sentinel with "auto".
+
+Revision ID: 20260908_000000_replace_upstream_stream_transport_default_sentinel
+Revises: 20260830_000000_add_quota_warmup_claim_expiry
+Create Date: 2026-09-08
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260908_000000_replace_upstream_stream_transport_default_sentinel"
+down_revision = "20260830_000000_add_quota_warmup_claim_expiry"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # "default" used to mean "defer to CODEX_LB_UPSTREAM_STREAM_TRANSPORT",
+    # whose own default was "auto". The env var is removed and the dashboard
+    # row is the only source, so the sentinel maps to the documented default.
+    # A migration cannot read the environment the removed variable was set in;
+    # an operator who pinned the env var to http/websocket must re-pin it in
+    # the dashboard (release notes).
+    op.execute(
+        sa.text(
+            "UPDATE dashboard_settings SET upstream_stream_transport = 'auto' "
+            "WHERE upstream_stream_transport = 'default'"
+        )
+    )
+    with op.batch_alter_table("dashboard_settings") as batch_op:
+        batch_op.alter_column(
+            "upstream_stream_transport",
+            existing_type=sa.String(),
+            existing_nullable=False,
+            server_default=sa.text("'auto'"),
+        )
+
+
+def downgrade() -> None:
+    # "auto" is a valid value in the previous schema too, so rows are left as
+    # they are; only the server default is restored.
+    with op.batch_alter_table("dashboard_settings") as batch_op:
+        batch_op.alter_column(
+            "upstream_stream_transport",
+            existing_type=sa.String(),
+            existing_nullable=False,
+            server_default=sa.text("'default'"),
+        )

app/db/alembic/versions/20260908_020000_merge_overflow_transport_heads.py

@@ -0,0 +1,27 @@
+"""Merge the subscription-overflow and transport-sentinel heads.
+
+Revision ID: 20260908_020000_merge_overflow_transport_heads
+Revises: 20260908_000000_add_subscription_overflow,
+    20260908_000000_replace_upstream_stream_transport_default_sentinel
+Create Date: 2026-09-08
+"""
+
+from __future__ import annotations
+
+revision = "20260908_020000_merge_overflow_transport_heads"
+down_revision = (
+    "20260908_000000_add_subscription_overflow",
+    "20260908_000000_replace_upstream_stream_transport_default_sentinel",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Join revision tracking after both parents have completed."""
+    pass
+
+
+def downgrade() -> None:
+    """Restore both parent stamps without changing their schema or data."""
+    pass

app/db/alembic/versions/20260909_000000_add_dashboard_roles.py

@@ -0,0 +1,72 @@
+"""Add dashboard_roles and dashboard_role_grants with the five preset rows.
+
+Revision ID: 20260909_000000_add_dashboard_roles
+Revises: 20260908_000000_add_guest_session_generation
+Create Date: 2026-09-09
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+from app.modules.dashboard_roles.seed import seed_preset_dashboard_roles
+
+revision = "20260909_000000_add_dashboard_roles"
+down_revision = "20260908_000000_add_guest_session_generation"
+branch_labels = None
+depends_on = None
+
+
+def _roles_table(metadata: sa.MetaData) -> sa.Table:
+    return sa.Table(
+        "dashboard_roles",
+        metadata,
+        sa.Column("id", sa.String(), primary_key=True),
+        sa.Column("slug", sa.String(length=32), nullable=False, unique=True),
+        sa.Column("name", sa.String(length=64), nullable=False),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column("kind", sa.String(length=16), nullable=False),
+        sa.Column("assignable_to_users", sa.Boolean(), server_default=sa.true(), nullable=False),
+        sa.Column(
+            "cloned_from_role_id",
+            sa.String(),
+            sa.ForeignKey("dashboard_roles.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("permissions_version", sa.Integer(), server_default=sa.text("1"), nullable=False),
+        sa.Column("created_at", sa.DateTime(), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(), server_default=sa.func.now(), nullable=False),
+    )
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    metadata = sa.MetaData()
+    roles = _roles_table(metadata)
+    if not inspector.has_table("dashboard_roles"):
+        roles.create(bind)
+    if not inspector.has_table("dashboard_role_grants"):
+        op.create_table(
+            "dashboard_role_grants",
+            sa.Column(
+                "role_id",
+                sa.String(),
+                sa.ForeignKey("dashboard_roles.id", ondelete="CASCADE"),
+                primary_key=True,
+            ),
+            sa.Column("permission", sa.String(length=64), primary_key=True),
+            sa.Column("scope", sa.String(length=8), nullable=False),
+        )
+    # Outside the table guard so a re-run after a partial failure still seeds.
+    seed_preset_dashboard_roles(bind, roles)
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if inspector.has_table("dashboard_role_grants"):
+        op.drop_table("dashboard_role_grants")
+    if inspector.has_table("dashboard_roles"):
+        op.drop_table("dashboard_roles")

app/db/alembic/versions/20260909_010000_add_dashboard_users.py

@@ -0,0 +1,183 @@
+"""Add dashboard_users, dashboard_identities, API key ownership columns, and backfill the compat admin.
+
+Revision ID: 20260909_010000_add_dashboard_users
+Revises: 20260909_000000_add_dashboard_roles
+Create Date: 2026-09-09
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260909_010000_add_dashboard_users"
+down_revision = "20260909_000000_add_dashboard_roles"
+branch_labels = None
+depends_on = None
+
+# Frozen copies of the runtime identifiers (see app.db.models and
+# app.core.auth.dashboard_access). A migration must not import runtime modules,
+# which may move or go; the unit test
+# tests/unit/test_migration_identifier_literals.py asserts these stay in sync
+# with the constants they were copied from.
+COMPAT_ADMIN_USER_ID = "7a4fc02d-216e-5be7-b974-bc437f23df60"
+COMPAT_ADMIN_USERNAME = "admin"
+ADMIN_ROLE_ID = "3fe7dc57-aabd-5b16-9850-b6d464087f07"
+
+_API_KEY_COLUMNS = ("owner_user_id", "created_by_user_id", "deactivated_reason")
+
+
+def _columns(bind: sa.engine.Connection, table: str) -> set[str]:
+    inspector = sa.inspect(bind)
+    if not inspector.has_table(table):
+        return set()
+    return {column["name"] for column in inspector.get_columns(table)}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    if not inspector.has_table("dashboard_users"):
+        op.create_table(
+            "dashboard_users",
+            sa.Column("id", sa.String(), primary_key=True),
+            sa.Column("username", sa.String(length=64), nullable=False, unique=True),
+            sa.Column("display_name", sa.String(length=128), nullable=True),
+            sa.Column("email", sa.String(length=320), nullable=True, unique=True),
+            sa.Column("role_id", sa.String(), sa.ForeignKey("dashboard_roles.id", ondelete="RESTRICT"), nullable=False),
+            sa.Column("role_source", sa.String(length=16), server_default=sa.text("'manual'"), nullable=False),
+            sa.Column("status", sa.String(length=16), server_default=sa.text("'active'"), nullable=False),
+            sa.Column("password_hash", sa.Text(), nullable=True),
+            sa.Column("totp_secret_encrypted", sa.LargeBinary(), nullable=True),
+            sa.Column("totp_last_verified_step", sa.Integer(), nullable=True),
+            sa.Column("session_generation", sa.Integer(), server_default=sa.text("0"), nullable=False),
+            sa.Column("must_change_password", sa.Boolean(), server_default=sa.false(), nullable=False),
+            sa.Column("is_break_glass", sa.Boolean(), server_default=sa.false(), nullable=False),
+            sa.Column("created_at", sa.DateTime(), server_default=sa.func.now(), nullable=False),
+            sa.Column(
+                "created_by_user_id",
+                sa.String(),
+                sa.ForeignKey("dashboard_users.id", ondelete="SET NULL"),
+                nullable=True,
+            ),
+            sa.Column("updated_at", sa.DateTime(), server_default=sa.func.now(), nullable=False),
+            sa.Column("last_login_at", sa.DateTime(), nullable=True),
+        )
+    if not inspector.has_table("dashboard_identities"):
+        op.create_table(
+            "dashboard_identities",
+            sa.Column("id", sa.String(), primary_key=True),
+            sa.Column("user_id", sa.String(), sa.ForeignKey("dashboard_users.id", ondelete="CASCADE"), nullable=False),
+            sa.Column("provider", sa.String(length=32), nullable=False),
+            sa.Column("provider_key", sa.String(length=128), nullable=False),
+            sa.Column("subject", sa.String(length=512), nullable=False),
+            sa.Column("email", sa.String(length=320), nullable=True),
+            sa.Column("display_name", sa.String(length=128), nullable=True),
+            sa.Column("groups_json", sa.Text(), nullable=True),
+            sa.Column("last_seen_at", sa.DateTime(), nullable=True),
+            sa.Column("created_at", sa.DateTime(), server_default=sa.func.now(), nullable=False),
+            sa.UniqueConstraint("provider", "provider_key", "subject", name="uq_dashboard_identities_subject"),
+        )
+        op.create_index("idx_dashboard_identities_user_id", "dashboard_identities", ["user_id"])
+
+    existing = _columns(bind, "api_keys")
+    missing = [name for name in _API_KEY_COLUMNS if name not in existing]
+    if missing:
+        with op.batch_alter_table("api_keys") as batch_op:
+            if "owner_user_id" in missing:
+                batch_op.add_column(sa.Column("owner_user_id", sa.String(), nullable=True))
+                batch_op.create_foreign_key(
+                    "fk_api_keys_owner_user_id",
+                    "dashboard_users",
+                    ["owner_user_id"],
+                    ["id"],
+                    ondelete="SET NULL",
+                )
+            if "created_by_user_id" in missing:
+                batch_op.add_column(sa.Column("created_by_user_id", sa.String(), nullable=True))
+                batch_op.create_foreign_key(
+                    "fk_api_keys_created_by_user_id",
+                    "dashboard_users",
+                    ["created_by_user_id"],
+                    ["id"],
+                    ondelete="SET NULL",
+                )
+            if "deactivated_reason" in missing:
+                batch_op.add_column(sa.Column("deactivated_reason", sa.String(length=32), nullable=True))
+
+    # Backfill: the legacy shared admin password becomes the `admin` user. Runs
+    # outside the table guards so a re-run after a partial failure still
+    # migrates the credential. Idempotent on the deterministic user id and on
+    # the unique username.
+    settings_row = bind.execute(
+        sa.text(
+            "SELECT password_hash, totp_secret_encrypted, totp_last_verified_step FROM dashboard_settings WHERE id = 1"
+        )
+    ).first()
+    if settings_row is not None and settings_row[0] is not None:
+        existing_admin = bind.execute(
+            sa.text("SELECT id FROM dashboard_users WHERE id = :id OR username = :username"),
+            {"id": COMPAT_ADMIN_USER_ID, "username": COMPAT_ADMIN_USERNAME},
+        ).first()
+        if existing_admin is None:
+            bind.execute(
+                sa.text(
+                    "INSERT INTO dashboard_users "
+                    "(id, username, display_name, role_id, role_source, status, password_hash, "
+                    "totp_secret_encrypted, totp_last_verified_step, session_generation, "
+                    "must_change_password, is_break_glass, created_at, updated_at) "
+                    "VALUES (:id, :username, NULL, :role_id, 'manual', 'active', :password_hash, "
+                    ":totp_secret, :totp_step, 0, :false_value, :true_value, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)"
+                ),
+                {
+                    "id": COMPAT_ADMIN_USER_ID,
+                    "username": COMPAT_ADMIN_USERNAME,
+                    "role_id": ADMIN_ROLE_ID,
+                    "password_hash": settings_row[0],
+                    "totp_secret": settings_row[1],
+                    "totp_step": settings_row[2],
+                    "false_value": False,
+                    "true_value": True,
+                },
+            )
+
+
+def _user_fk_names(inspector: sa.Inspector, column: str) -> list[str]:
+    """Names of api_keys foreign keys from ``column`` to dashboard_users.
+
+    The constraint may carry this revision's explicit name or a dialect
+    default (a schema built by ``Base.metadata.create_all`` on PostgreSQL
+    names it ``api_keys_<column>_fkey``); unnamed SQLite constraints are
+    dropped together with the column by the batch table rebuild.
+    """
+
+    names: list[str] = []
+    for fk in inspector.get_foreign_keys("api_keys"):
+        name = fk.get("name")
+        if (
+            isinstance(name, str)
+            and fk.get("referred_table") == "dashboard_users"
+            and column in fk.get("constrained_columns", ())
+        ):
+            names.append(name)
+    return names
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    existing = _columns(bind, "api_keys")
+    if existing & set(_API_KEY_COLUMNS):
+        with op.batch_alter_table("api_keys") as batch_op:
+            for column in ("owner_user_id", "created_by_user_id"):
+                if column in existing:
+                    for fk_name in _user_fk_names(inspector, column):
+                        batch_op.drop_constraint(fk_name, type_="foreignkey")
+                    batch_op.drop_column(column)
+            if "deactivated_reason" in existing:
+                batch_op.drop_column("deactivated_reason")
+    if inspector.has_table("dashboard_identities"):
+        op.drop_table("dashboard_identities")
+    if inspector.has_table("dashboard_users"):
+        op.drop_table("dashboard_users")

app/db/alembic/versions/20260909_020000_reproject_compat_admin_credentials.py

@@ -0,0 +1,105 @@
+"""Re-project the legacy dashboard credential onto the compat ``admin`` user once more.
+
+Revision ID: 20260909_020000_reproject_compat_admin_credentials
+Revises: 20260909_010000_add_dashboard_users
+Create Date: 2026-09-09
+
+Through the previous release the legacy ``dashboard_settings`` columns were the
+authoritative credential and the ``admin`` user row a mirror; a replica still
+running that release during a rolling upgrade may have changed the password or
+TOTP secret on the legacy row only. This data-only revision copies the legacy
+credential onto the user row one last time before the user row becomes the
+source of truth (and the legacy columns become the mirror). Downgrade is a
+no-op: nothing structural changes.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260909_020000_reproject_compat_admin_credentials"
+down_revision = "20260909_010000_add_dashboard_users"
+branch_labels = None
+depends_on = None
+
+# Frozen copies of the runtime identifiers (see 20260909_010000): a migration
+# must not import transient application modules. The preset role rows are
+# guaranteed by 20260909_000000 earlier in this chain.
+COMPAT_ADMIN_USER_ID = "7a4fc02d-216e-5be7-b974-bc437f23df60"
+COMPAT_ADMIN_USERNAME = "admin"
+ADMIN_ROLE_ID = "3fe7dc57-aabd-5b16-9850-b6d464087f07"
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if not inspector.has_table("dashboard_settings") or not inspector.has_table("dashboard_users"):
+        return
+
+    settings_row = bind.execute(
+        sa.text(
+            "SELECT password_hash, totp_secret_encrypted, totp_last_verified_step FROM dashboard_settings WHERE id = 1"
+        )
+    ).first()
+    if settings_row is None:
+        return
+    legacy_password_hash, legacy_totp_secret, legacy_totp_step = settings_row
+
+    existing_admin = bind.execute(
+        sa.text("SELECT id FROM dashboard_users WHERE id = :id OR username = :username"),
+        {"id": COMPAT_ADMIN_USER_ID, "username": COMPAT_ADMIN_USERNAME},
+    ).first()
+
+    if legacy_password_hash is None:
+        # The previous release removed the password: the compat row (if any)
+        # must be credential-less too. The row itself stays so the account
+        # keeps its identity and settings.
+        if existing_admin is not None:
+            bind.execute(
+                sa.text(
+                    "UPDATE dashboard_users SET password_hash = NULL, totp_secret_encrypted = NULL, "
+                    "totp_last_verified_step = NULL WHERE id = :id"
+                ),
+                {"id": existing_admin[0]},
+            )
+        return
+
+    credential = {
+        "password_hash": legacy_password_hash,
+        "totp_secret": legacy_totp_secret,
+        "totp_step": legacy_totp_step,
+    }
+    if existing_admin is not None:
+        bind.execute(
+            sa.text(
+                "UPDATE dashboard_users SET password_hash = :password_hash, totp_secret_encrypted = :totp_secret, "
+                "totp_last_verified_step = :totp_step WHERE id = :id"
+            ),
+            {**credential, "id": existing_admin[0]},
+        )
+        return
+
+    bind.execute(
+        sa.text(
+            "INSERT INTO dashboard_users "
+            "(id, username, display_name, role_id, role_source, status, password_hash, "
+            "totp_secret_encrypted, totp_last_verified_step, session_generation, "
+            "must_change_password, is_break_glass, created_at, updated_at) "
+            "VALUES (:id, :username, NULL, :role_id, 'manual', 'active', :password_hash, "
+            ":totp_secret, :totp_step, 0, :false_value, :true_value, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)"
+        ),
+        {
+            **credential,
+            "id": COMPAT_ADMIN_USER_ID,
+            "username": COMPAT_ADMIN_USERNAME,
+            "role_id": ADMIN_ROLE_ID,
+            "false_value": False,
+            "true_value": True,
+        },
+    )
+
+
+def downgrade() -> None:
+    # Data-only re-projection; the previous revision's downgrade drops the tables.
+    return

app/db/alembic/versions/20260909_030000_add_audit_actor_columns.py

@@ -0,0 +1,103 @@
+"""Add actor, target and severity columns to audit_logs.
+
+Revision ID: 20260909_030000_add_audit_actor_columns
+Revises: 20260909_020000_reproject_compat_admin_credentials
+Create Date: 2026-09-09
+
+The actor columns are a snapshot (no foreign key) so an audit row outlives the
+account it names. Existing rows keep NULL actor/target columns and receive
+``severity='info'`` through the server default.
+
+On SQLite the ``timestamp`` text of rows written through the database default
+(``CURRENT_TIMESTAMP``, second granularity) is padded once to the
+microsecond form the ORM writes and binds, so time-window predicates and
+same-second ordering compare consistently. Representation only; the instant
+does not change.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260909_030000_add_audit_actor_columns"
+down_revision = "20260909_020000_reproject_compat_admin_credentials"
+branch_labels = None
+depends_on = None
+
+_TABLE = "audit_logs"
+_COLUMN_NAMES: tuple[str, ...] = (
+    "actor_user_id",
+    "actor_username",
+    "actor_role_slug",
+    "auth_method",
+    "target_type",
+    "target_id",
+    "severity",
+)
+_INDEXES: tuple[tuple[str, tuple[str, ...]], ...] = (
+    ("idx_audit_logs_actor_user_id", ("actor_user_id",)),
+    ("idx_audit_logs_target", ("target_type", "target_id")),
+)
+
+
+def _new_columns() -> tuple[sa.Column, ...]:
+    """Fresh Column objects per call: a Column may be bound to one table only."""
+
+    return (
+        sa.Column("actor_user_id", sa.String(length=36), nullable=True),
+        sa.Column("actor_username", sa.String(length=64), nullable=True),
+        sa.Column("actor_role_slug", sa.String(length=32), nullable=True),
+        sa.Column("auth_method", sa.String(length=32), nullable=True),
+        sa.Column("target_type", sa.String(length=32), nullable=True),
+        sa.Column("target_id", sa.String(length=128), nullable=True),
+        sa.Column("severity", sa.String(length=16), nullable=False, server_default=sa.text("'info'")),
+    )
+
+
+def _columns(inspector: sa.Inspector) -> set[str]:
+    if not inspector.has_table(_TABLE):
+        return set()
+    return {column["name"] for column in inspector.get_columns(_TABLE)}
+
+
+def _indexes(inspector: sa.Inspector) -> set[str]:
+    if not inspector.has_table(_TABLE):
+        return set()
+    return {name for index in inspector.get_indexes(_TABLE) if isinstance(name := index.get("name"), str)}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if not inspector.has_table(_TABLE):
+        return
+    existing_columns = _columns(inspector)
+    missing = [column for column in _new_columns() if column.name not in existing_columns]
+    if missing:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            for column in missing:
+                batch_op.add_column(column)
+    existing_indexes = _indexes(sa.inspect(bind))
+    for name, columns in _INDEXES:
+        if name not in existing_indexes:
+            op.create_index(name, _TABLE, list(columns))
+    if bind.dialect.name == "sqlite":
+        op.execute(sa.text("UPDATE audit_logs SET timestamp = timestamp || '.000000' WHERE timestamp NOT LIKE '%.%'"))
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if not inspector.has_table(_TABLE):
+        return
+    existing_indexes = _indexes(inspector)
+    for name, _ in _INDEXES:
+        if name in existing_indexes:
+            op.drop_index(name, table_name=_TABLE)
+    existing_columns = _columns(inspector)
+    present = [name for name in _COLUMN_NAMES if name in existing_columns]
+    if present:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            for name in present:
+                batch_op.drop_column(name)