justin
c5631d3eab
Provenance had no system-level owner: ownership was only per-tree (TreeMembership), so a self-hosted instance had no operator account and no instance-admin surface. This adds one, declared by environment per the project's twelve-factor rule. - OWNER_EMAIL (comma-separated): the account(s) named here are instance owners. Derived at request time — no DB column, no migration, can't drift from the env, survives DB resets. is_instance_owner()/InstanceOwner dependency in api/deps.py. - Ownership requires a VERIFIED email (independent of REQUIRE_EMAIL_VERIFICATION). Registration is open, so without this an attacker could seize the role by registering the owner address first; verification ties it to inbox control. - GET /api/v1/admin/instance (owner-only): operational status — version, env, user/tree counts, configured AI providers. Deliberately exposes no tree data or PII: instance ownership is an operator role, NOT a privacy-engine bypass. - /users/me reports is_instance_owner; frontend gains an owner-only /admin page and a conditional sidebar link (server-enforced, not just client-hidden). Found-and-fixed by an adversarial security review before merge: the verified-email land-grab (above) and a frontend null-deref where the admin page crashed on 401/5xx instead of failing closed. Docs: .env.example + ARCHITECTURE (notes the not-a-privacy-bypass boundary and the verified-email requirement). Tests: owner matching, the land-grab guard, /users/me, and owner-only /admin. Suite 96 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Justin Paul <justin@jpaul.me>
32 lines
887 B
Python
32 lines
887 B
Python
import uuid
|
|
from datetime import datetime
|
|
|
|
from pydantic import BaseModel, ConfigDict
|
|
|
|
# Note: email is a plain str for now (no email-validator dependency yet); the
|
|
# auth slice can tighten this to EmailStr.
|
|
|
|
|
|
class UserCreate(BaseModel):
|
|
email: str
|
|
display_name: str | None = None
|
|
|
|
|
|
class UserRead(BaseModel):
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
id: uuid.UUID
|
|
email: str
|
|
display_name: str | None
|
|
email_verified_at: datetime | None
|
|
self_person_id: uuid.UUID | None = None
|
|
created_at: datetime
|
|
# Operational role, not a DB column: true when this account's email is named
|
|
# in OWNER_EMAIL. Set by the API layer (see users.read_me).
|
|
is_instance_owner: bool = False
|
|
|
|
|
|
class UserSelfPersonUpdate(BaseModel):
|
|
# null clears the link; otherwise the Person that represents this account.
|
|
self_person_id: uuid.UUID | None = None
|