inital

app/models/__init__.py

@@ -0,0 +1,20 @@
+"""Models package."""
+from app.models.base import BaseModel
+from app.models.user import User
+from app.models.organization import Organization
+from app.models.organization_member import OrganizationMember
+from app.models.authentication_method import AuthenticationMethod
+from app.models.session import Session
+from app.models.audit_log import AuditLog
+from app.models.oidc_client import OIDCClient
+
+__all__ = [
+    "BaseModel",
+    "User",
+    "Organization",
+    "OrganizationMember",
+    "AuthenticationMethod",
+    "Session",
+    "AuditLog",
+    "OIDCClient",
+]

app/models/audit_log.py

@@ -0,0 +1,62 @@
+"""Audit log model."""
+from app.extensions import db
+from app.models.base import BaseModel
+from app.utils.constants import AuditAction
+
+
+class AuditLog(BaseModel):
+    """Audit log model for tracking user and system actions."""
+
+    __tablename__ = "audit_logs"
+
+    user_id = db.Column(db.String(36), db.ForeignKey("users.id"), nullable=True, index=True)
+    action = db.Column(db.Enum(AuditAction), nullable=False, index=True)
+
+    # Context
+    resource_type = db.Column(db.String(50), nullable=True, index=True)
+    resource_id = db.Column(db.String(36), nullable=True, index=True)
+    organization_id = db.Column(db.String(36), nullable=True, index=True)
+
+    # Request details
+    ip_address = db.Column(db.String(45), nullable=True)
+    user_agent = db.Column(db.Text, nullable=True)
+    request_id = db.Column(db.String(36), nullable=True, index=True)
+
+    # Additional data
+    extra_data = db.Column(db.JSON, nullable=True)
+    description = db.Column(db.Text, nullable=True)
+
+    # Success/failure
+    success = db.Column(db.Boolean, default=True, nullable=False)
+    error_message = db.Column(db.Text, nullable=True)
+
+    # Relationships
+    user = db.relationship("User", back_populates="audit_logs")
+
+    # Indexes for common queries
+    __table_args__ = (
+        db.Index("idx_audit_user_action", "user_id", "action"),
+        db.Index("idx_audit_resource", "resource_type", "resource_id"),
+        db.Index("idx_audit_org", "organization_id", "created_at"),
+    )
+
+    def __repr__(self):
+        """String representation of AuditLog."""
+        return f"<AuditLog action={self.action} user_id={self.user_id}>"
+
+    @classmethod
+    def log(cls, action, user_id=None, **kwargs):
+        """
+        Create an audit log entry.
+
+        Args:
+            action: AuditAction enum value
+            user_id: ID of the user performing the action
+            **kwargs: Additional audit log fields
+
+        Returns:
+            AuditLog instance
+        """
+        log_entry = cls(action=action, user_id=user_id, **kwargs)
+        log_entry.save()
+        return log_entry

app/models/authentication_method.py

@@ -0,0 +1,59 @@
+"""Authentication method model."""
+from app.extensions import db
+from app.models.base import BaseModel
+from app.utils.constants import AuthMethodType
+
+
+class AuthenticationMethod(BaseModel):
+    """Authentication method model storing user authentication credentials."""
+
+    __tablename__ = "authentication_methods"
+
+    user_id = db.Column(db.String(36), db.ForeignKey("users.id"), nullable=False, index=True)
+    method_type = db.Column(db.Enum(AuthMethodType), nullable=False, index=True)
+
+    # For password authentication
+    password_hash = db.Column(db.String(255), nullable=True)
+
+    # For OAuth/OIDC providers
+    provider_user_id = db.Column(db.String(255), nullable=True)
+    provider_data = db.Column(db.JSON, nullable=True)
+
+    # Metadata
+    is_primary = db.Column(db.Boolean, default=False, nullable=False)
+    verified = db.Column(db.Boolean, default=False, nullable=False)
+    last_used_at = db.Column(db.DateTime, nullable=True)
+
+    # Relationships
+    user = db.relationship("User", back_populates="authentication_methods")
+
+    # Ensure unique provider combinations
+    __table_args__ = (
+        db.Index("idx_user_method", "user_id", "method_type"),
+        db.UniqueConstraint(
+            "user_id", "method_type", "provider_user_id", name="uix_user_method_provider"
+        ),
+    )
+
+    def __repr__(self):
+        """String representation of AuthenticationMethod."""
+        return f"<AuthenticationMethod user_id={self.user_id} type={self.method_type}>"
+
+    def is_password(self):
+        """Check if this is a password authentication method."""
+        return self.method_type == AuthMethodType.PASSWORD
+
+    def is_oauth(self):
+        """Check if this is an OAuth authentication method."""
+        return self.method_type in [
+            AuthMethodType.GOOGLE,
+            AuthMethodType.GITHUB,
+            AuthMethodType.MICROSOFT,
+        ]
+
+    def to_dict(self, exclude=None):
+        """Convert to dictionary, excluding sensitive fields."""
+        exclude = exclude or []
+        # Always exclude password hash
+        exclude.append("password_hash")
+        return super().to_dict(exclude=exclude)

app/models/base.py

@@ -0,0 +1,73 @@
+"""Base model with common fields and functionality."""
+import uuid
+from datetime import datetime
+from app.extensions import db
+
+
+class BaseModel(db.Model):
+    """Base model class with common fields."""
+
+    __abstract__ = True
+
+    id = db.Column(
+        db.String(36),
+        primary_key=True,
+        default=lambda: str(uuid.uuid4()),
+        unique=True,
+        nullable=False,
+    )
+    created_at = db.Column(db.DateTime, nullable=False, default=datetime.utcnow)
+    updated_at = db.Column(
+        db.DateTime, nullable=False, default=datetime.utcnow, onupdate=datetime.utcnow
+    )
+    deleted_at = db.Column(db.DateTime, nullable=True)
+
+    def save(self):
+        """Save the model instance to database."""
+        db.session.add(self)
+        db.session.commit()
+        return self
+
+    def delete(self, soft=True):
+        """
+        Delete the model instance.
+
+        Args:
+            soft: If True, performs soft delete. If False, hard delete.
+        """
+        if soft:
+            self.deleted_at = datetime.utcnow()
+            db.session.commit()
+        else:
+            db.session.delete(self)
+            db.session.commit()
+
+    def update(self, **kwargs):
+        """Update model fields."""
+        for key, value in kwargs.items():
+            if hasattr(self, key):
+                setattr(self, key, value)
+        self.updated_at = datetime.utcnow()
+        db.session.commit()
+        return self
+
+    def to_dict(self, exclude=None):
+        """
+        Convert model to dictionary.
+
+        Args:
+            exclude: List of fields to exclude from output
+
+        Returns:
+            Dictionary representation of the model
+        """
+        exclude = exclude or []
+        result = {}
+        for column in self.__table__.columns:
+            if column.name not in exclude:
+                value = getattr(self, column.name)
+                if isinstance(value, datetime):
+                    result[column.name] = value.isoformat()
+                else:
+                    result[column.name] = value
+        return result

app/models/oidc_client.py

@@ -0,0 +1,69 @@
+"""OIDC Client model."""
+from app.extensions import db
+from app.models.base import BaseModel
+from app.utils.constants import OIDCGrantType, OIDCResponseType
+
+
+class OIDCClient(BaseModel):
+    """OIDC client model for OAuth2/OIDC integrations."""
+
+    __tablename__ = "oidc_clients"
+
+    organization_id = db.Column(
+        db.String(36), db.ForeignKey("organizations.id"), nullable=False, index=True
+    )
+    name = db.Column(db.String(255), nullable=False)
+    client_id = db.Column(db.String(255), unique=True, nullable=False, index=True)
+    client_secret_hash = db.Column(db.String(255), nullable=False)
+
+    # OAuth/OIDC configuration
+    redirect_uris = db.Column(db.JSON, nullable=False)  # List of allowed redirect URIs
+    grant_types = db.Column(db.JSON, nullable=False)  # List of allowed grant types
+    response_types = db.Column(db.JSON, nullable=False)  # List of allowed response types
+    scopes = db.Column(db.JSON, nullable=False)  # List of allowed scopes
+
+    # Client metadata
+    logo_uri = db.Column(db.String(512), nullable=True)
+    client_uri = db.Column(db.String(512), nullable=True)
+    policy_uri = db.Column(db.String(512), nullable=True)
+    tos_uri = db.Column(db.String(512), nullable=True)
+
+    # Settings
+    is_active = db.Column(db.Boolean, default=True, nullable=False)
+    is_confidential = db.Column(db.Boolean, default=True, nullable=False)
+    require_pkce = db.Column(db.Boolean, default=True, nullable=False)
+
+    # Token lifetimes (in seconds)
+    access_token_lifetime = db.Column(db.Integer, default=3600, nullable=False)
+    refresh_token_lifetime = db.Column(db.Integer, default=2592000, nullable=False)
+    id_token_lifetime = db.Column(db.Integer, default=3600, nullable=False)
+
+    # Relationships
+    organization = db.relationship("Organization", back_populates="oidc_clients")
+
+    def __repr__(self):
+        """String representation of OIDCClient."""
+        return f"<OIDCClient {self.name} client_id={self.client_id}>"
+
+    def to_dict(self, exclude=None):
+        """Convert to dictionary, excluding sensitive fields."""
+        exclude = exclude or []
+        # Always exclude client secret
+        exclude.append("client_secret_hash")
+        return super().to_dict(exclude=exclude)
+
+    def has_grant_type(self, grant_type):
+        """Check if client supports a specific grant type."""
+        return grant_type in self.grant_types
+
+    def has_response_type(self, response_type):
+        """Check if client supports a specific response type."""
+        return response_type in self.response_types
+
+    def is_redirect_uri_allowed(self, redirect_uri):
+        """Check if a redirect URI is allowed for this client."""
+        return redirect_uri in self.redirect_uris
+
+    def has_scope(self, scope):
+        """Check if client is allowed to request a specific scope."""
+        return scope in self.scopes

app/models/organization.py

@@ -0,0 +1,54 @@
+"""Organization model."""
+from app.extensions import db
+from app.models.base import BaseModel
+
+
+class Organization(BaseModel):
+    """Organization model representing a tenant/workspace."""
+
+    __tablename__ = "organizations"
+
+    name = db.Column(db.String(255), nullable=False)
+    slug = db.Column(db.String(255), unique=True, nullable=False, index=True)
+    description = db.Column(db.Text, nullable=True)
+    logo_url = db.Column(db.String(512), nullable=True)
+    is_active = db.Column(db.Boolean, default=True, nullable=False)
+
+    # Settings (stored as JSON)
+    settings = db.Column(db.JSON, nullable=True, default=dict)
+
+    # Relationships
+    members = db.relationship(
+        "OrganizationMember", back_populates="organization", cascade="all, delete-orphan"
+    )
+    oidc_clients = db.relationship(
+        "OIDCClient", back_populates="organization", cascade="all, delete-orphan"
+    )
+
+    def __repr__(self):
+        """String representation of Organization."""
+        return f"<Organization {self.name}>"
+
+    def get_member_count(self):
+        """Get the count of active members in the organization."""
+        return len([m for m in self.members if m.deleted_at is None])
+
+    def get_owner(self):
+        """Get the owner of the organization."""
+        from app.utils.constants import OrganizationRole
+
+        for member in self.members:
+            if member.role == OrganizationRole.OWNER and member.deleted_at is None:
+                return member.user
+        return None
+
+    def is_member(self, user_id):
+        """Check if a user is a member of the organization."""
+        from app.models.organization_member import OrganizationMember
+
+        return (
+            OrganizationMember.query.filter_by(
+                user_id=user_id, organization_id=self.id, deleted_at=None
+            ).first()
+            is not None
+        )

app/models/organization_member.py

@@ -0,0 +1,51 @@
+"""Organization member model.""" 
+from app.extensions import db
+from app.models.base import BaseModel
+from app.utils.constants import OrganizationRole
+
+
+class OrganizationMember(BaseModel):
+    """Organization member model representing user membership in an organization."""
+
+    __tablename__ = "organization_members"
+
+    user_id = db.Column(db.String(36), db.ForeignKey("users.id"), nullable=False, index=True)
+    organization_id = db.Column(
+        db.String(36), db.ForeignKey("organizations.id"), nullable=False, index=True
+    )
+    role = db.Column(
+        db.Enum(OrganizationRole), default=OrganizationRole.MEMBER, nullable=False
+    )
+    invited_by_id = db.Column(db.String(36), db.ForeignKey("users.id"), nullable=True)
+    invited_at = db.Column(db.DateTime, nullable=True)
+    joined_at = db.Column(db.DateTime, nullable=True)
+
+    # Relationships
+    user = db.relationship("User", foreign_keys=[user_id], back_populates="organization_memberships")
+    organization = db.relationship("Organization", back_populates="members")
+    invited_by = db.relationship("User", foreign_keys=[invited_by_id])
+
+    # Unique constraint to prevent duplicate memberships
+    __table_args__ = (
+        db.UniqueConstraint("user_id", "organization_id", name="uix_user_org"),
+    )
+
+    def __repr__(self):
+        """String representation of OrganizationMember."""
+        return f"<OrganizationMember user_id={self.user_id} org_id={self.organization_id} role={self.role}>"
+
+    def is_owner(self):
+        """Check if member is an owner."""
+        return self.role == OrganizationRole.OWNER
+
+    def is_admin(self):
+        """Check if member is an admin or owner."""
+        return self.role in [OrganizationRole.OWNER, OrganizationRole.ADMIN]
+
+    def can_manage_members(self):
+        """Check if member can manage other members."""
+        return self.is_admin()
+
+    def can_delete_organization(self):
+        """Check if member can delete the organization."""
+        return self.is_owner()

app/models/session.py

@@ -0,0 +1,77 @@
+"""Session model."""
+from datetime import datetime, timedelta
+from app.extensions import db
+from app.models.base import BaseModel
+from app.utils.constants import SessionStatus
+
+
+class Session(BaseModel):
+    """Session model for tracking user sessions."""
+
+    __tablename__ = "sessions"
+
+    user_id = db.Column(db.String(36), db.ForeignKey("users.id"), nullable=False, index=True)
+    token = db.Column(db.String(255), unique=True, nullable=False, index=True)
+    status = db.Column(db.Enum(SessionStatus), default=SessionStatus.ACTIVE, nullable=False)
+
+    # Session metadata
+    ip_address = db.Column(db.String(45), nullable=True)
+    user_agent = db.Column(db.Text, nullable=True)
+    device_info = db.Column(db.JSON, nullable=True)
+
+    # Timing
+    expires_at = db.Column(db.DateTime, nullable=False)
+    last_activity_at = db.Column(db.DateTime, nullable=False, default=datetime.utcnow)
+    revoked_at = db.Column(db.DateTime, nullable=True)
+    revoked_reason = db.Column(db.String(255), nullable=True)
+
+    # Relationships
+    user = db.relationship("User", back_populates="sessions")
+
+    def __repr__(self):
+        """String representation of Session."""
+        return f"<Session user_id={self.user_id} status={self.status}>"
+
+    def is_active(self):
+        """Check if session is currently active."""
+        now = datetime.utcnow()
+        return (
+            self.status == SessionStatus.ACTIVE
+            and self.expires_at > now
+            and self.deleted_at is None
+        )
+
+    def is_expired(self):
+        """Check if session has expired."""
+        return datetime.utcnow() > self.expires_at
+
+    def refresh(self, duration_seconds=86400):
+        """
+        Refresh session expiration.
+
+        Args:
+            duration_seconds: New session duration in seconds
+        """
+        self.expires_at = datetime.utcnow() + timedelta(seconds=duration_seconds)
+        self.last_activity_at = datetime.utcnow()
+        db.session.commit()
+
+    def revoke(self, reason=None):
+        """
+        Revoke the session.
+
+        Args:
+            reason: Optional reason for revocation
+        """
+        self.status = SessionStatus.REVOKED
+        self.revoked_at = datetime.utcnow()
+        if reason:
+            self.revoked_reason = reason
+        db.session.commit()
+
+    def to_dict(self, exclude=None):
+        """Convert to dictionary, excluding sensitive fields."""
+        exclude = exclude or []
+        # Exclude token from dict
+        exclude.append("token")
+        return super().to_dict(exclude=exclude)

app/models/user.py

@@ -0,0 +1,61 @@
+"""User model."""
+from app.extensions import db
+from app.models.base import BaseModel
+from app.utils.constants import UserStatus
+
+
+class User(BaseModel):
+    """User model representing a user account."""
+
+    __tablename__ = "users"
+
+    email = db.Column(db.String(255), unique=True, nullable=False, index=True)
+    email_verified = db.Column(db.Boolean, default=False, nullable=False)
+    full_name = db.Column(db.String(255), nullable=True)
+    avatar_url = db.Column(db.String(512), nullable=True)
+    status = db.Column(
+        db.Enum(UserStatus), default=UserStatus.ACTIVE, nullable=False, index=True
+    )
+    last_login_at = db.Column(db.DateTime, nullable=True)
+    last_login_ip = db.Column(db.String(45), nullable=True)
+
+    # Relationships
+    authentication_methods = db.relationship(
+        "AuthenticationMethod", back_populates="user", cascade="all, delete-orphan"
+    )
+    sessions = db.relationship("Session", back_populates="user", cascade="all, delete-orphan")
+    organization_memberships = db.relationship(
+        "OrganizationMember",
+        back_populates="user",
+        cascade="all, delete-orphan",
+        foreign_keys="OrganizationMember.user_id",
+    )
+    audit_logs = db.relationship("AuditLog", back_populates="user", cascade="all, delete-orphan")
+
+    def __repr__(self):
+        """String representation of User."""
+        return f"<User {self.email}>"
+
+    def to_dict(self, exclude=None):
+        """Convert user to dictionary, excluding sensitive fields by default."""
+        exclude = exclude or []
+        # Always exclude password-related fields
+        default_exclude = []
+        all_exclude = list(set(default_exclude + exclude))
+        return super().to_dict(exclude=all_exclude)
+
+    def has_password_auth(self):
+        """Check if user has password authentication enabled."""
+        from app.models.authentication_method import AuthenticationMethod
+        from app.utils.constants import AuthMethodType
+
+        return (
+            AuthenticationMethod.query.filter_by(
+                user_id=self.id, method_type=AuthMethodType.PASSWORD, deleted_at=None
+            ).first()
+            is not None
+        )
+
+    def get_organizations(self):
+        """Get all organizations the user is a member of."""
+        return [membership.organization for membership in self.organization_memberships]