Add phase 5 secure credential vault

2026-07-23 14:44:02 +05:30
parent d113db0d20
commit 1b9f555dcf
16 changed files with 442 additions and 0 deletions
@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+from datetime import date, datetime, timezone
+
+from sqlalchemy import Boolean, Date, DateTime, ForeignKey, Integer, String, Text
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.core.db.common import CommonBase
+
+
+def utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+class CredentialVaultEntry(CommonBase):
+    __tablename__ = "credential_vault_entries"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    tenant_id: Mapped[int] = mapped_column(ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False, index=True)
+    branch_id: Mapped[int | None] = mapped_column(ForeignKey("branches.id", ondelete="SET NULL"), index=True)
+    client_id: Mapped[int | None] = mapped_column(ForeignKey("clients.id", ondelete="CASCADE"), index=True)
+    registration_id: Mapped[int | None] = mapped_column(ForeignKey("client_registrations.id", ondelete="SET NULL"), index=True)
+    title: Mapped[str] = mapped_column(String(200), nullable=False, index=True)
+    category: Mapped[str] = mapped_column(String(60), nullable=False, default="government_portal", index=True)
+    portal_url: Mapped[str | None] = mapped_column(String(800))
+    reference_number: Mapped[str | None] = mapped_column(String(160), index=True)
+    username_encrypted: Mapped[str | None] = mapped_column(Text)
+    secret_encrypted: Mapped[str] = mapped_column(Text, nullable=False)
+    additional_secret_encrypted: Mapped[str | None] = mapped_column(Text)
+    notes_encrypted: Mapped[str | None] = mapped_column(Text)
+    encryption_version: Mapped[int] = mapped_column(Integer, nullable=False, default=1)
+    sensitivity: Mapped[str] = mapped_column(String(30), nullable=False, default="high")
+    status: Mapped[str] = mapped_column(String(30), nullable=False, default="active", index=True)
+    expires_on: Mapped[date | None] = mapped_column(Date, index=True)
+    rotation_due_on: Mapped[date | None] = mapped_column(Date, index=True)
+    owner_user_id: Mapped[int | None] = mapped_column(ForeignKey("users.id", ondelete="SET NULL"), index=True)
+    allowed_user_ids_csv: Mapped[str | None] = mapped_column(Text)
+    reveal_requires_reason: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    last_rotated_at_utc: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    archived_at_utc: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_by_user_id: Mapped[int | None] = mapped_column(ForeignKey("users.id", ondelete="SET NULL"))
+    updated_by_user_id: Mapped[int | None] = mapped_column(ForeignKey("users.id", ondelete="SET NULL"))
+    created_at_utc: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, default=utcnow)
+    updated_at_utc: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, default=utcnow, onupdate=utcnow)
+
+
+class CredentialVaultVersion(CommonBase):
+    __tablename__ = "credential_vault_versions"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    tenant_id: Mapped[int] = mapped_column(ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False, index=True)
+    entry_id: Mapped[int] = mapped_column(ForeignKey("credential_vault_entries.id", ondelete="CASCADE"), nullable=False, index=True)
+    version_number: Mapped[int] = mapped_column(Integer, nullable=False)
+    username_encrypted: Mapped[str | None] = mapped_column(Text)
+    secret_encrypted: Mapped[str] = mapped_column(Text, nullable=False)
+    additional_secret_encrypted: Mapped[str | None] = mapped_column(Text)
+    notes_encrypted: Mapped[str | None] = mapped_column(Text)
+    change_reason: Mapped[str] = mapped_column(Text, nullable=False)
+    changed_by_user_id: Mapped[int | None] = mapped_column(ForeignKey("users.id", ondelete="SET NULL"))
+    changed_at_utc: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, default=utcnow)
+
+
+class CredentialVaultAccessLog(CommonBase):
+    __tablename__ = "credential_vault_access_logs"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    tenant_id: Mapped[int] = mapped_column(ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False, index=True)
+    branch_id: Mapped[int | None] = mapped_column(ForeignKey("branches.id", ondelete="SET NULL"), index=True)
+    entry_id: Mapped[int | None] = mapped_column(ForeignKey("credential_vault_entries.id", ondelete="SET NULL"), index=True)
+    actor_user_id: Mapped[int | None] = mapped_column(ForeignKey("users.id", ondelete="SET NULL"), index=True)
+    action: Mapped[str] = mapped_column(String(40), nullable=False, index=True)
+    reason: Mapped[str | None] = mapped_column(Text)
+    fields_accessed_csv: Mapped[str | None] = mapped_column(String(300))
+    success: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    ip_address: Mapped[str | None] = mapped_column(String(100))
+    user_agent: Mapped[str | None] = mapped_column(String(500))
+    created_at_utc: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, default=utcnow, index=True)