rohskiddo/UMBRA
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
UMBRA/backend/alembic/versions
History
Kyle Pope e8e3f62ff8 Phase 1: Add passkey (WebAuthn/FIDO2) backend 
New files:
- models/passkey_credential.py: PasskeyCredential model with indexed credential_id
- alembic 061: Create passkey_credentials table
- services/passkey.py: Challenge token management (itsdangerous + nonce replay
  protection) and py_webauthn wrappers for registration/authentication
- routers/passkeys.py: 6 endpoints (register begin/complete, login begin/complete,
  list, delete) with full security hardening

Changes:
- config.py: WEBAUTHN_RP_ID, RP_NAME, ORIGIN, CHALLENGE_TTL settings
- main.py: Mount passkey router, add CSRF exemptions for login endpoints
- auth.py: Add has_passkeys to /auth/status response
- nginx.conf: Rate limiting on all passkey endpoints, Permissions-Policy
  updated for publickey-credentials-get/create
- requirements.txt: Add webauthn>=2.1.0

Security: password re-entry for registration (V-02), single-use nonce
challenges (V-01), constant-time login/begin (V-03), shared lockout
counter, generic 401 errors, audit logging on all events.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 22:46:00 +08:00
..
001_initial_migration.py
Initial commit
2026-02-15 16:13:41 +08:00
002_add_subtasks.py
Add subtasks feature to project tasks
2026-02-16 01:31:46 +08:00
003_add_preferred_name.py
Dashboard personalization: preferred name, colored dots, smart briefing
2026-02-20 07:37:43 +08:00
004_add_starred_and_weather_city.py
Dashboard Phase 2: weather widget, starred events, quick add, thinner events
2026-02-20 13:15:43 +08:00
005_add_weather_coordinates.py
Add coordinate-based weather lookup with location search
2026-02-21 12:11:02 +08:00
006_add_calendars.py
Add multi-calendar backend support with virtual birthday events
2026-02-21 19:07:35 +08:00
007_add_recurrence_fields.py
Add materialized recurring events backend
2026-02-22 00:37:21 +08:00
008_add_first_day_of_week.py
Add first day of week setting and fix calendar header alignment
2026-02-22 01:33:45 +08:00
009_add_task_comments.py
ProjectDetail overhaul: master-detail layout, comments, sorting, kanban
2026-02-22 03:22:44 +08:00
010_make_remind_at_nullable.py
Global enhancements: none priority, optional remind_at, required labels, textarea flex, remove color picker
2026-02-22 11:58:19 +08:00
011_add_event_templates.py
Calendar enhancements: scroll navigation, birthday color editing, event templates
2026-02-22 17:34:16 +08:00
012_add_project_is_tracked.py
Add track project feature with sidebar nav and dashboard widget
2026-02-23 01:20:36 +08:00
013_drop_template_duration.py
Remove duration_minutes from event templates, auto-prefill event times
2026-02-23 10:55:27 +08:00
014_add_todo_recurrence_fields.py
Implement todo recurrence logic with auto-reset scheduling
2026-02-23 17:04:12 +08:00
015_add_todo_due_time.py
Add optional due time to todos, fix date not being optional
2026-02-23 19:59:38 +08:00
016_add_todo_indexes_and_defaults.py
Address remaining QA items: indexes, validation, UX improvements
2026-02-23 21:24:59 +08:00
017_add_reminder_snoozed_until.py
Address remaining QA items: index, validation, accessibility, guard
2026-02-24 01:02:19 +08:00
018_extend_due_lookup_index.py
Fix migration 018: use DROP INDEX IF EXISTS for safety
2026-02-24 04:07:51 +08:00
019_extend_person_model.py
Entity pages enhancement: backend model extensions, shared components, Locations rebuild, panel animations
2026-02-24 21:10:26 +08:00
020_extend_location_model.py
Entity pages enhancement: backend model extensions, shared components, Locations rebuild, panel animations
2026-02-24 21:10:26 +08:00
021_drop_person_relationship_column.py
Address all QA review warnings and suggestions for entity pages
2026-02-25 01:04:20 +08:00
022_add_ntfy_settings_and_sent_table.py
Implement Track C: NTFY push notification integration
2026-02-25 04:04:23 +08:00
023_auth_migration_users_sessions.py
Address QA review: model registry, NOT NULL constraint, variable naming, toggle defaults, lockout UX
2026-02-25 04:34:21 +08:00
024_totp_mfa_tables.py
Implement Stage 6 Track B: TOTP MFA (pyotp, Fernet-encrypted secrets, backup codes)
2026-02-25 04:18:05 +08:00
025_add_auto_lock_settings.py
Add lock screen, auto-lock timeout, and login visual upgrade
2026-02-25 10:03:12 +08:00
026_add_user_role_and_system_config.py
Fix QA review findings: C-01 through C-04, W-01 through W-07, S-01/S-04/S-05/S-06
2026-02-26 19:19:04 +08:00
027_add_user_id_to_todos.py
Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)
2026-02-26 19:06:25 +08:00
028_add_user_id_to_reminders.py
Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)
2026-02-26 19:06:25 +08:00
029_add_user_id_to_projects.py
Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)
2026-02-26 19:06:25 +08:00
030_add_user_id_to_calendars.py
Fix migration 030 failing on fresh DB with no admin user
2026-02-27 04:49:57 +08:00
031_add_user_id_to_people.py
Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)
2026-02-26 19:06:25 +08:00
032_add_user_id_to_locations.py
Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)
2026-02-26 19:06:25 +08:00
033_add_user_id_to_event_templates.py
Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)
2026-02-26 19:06:25 +08:00
034_add_user_id_to_ntfy_sent.py
Fix migration 034 failing on fresh DB: drop index not constraint
2026-02-27 06:06:13 +08:00
035_add_performance_indexes.py
Fix QA review #2: W-03/W-04, S-01 through S-04
2026-02-27 05:41:16 +08:00
036_add_cascade_to_transitive_fks.py
Add admin delete-user with full cascade cleanup
2026-02-27 19:20:47 +08:00
037_add_user_profile_fields.py
Add user profile fields + IAM search, email column, detail panel
2026-02-27 22:40:20 +08:00
038_add_date_of_birth_and_email_partial_index.py
Add required email + date of birth to registration, shared validators, partial index
2026-03-02 19:21:11 +08:00
039_add_umbral_name_to_users.py
Add user connections, notification centre, and people integration
2026-03-04 02:10:16 +08:00
040_expand_settings_profile_social.py
Add user connections, notification centre, and people integration
2026-03-04 02:10:16 +08:00
041_create_notifications_table.py
Add user connections, notification centre, and people integration
2026-03-04 02:10:16 +08:00
042_create_connection_tables.py
Add user connections, notification centre, and people integration
2026-03-04 02:10:16 +08:00
043_add_linked_fields_to_people.py
Add user connections, notification centre, and people integration
2026-03-04 02:10:16 +08:00
044_add_notification_type_check.py
Fix QA W-01/W-05/W-06/W-08: cancel requests, detach umbral, notifications
2026-03-04 07:17:31 +08:00
045_add_share_name_fields.py
Fix notification background polling, add first/last name sharing
2026-03-04 07:34:13 +08:00
046_add_person_id_to_connection_requests.py
Add umbral name header, preferred name field, and link button for contacts
2026-03-04 08:37:01 +08:00
047_add_is_shared_to_calendars.py
Phase 1: Schema and models for shared calendars
2026-03-06 03:22:44 +08:00
048_create_calendar_members.py
Phase 1: Schema and models for shared calendars
2026-03-06 03:22:44 +08:00
049_create_event_locks.py
Phase 1: Schema and models for shared calendars
2026-03-06 03:22:44 +08:00
050_expand_notification_types_calendar.py
Phase 1: Schema and models for shared calendars
2026-03-06 03:22:44 +08:00
051_add_updated_by_to_calendar_events.py
Phase 1: Schema and models for shared calendars
2026-03-06 03:22:44 +08:00
052_add_session_lock_columns.py
Fix lock screen bypass, theme flicker, skeleton flash, and sidebar click target
2026-03-12 19:00:55 +08:00
053_add_composite_indexes.py
Phase 3: Backend queries and indexes optimization
2026-03-13 00:08:45 +08:00
054_event_invitations.py
Implement event invitation feature (invite, RSVP, per-occurrence override, leave)
2026-03-15 02:47:27 +08:00
055_add_display_calendar_to_event_invitations.py
Fix QA review findings: C-01, C-02, W-01, W-02, W-04, S-01, S-02, S-03
2026-03-16 20:27:01 +08:00
056_add_can_modify_to_event_invitations.py
Add per-invitee can_modify toggle for event edit access
2026-03-17 00:59:36 +08:00
057_project_collab_prep.py
Fix migration 057: use IF NOT EXISTS for indexes that may pre-exist
2026-03-17 03:30:19 +08:00
058_project_members.py
Add collaborative project sharing, task assignments, and delta polling
2026-03-17 03:18:35 +08:00
059_project_task_assignments.py
Add collaborative project sharing, task assignments, and delta polling
2026-03-17 03:18:35 +08:00
060_expand_notification_types_project.py
Add project notification types to CHECK constraint (migration 060)
2026-03-17 03:54:54 +08:00
061_add_passkey_credentials.py
Phase 1: Add passkey (WebAuthn/FIDO2) backend
2026-03-17 22:46:00 +08:00