backend/security/models.py

from sqlalchemy import Column, Integer, String, DateTime, Text, JSON, Boolean, ForeignKey
from sqlalchemy.ext.declarative import declarative_base
from sqlalchemy.orm import relationship
from datetime import datetime

Base = declarative_base()

class APIKey(Base):
    __tablename__ = "api_keys"
    id = Column(Integer, primary_key=True)
    key_id = Column(String(64), unique=True, nullable=False)
    name = Column(String(128), nullable=False)
    key_hash = Column(String(128), nullable=False)       # hashed key
    user_id = Column(String(64), nullable=True)
    roles = Column(JSON, default=[])                     # list of roles
    permissions = Column(JSON, default=[])               # list of permissions
    expires_at = Column(DateTime, nullable=True)
    created_at = Column(DateTime, default=datetime.utcnow)
    last_used_at = Column(DateTime, nullable=True)
    is_active = Column(Boolean, default=True)

class Secret(Base):
    __tablename__ = "secrets"
    id = Column(Integer, primary_key=True)
    secret_id = Column(String(64), unique=True, nullable=False)
    name = Column(String(128), nullable=False)
    value_encrypted = Column(Text, nullable=False)       # store encrypted
    user_id = Column(String(64), nullable=True)
    created_at = Column(DateTime, default=datetime.utcnow)
    updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
    expires_at = Column(DateTime, nullable=True)

class Role(Base):
    __tablename__ = "roles"
    id = Column(Integer, primary_key=True)
    role_id = Column(String(64), unique=True, nullable=False)
    name = Column(String(64), nullable=False)
    permissions = Column(JSON, default=[])               # list of permission strings

class RateLimitRule(Base):
    __tablename__ = "rate_limit_rules"
    id = Column(Integer, primary_key=True)
    rule_id = Column(String(64), unique=True, nullable=False)
    path = Column(String(256), nullable=False)           # e.g., "/v1/models/generate"
    method = Column(String(16), nullable=False)          # GET, POST, etc.
    limit = Column(Integer, default=100)                 # max requests
    window_seconds = Column(Integer, default=60)         # time window
    user_id = Column(String(64), nullable=True)          # optional per-user override

class JWTToken(Base):
    __tablename__ = "jwt_tokens"
    id = Column(Integer, primary_key=True)
    token_id = Column(String(64), unique=True, nullable=False)
    user_id = Column(String(64), nullable=False)
    jti = Column(String(64), nullable=False)             # JWT ID
    expires_at = Column(DateTime, nullable=False)
    created_at = Column(DateTime, default=datetime.utcnow)
    revoked = Column(Boolean, default=False)