48f531cf82
- Updated modification times for various asset files in bindata.go to reflect recent changes. - Enhanced user authentication by adding support for custom claims in the context during authorization, improving flexibility in handling user data. - Refactored entry verification logic to generate and send OTPs for user registration, streamlining the registration process and improving user experience. - Introduced new status handling for user accounts, ensuring proper feedback for pending, unverified, and disabled accounts during login attempts.
455 lines
12 KiB
Text
455 lines
12 KiB
Text
{
|
|
"name": "User",
|
|
"label": "User",
|
|
"description": "User profile and information storage",
|
|
"tags": ["user", "profile", "auth", "mfa"],
|
|
"table": {
|
|
"name": "user",
|
|
"comment": "User profile and information storage"
|
|
},
|
|
"columns": [
|
|
// ============================================================================
|
|
// Basic Fields
|
|
// ============================================================================
|
|
{
|
|
"name": "id",
|
|
"type": "ID",
|
|
"label": "ID",
|
|
"comment": "Primary key identifier",
|
|
"primary": true
|
|
},
|
|
{
|
|
"name": "user_id",
|
|
"type": "string",
|
|
"label": "User ID",
|
|
"comment": "Global unique user identifier",
|
|
"length": 255,
|
|
"unique": true,
|
|
"index": true
|
|
},
|
|
|
|
// ============================================================================
|
|
// OIDC Standard Claims
|
|
// Reference: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
|
|
// ============================================================================
|
|
{
|
|
"name": "preferred_username",
|
|
"type": "string",
|
|
"label": "Preferred Username",
|
|
"comment": "OIDC preferred username",
|
|
"length": 100,
|
|
"nullable": true,
|
|
"unique": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "email",
|
|
"type": "string",
|
|
"label": "Email",
|
|
"comment": "OIDC email address",
|
|
"length": 255,
|
|
"nullable": true,
|
|
"unique": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "email_verified",
|
|
"type": "boolean",
|
|
"label": "Email Verified",
|
|
"comment": "OIDC email verification status",
|
|
"default": false,
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "name",
|
|
"type": "string",
|
|
"label": "Full Name",
|
|
"comment": "OIDC full name",
|
|
"length": 200,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "given_name",
|
|
"type": "string",
|
|
"label": "Given Name",
|
|
"comment": "OIDC given name(s) or first name(s)",
|
|
"length": 100,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "family_name",
|
|
"type": "string",
|
|
"label": "Family Name",
|
|
"comment": "OIDC surname(s) or last name(s)",
|
|
"length": 100,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "middle_name",
|
|
"type": "string",
|
|
"label": "Middle Name",
|
|
"comment": "OIDC middle name(s)",
|
|
"length": 100,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "nickname",
|
|
"type": "string",
|
|
"label": "Nickname",
|
|
"comment": "OIDC casual name",
|
|
"length": 100,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "profile",
|
|
"type": "string",
|
|
"label": "Profile",
|
|
"comment": "OIDC profile page URL",
|
|
"length": 500,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "picture",
|
|
"type": "string",
|
|
"label": "Picture",
|
|
"comment": "OIDC profile picture URL",
|
|
"length": 500,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "website",
|
|
"type": "string",
|
|
"label": "Website",
|
|
"comment": "OIDC web page or blog URL",
|
|
"length": 500,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "gender",
|
|
"type": "string",
|
|
"label": "Gender",
|
|
"comment": "OIDC gender",
|
|
"length": 20,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "birthdate",
|
|
"type": "string",
|
|
"label": "Birthdate",
|
|
"comment": "OIDC birthday (YYYY-MM-DD format)",
|
|
"length": 10,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "zoneinfo",
|
|
"type": "string",
|
|
"label": "Zone Info",
|
|
"comment": "OIDC time zone info (IANA Time Zone Database format)",
|
|
"length": 50,
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "locale",
|
|
"type": "string",
|
|
"label": "Locale",
|
|
"comment": "OIDC locale (language-country)",
|
|
"length": 20,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "phone_number",
|
|
"type": "string",
|
|
"label": "Phone Number",
|
|
"comment": "OIDC phone number",
|
|
"length": 50,
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "phone_number_verified",
|
|
"type": "boolean",
|
|
"label": "Phone Number Verified",
|
|
"comment": "OIDC phone verification status",
|
|
"default": false,
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "address",
|
|
"type": "json",
|
|
"label": "Address",
|
|
"comment": "OIDC physical mailing address (structured)",
|
|
"nullable": true
|
|
},
|
|
|
|
// ============================================================================
|
|
// User Preferences & Extensions
|
|
// ============================================================================
|
|
{
|
|
"name": "theme",
|
|
"type": "string",
|
|
"label": "Theme",
|
|
"comment": "User interface theme preference",
|
|
"length": 50,
|
|
"default": "auto",
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "metadata",
|
|
"type": "json",
|
|
"label": "Metadata",
|
|
"comment": "Extended user metadata and custom fields",
|
|
"nullable": true
|
|
},
|
|
|
|
// ============================================================================
|
|
// Authentication Fields
|
|
// ============================================================================
|
|
{
|
|
"name": "password_hash",
|
|
"type": "string",
|
|
"label": "Password Hash",
|
|
"comment": "Hashed password for authentication",
|
|
"length": 255,
|
|
"nullable": true,
|
|
"crypt": "PASSWORD"
|
|
},
|
|
|
|
// ============================================================================
|
|
// User Management Fields
|
|
// ============================================================================
|
|
{
|
|
"name": "status",
|
|
"type": "enum",
|
|
"label": "Status",
|
|
"comment": "User account status",
|
|
"option": [
|
|
"pending", // New user awaiting email verification or admin approval
|
|
"pending_invite", // New user awaiting invitation code verification
|
|
"active", // Normal user with full access to all features
|
|
"disabled", // Disabled by admin, cannot login but data retained
|
|
"suspended", // Temporarily banned due to policy violations
|
|
"locked", // System locked due to failed login attempts or security risks
|
|
"password_expired", // Password expired, requires reset before login
|
|
"email_unverified", // Email not verified, limited functionality
|
|
"archived" // Long-term inactive or former employee, data archived
|
|
],
|
|
"default": "pending",
|
|
"index": true,
|
|
"nullable": false
|
|
},
|
|
{
|
|
"name": "role_id",
|
|
"type": "string",
|
|
"label": "Role ID",
|
|
"comment": "User role identifier (references role.role_id)",
|
|
"length": 50,
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "type_id",
|
|
"type": "string",
|
|
"label": "Type ID",
|
|
"comment": "User type identifier (references user.type.type_id)",
|
|
"length": 50,
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
|
|
// ============================================================================
|
|
// Multi-Factor Authentication (MFA) Fields
|
|
// ============================================================================
|
|
{
|
|
"name": "mfa_enabled",
|
|
"type": "boolean",
|
|
"label": "MFA Enabled",
|
|
"comment": "Whether multi-factor authentication is enabled",
|
|
"default": false,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "mfa_secret",
|
|
"type": "string",
|
|
"label": "MFA Secret",
|
|
"comment": "TOTP shared secret key (Base32 encoded)",
|
|
"length": 255,
|
|
"nullable": true,
|
|
"crypt": "AES"
|
|
},
|
|
{
|
|
"name": "mfa_issuer",
|
|
"type": "string",
|
|
"label": "MFA Issuer",
|
|
"comment": "Issuer name displayed in authenticator app",
|
|
"length": 100,
|
|
"nullable": true,
|
|
"default": "Yao App Engine"
|
|
},
|
|
{
|
|
"name": "mfa_algorithm",
|
|
"type": "enum",
|
|
"label": "MFA Algorithm",
|
|
"comment": "TOTP algorithm (SHA1, SHA256, SHA512)",
|
|
"option": ["SHA1", "SHA256", "SHA512"],
|
|
"default": "SHA256",
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "mfa_digits",
|
|
"type": "integer",
|
|
"label": "MFA Digits",
|
|
"comment": "Number of digits in TOTP code (6 or 8)",
|
|
"default": 6,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "mfa_period",
|
|
"type": "integer",
|
|
"label": "MFA Period",
|
|
"comment": "TOTP time period in seconds (usually 30)",
|
|
"default": 30,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "mfa_recovery_hash",
|
|
"type": "string",
|
|
"label": "MFA Recovery Hash",
|
|
"comment": "Hashed recovery code for MFA backup authentication",
|
|
"length": 1024,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "mfa_enabled_at",
|
|
"type": "timestamp",
|
|
"label": "MFA Enabled At",
|
|
"comment": "When multi-factor authentication was enabled",
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
|
|
// ============================================================================
|
|
// User Activity Tracking Fields
|
|
// ============================================================================
|
|
{
|
|
"name": "last_login_at",
|
|
"type": "timestamp",
|
|
"label": "Last Login At",
|
|
"comment": "Last login timestamp",
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "last_login_ip",
|
|
"type": "string",
|
|
"label": "Last Login IP",
|
|
"comment": "Last login IP address",
|
|
"length": 46,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "last_login_user_agent",
|
|
"type": "string",
|
|
"label": "Last Login User Agent",
|
|
"comment": "Last login user agent string",
|
|
"length": 512,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "last_login_device",
|
|
"type": "string",
|
|
"label": "Last Login Device",
|
|
"comment": "Last login device type (e.g., mobile, desktop, tablet)",
|
|
"length": 50,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "last_login_platform",
|
|
"type": "string",
|
|
"label": "Last Login Platform",
|
|
"comment": "Last login platform (e.g., ios, android, web)",
|
|
"length": 50,
|
|
"nullable": true
|
|
},
|
|
{
|
|
"name": "mfa_last_verified_at",
|
|
"type": "timestamp",
|
|
"label": "MFA Last Verified At",
|
|
"comment": "Last time multi-factor authentication was verified",
|
|
"nullable": true,
|
|
"index": true
|
|
},
|
|
{
|
|
"name": "password_changed_at",
|
|
"type": "timestamp",
|
|
"label": "Password Changed At",
|
|
"comment": "When password was last changed",
|
|
"nullable": true
|
|
}
|
|
],
|
|
"indexes": [
|
|
{
|
|
"name": "idx_user_mfa",
|
|
"columns": ["mfa_enabled", "mfa_enabled_at"],
|
|
"type": "index",
|
|
"comment": "Index on multi-factor authentication status and time"
|
|
},
|
|
{
|
|
"name": "idx_user_verification",
|
|
"columns": ["email_verified", "phone_number_verified"],
|
|
"type": "index",
|
|
"comment": "Index on verification status for filtering"
|
|
},
|
|
{
|
|
"name": "idx_user_locale_zoneinfo",
|
|
"columns": ["locale", "zoneinfo"],
|
|
"type": "index",
|
|
"comment": "Index on locale and zoneinfo for internationalization queries"
|
|
}
|
|
],
|
|
"relations": {
|
|
"role": {
|
|
"type": "hasOne",
|
|
"model": "__yao.role",
|
|
"key": "role_id",
|
|
"foreign": "role_id"
|
|
},
|
|
"type": {
|
|
"type": "hasOne",
|
|
"model": "__yao.user.type",
|
|
"key": "type_id",
|
|
"foreign": "type_id"
|
|
},
|
|
"oauth_accounts": {
|
|
"type": "hasMany",
|
|
"model": "__yao.user.oauth_account",
|
|
"key": "user_id",
|
|
"foreign": "user_id"
|
|
},
|
|
"owned_teams": {
|
|
"type": "hasMany",
|
|
"model": "__yao.team",
|
|
"key": "user_id",
|
|
"foreign": "owner_id"
|
|
},
|
|
"team_memberships": {
|
|
"type": "hasMany",
|
|
"model": "__yao.member",
|
|
"key": "user_id",
|
|
"foreign": "user_id"
|
|
},
|
|
"teams": {
|
|
"type": "hasManyThrough",
|
|
"model": "__yao.team",
|
|
"through": "__yao.member",
|
|
"key": "user_id",
|
|
"foreign": "user_id",
|
|
"throughKey": "team_id",
|
|
"throughForeign": "team_id"
|
|
}
|
|
},
|
|
"values": [],
|
|
"option": { "timestamps": true, "soft_deletes": true, "permission": true }
|
|
}
|