leocrm/app/models/session.py

"""Session model — PostgreSQL audit trail for sessions.

⚠️ Session-Tabelle dient als audit trail. Redis ist der Runtime-Session-Store.
Dies ist ein bewusstes Dual-System.

⚠️ Sessions sind nicht an IP/Device gebunden (Design-Entscheidung).
Bei Bedarf IP-Binding hinzufügen.
"""

from __future__ import annotations

import uuid
from datetime import datetime

from sqlalchemy import DateTime, ForeignKey, String, func
from sqlalchemy.dialects.postgresql import UUID as PGUUID
from sqlalchemy.orm import Mapped, mapped_column

from app.core.db import Base, TenantMixin


class Session(Base, TenantMixin):
    """Immutable session audit record. Runtime session lookup uses Redis."""

    __tablename__ = "sessions"

    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    user_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
    )
    csrf_token: Mapped[str] = mapped_column(String(255), nullable=False)
    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, index=True)
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )