P1.6: secure guest invitation tokens (secrets.token_urlsafe + SHA-256 hash + one-time use + session revocation)

2026-07-29 12:30:00 +02:00
parent 26bf8d3a31
commit 8539a6402c
4 changed files with 186 additions and 44 deletions
@@ -0,0 +1,51 @@
+"""Fix guest invitation security — separate token table.
+
+Revision ID: 0062
+Revises: 0061
+Create Date: 2026-07-29
+
+Problems fixed:
+1. Guest UUID was used as invitation token (P1.6)
+2. No separate token with sufficient entropy
+3. No one-time use tracking
+4. No session revocation on guest deletion
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0062"
+down_revision = "0061"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "guest_invitations",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("guest_user_id", UUID(as_uuid=True), sa.ForeignKey("guest_users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("token_hash", sa.String(64), nullable=False, unique=True, index=True),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
+    )
+    op.execute("ALTER TABLE guest_invitations ENABLE ROW LEVEL SECURITY")
+    op.execute("""
+        CREATE POLICY guest_invitations_tenant_isolation ON guest_invitations
+        FOR ALL
+        USING (
+            EXISTS (
+                SELECT 1 FROM guest_users gu
+                WHERE gu.id = guest_invitations.guest_user_id
+                AND gu.tenant_id = current_setting('app.current_tenant_id', true)::uuid
+            )
+        )
+    """)
+
+
+def downgrade() -> None:
+    op.drop_table("guest_invitations")