a4de2a7b79
Implement three-phase security upgrade: Phase 1 - RBAC: Extend JWT with roles claim, populate Spring GrantedAuthority in filter, enforce role-based access (AGENT for data/heartbeat/SSE, VIEWER+ for search/diagrams, OPERATOR+ for commands, ADMIN for user management). Configurable JWT secret via CAMELEER_JWT_SECRET env var for token persistence across restarts. Phase 2 - User persistence: ClickHouse users table with ReplacingMergeTree, UserRepository interface + ClickHouse impl, UserAdminController for CRUD at /api/v1/admin/users. Local login upserts user on each authentication. Phase 3 - OIDC: Token exchange flow where SPA sends auth code, server exchanges it server-side (keeping client_secret secure), validates id_token via JWKS, resolves roles (DB override > OIDC claim > default), issues internal JWT. Conditional on CAMELEER_OIDC_ENABLED=true. Uses oauth2-oidc-sdk for standards compliance. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
11 lines
415 B
SQL
11 lines
415 B
SQL
CREATE TABLE IF NOT EXISTS users (
|
|
user_id String,
|
|
provider LowCardinality(String),
|
|
email String DEFAULT '',
|
|
display_name String DEFAULT '',
|
|
roles Array(LowCardinality(String)),
|
|
created_at DateTime64(3, 'UTC') DEFAULT now64(3, 'UTC'),
|
|
updated_at DateTime64(3, 'UTC') DEFAULT now64(3, 'UTC')
|
|
) ENGINE = ReplacingMergeTree(updated_at)
|
|
ORDER BY (user_id);
|