feat(persistence): saved diagram views + table annotations - #467
Conversation
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Split out of the adhesive-piper foundation as an independent PR against main. Two persisted entities sharing the alembic chain (0004_merge_heads resolves main's two 0003 heads -> 0005_diagram_view -> 0006_table_annotation), models.py, and router registration. /api/diagram-views (save/load ERD canvas layouts) and /api/annotations (per-table notes), both editor-gated + IDOR-safe uniform 404. +8 tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
…hare down_revision='0002' references a nonexistent revision (actual id 0002_auth_share); alembic upgrade head fails with KeyError '0002' on a fresh DB. Latent on main; surfaces once this PR's 0004_merge_heads chain is walked. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
Stacked on #467 (needs TableAnnotation); auto-retargets to main when #467 merges. GET /api/snapshots/{uuid}/data-dictionary.md renders a dialect-agnostic Markdown data dictionary (schema sections, columns table, FKs, indexes, view labels) merged with the project's table annotations. IDOR-safe. Frontend download button follows once the frontend foundation lands. +tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
P2 roadmap item — API-first platform access. Bearer pgerd_* keys accepted by get_current_user alongside OIDC (non-invasive branch). Secrets never stored: SHA-256 hash only, plaintext returned exactly once at creation, key_prefix for recognition, revocation is an auditable timestamp (idempotent). /api/api-keys: POST create, GET list (metadata only), DELETE revoke (uniform 404 for other users' keys). Also carries the 0003_revoked_token down_revision fix ('0002' -> '0002_auth_share') without which alembic upgrade head breaks on a fresh DB. Migration 0007 verified against real Postgres. +5 tests; backend suite 236; mypy clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
Addresses github-code-quality r3531583397 (unused 'patch') and CodeQL r3531597887: the hashed value is a server-generated 256-bit random token, not a password — a slow KDF adds nothing and a deterministic digest is required for the unique-indexed lookup (same scheme GitHub uses for PATs). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
7aeebd9 to
dfe029d
Compare
|
🤖 Rebased onto What happened: the previous branch tip was a botched merge commit that resolved conflicts by discarding the entire feature — the pushed tree was byte-identical to Conflicts resolved (all clean unions, no feature or base change dropped):
Base work preserved: the Sentinel Verified: all changed Python compiles; every changed module imports and the FastAPI app assembles; Net diff = the 18 intended feature files, nothing else. Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com |
CodeQL py/weak-sensitive-data-hashing (high) flagged hash_api_key using a bare SHA-256 digest on token material. The token is a server-generated 256-bit random value (not a password), so a slow KDF is unwarranted and a deterministic digest is required for the unique-indexed O(1) lookup. Switch to HMAC-SHA-256 keyed with settings.app_secret: the server secret acts as a pepper so a database-only disclosure of key_hash cannot be reversed or matched against precomputed tables without also compromising the application secret. Output stays a deterministic 64-char hex, so the indexed lookup is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryApproval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Backend (18 files)"]
S1 --> I1["API and service runtime"]
I1 --> R1["Review risk: Backend (18 files)"]
R1 --> V1["backend tests"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including backend/alembic/versions/0003_revoked_token.py, backend/alembic/versions/0004_merge_heads.py, backend/alembic/versions/0005_diagram_view.py, backend/alembic/versions/0006_table_annotation.py, backend/alembic/versions/0007_api_key.py, and 13 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects backend/alembic/versions/0003_revoked_token.py to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: The changes introduce well-documented and tested features for saved diagram views and table annotations, with proper security or data integrity considerations.
- Head SHA:
3ff55b7e527e317103fc5edca84e5ae0164fa5e8 - Workflow run: 29123208848
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Backend (18 files)"]
S1 --> I1["API and service runtime"]
I1 --> R1["Review risk: Backend (18 files)"]
R1 --> V1["backend tests"]
2 participants
Independent PR against
main(split out of #440). Now also contains the merged stack: #469 (data dictionary export) and #485 (API keys).0004_merge_heads→0005→0006, editor-gated, IDOR-safe)GET /data-dictionary.md— Markdown data dictionary merged with annotations (living documentation)/api/api-keys,Bearer pgerd_…inget_current_user): SHA-256 hash only, secret shown once, auditable revocation, uniform 404; migration0007_api_keyverified on real Postgres; also fixes the latent0003_revoked_tokendown_revision bug that breaksalembic upgrade headon fresh DBsbackend tests incl. IDOR/editor gates; mypy clean.
🤖 Generated with Claude Code