37 lines
1.8 KiB
MySQL
37 lines
1.8 KiB
MySQL
|
-- Admin auth + audit for the management console.
|
||
|
|
--
|
||
|
|
-- Separate from the seed's two existing tiers on purpose:
|
||
|
|
-- * account.php — community member sessions (public users)
|
||
|
|
-- * ADMIN_TOKEN — machine/privileged bearer token
|
||
|
|
-- The console operator (you) is neither. This is a dedicated single-admin login
|
||
|
|
-- with its own session flag, so the console's blast radius never overlaps with
|
||
|
|
-- public accounts or a shared token.
|
||
|
|
--
|
||
|
|
-- Passwords are stored as a PHP password_hash() (bcrypt). Set via
|
||
|
|
-- api/cli/set-admin-password.php — never inline, never committed.
|
||
|
|
|
||
|
|
CREATE TABLE IF NOT EXISTS `cja_admin` (
|
||
|
|
`admin_id` int(10) unsigned NOT NULL AUTO_INCREMENT,
|
||
|
|
`username` varchar(60) NOT NULL,
|
||
|
|
`password_hash` varchar(255) NOT NULL,
|
||
|
|
`created_at` datetime NOT NULL DEFAULT current_timestamp(),
|
||
|
|
`last_login_at` datetime DEFAULT NULL,
|
||
|
|
PRIMARY KEY (`admin_id`),
|
||
|
|
UNIQUE KEY `uq_cja_admin_username` (`username`)
|
||
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
||
|
|
|
||
|
|
-- Every privileged action the console takes, logged. This is the accountability
|
||
|
|
-- backstop for a code-writing agent: what was asked, what was published,
|
||
|
|
-- discarded, or rolled back — with who and when.
|
||
|
|
CREATE TABLE IF NOT EXISTS `cja_admin_log` (
|
||
|
|
`log_id` int(10) unsigned NOT NULL AUTO_INCREMENT,
|
||
|
|
`actor` varchar(60) NOT NULL DEFAULT 'admin',
|
||
|
|
`action` varchar(60) NOT NULL, -- login, run, preview, publish, discard, rollback, upload
|
||
|
|
`detail` varchar(500) DEFAULT NULL,
|
||
|
|
`ip` varchar(45) DEFAULT NULL,
|
||
|
|
`created_at` datetime NOT NULL DEFAULT current_timestamp(),
|
||
|
|
PRIMARY KEY (`log_id`),
|
||
|
|
KEY `idx_cja_admin_log_feed` (`created_at`),
|
||
|
|
KEY `idx_cja_admin_log_action` (`action`, `created_at`)
|
||
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|