feat: mega bot identity#2004
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f13282a306
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| let bot = self | ||
| .new_bot_model( | ||
| name, | ||
| organization_id, | ||
| creator_user_id, |
There was a problem hiding this comment.
The bot row is inserted first and committed before key generation/persistence, so if RSA generation or the bot_keys insert fails, register_bot returns an error but leaves behind a bot without keys. This creates inconsistent state (and can block retries via the new unique name/org index), so both writes should be wrapped in a single transaction or explicitly rolled back on failure.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8daa5fdfdc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| .col(BotInstallations::BotId) | ||
| .col(BotInstallations::TargetType) | ||
| .col(BotInstallations::TargetId) |
There was a problem hiding this comment.
The unique index uq_bot_installations_target currently includes bot_id, so it only blocks duplicate installs of the same bot on the same target, but still allows multiple different bots to be installed on one target (for example, (bot=1, repository=42) and (bot=2, repository=42) both pass). If the intended invariant is one installation per target (as the index name suggests), bot_id should not be part of this unique key.
Useful? React with 👍 / 👎.
2 participants
本 PR 引入了系统 Bot 管理的核心数据库设计和服务逻辑，实现了 Bot 注册、密钥管理、安装跟踪以及审计功能。(issue: #1951)
数据库表设计：
bots存储 Bot 的核心记录。
字段：
id：主键name：Bot 名称organization_id：可选，Bot 所属组织creator_user_id：Bot 创建者permission_scope：Bot 权限范围（Read / Write / Admin）status：当前状态（Enabled / Disabled）created_at、updated_at：时间戳索引：
name + organization_id唯一约束，避免重复创建同名 Bot。bot_keys存储每个 Bot 的 RSA 密钥对。
字段：
bot_id：关联bots.idprivate_key、public_key：PEM 编码的密钥created_at：创建时间作用：用于安全通信或签名操作。密钥在 Bot 注册时生成，并安全存储，仅返回一次 private key。
bot_installationsbot_id、target_type、target_id、status、installed_by、installed_atbot_id + target_type + target_id，保证同一个目标只能安装一个 Bot。bot_tokensbot_id、token_name、token_hash、expires_at、revoked、created_ataudit_logsactor_type（Human/Bot）、actor_id、action、target_type、target_id、metadata、created_atregister_bot函数：负责完整的 Bot 注册流程：
bots表rsacrate 生成 2048 位 RSA 密钥对bot_keys表返回 Bot 记录和 private key（私钥仅返回一次，用于安全性考虑）
扩展能力预留