Merge pull request Junirezz#996 from KayMuna/feat/858

issue

Author: Junirezz

backend/prisma/migrations/20260725000000_add_scoped_admin_tokens/migration.sql

@@ -0,0 +1,37 @@
+-- Migration: Add ScopedAdminToken and ScopedAdminTokenRotationEvent tables
+-- Issue #858: Prisma storage layer for scoped admin tokens with rotation audit trail
+
+CREATE TABLE "ScopedAdminToken" (
+  "id"           TEXT      NOT NULL PRIMARY KEY,
+  "keyId"        TEXT      NOT NULL UNIQUE,
+  "hashedSecret" TEXT      NOT NULL,
+  "permissions"  TEXT      NOT NULL,
+  "label"        TEXT      NOT NULL,
+  "createdBy"    TEXT      NOT NULL,
+  "revoked"      BOOLEAN   NOT NULL DEFAULT false,
+  "revokedBy"    TEXT,
+  "revokedAt"    DATETIME,
+  "expiresAt"    DATETIME,
+  "createdAt"    DATETIME  NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "rotatedAt"    DATETIME
+);
+
+CREATE INDEX "ScopedAdminToken_keyId_idx"    ON "ScopedAdminToken"("keyId");
+CREATE INDEX "ScopedAdminToken_revoked_idx"  ON "ScopedAdminToken"("revoked");
+CREATE INDEX "ScopedAdminToken_createdAt_idx" ON "ScopedAdminToken"("createdAt");
+CREATE INDEX "ScopedAdminToken_expiresAt_idx" ON "ScopedAdminToken"("expiresAt");
+CREATE INDEX "ScopedAdminToken_createdBy_idx" ON "ScopedAdminToken"("createdBy");
+
+CREATE TABLE "ScopedAdminTokenRotationEvent" (
+  "id"           TEXT      NOT NULL PRIMARY KEY,
+  "keyId"        TEXT      NOT NULL,
+  "keyFingerprint" TEXT    NOT NULL,
+  "rotatedBy"    TEXT      NOT NULL,
+  "rotatedAt"    DATETIME  NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "ScopedAdminTokenRotationEvent_keyId_fkey"
+    FOREIGN KEY ("keyId") REFERENCES "ScopedAdminToken"("keyId") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX "ScopedAdminTokenRotationEvent_keyId_idx"    ON "ScopedAdminTokenRotationEvent"("keyId");
+CREATE INDEX "ScopedAdminTokenRotationEvent_rotatedAt_idx" ON "ScopedAdminTokenRotationEvent"("rotatedAt");
+CREATE INDEX "ScopedAdminTokenRotationEvent_rotatedBy_idx" ON "ScopedAdminTokenRotationEvent"("rotatedBy");

backend/prisma/schema.prisma

@@ -369,3 +369,50 @@ model TransactionBackfillJob {
   @@index([createdAt])
   @@index([dryRun])
 }
+
+// ─── Scoped Admin Tokens (Issue #858) ────────────────────────────────────────
+
+/// Permission-scoped admin token. Secrets are stored as SHA-256 hashes only;
+/// plaintext values are never persisted.
+model ScopedAdminToken {
+  id           String    @id @default(uuid())
+  /// Human-readable identifier prefix `yv_` + 16 hex chars.
+  keyId        String    @unique
+  /// SHA-256(secret) – used for timing-safe authentication.
+  hashedSecret String
+  /// JSON-serialised AdminPermission[].
+  permissions  String
+  label        String
+  createdBy    String
+  revoked      Boolean   @default(false)
+  revokedBy    String?
+  revokedAt    DateTime?
+  expiresAt    DateTime?
+  createdAt    DateTime  @default(now())
+  rotatedAt    DateTime?
+
+  rotationEvents ScopedAdminTokenRotationEvent[]
+
+  @@index([keyId])
+  @@index([revoked])
+  @@index([createdAt])
+  @@index([expiresAt])
+  @@index([createdBy])
+}
+
+/// Immutable audit record written on every successful secret rotation.
+/// Old hashed secrets are NOT stored; only the timing and actor are retained.
+model ScopedAdminTokenRotationEvent {
+  id        String   @id @default(uuid())
+  keyId     String
+  /// Fingerprint of the key that was rotated (sha256:<first 16 hex chars>).
+  keyFingerprint String
+  rotatedBy String
+  rotatedAt DateTime @default(now())
+
+  token ScopedAdminToken @relation(fields: [keyId], references: [keyId], onDelete: Cascade)
+
+  @@index([keyId])
+  @@index([rotatedAt])
+  @@index([rotatedBy])
+}