Adding LDAP login

alembic/versions/c9f1a2b3d4e5_add_ldap_and_default_role.py

@@ -0,0 +1,54 @@
+"""add LDAP user fields and default role flag
+
+Revision ID: c9f1a2b3d4e5
+Revises: 1b99be8a9b1e
+Create Date: 2026-07-16 00:00:00.000000
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "c9f1a2b3d4e5"
+down_revision: str | None = "1b99be8a9b1e"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    # Batch mode so SQLite can alter the nullability of hashed_password.
+    with op.batch_alter_table("users") as batch:
+        batch.add_column(sa.Column("username", sa.String(length=255), nullable=True))
+        batch.add_column(
+            sa.Column(
+                "auth_source",
+                sa.String(length=16),
+                nullable=False,
+                server_default="local",
+            )
+        )
+        batch.alter_column(
+            "hashed_password", existing_type=sa.String(length=255), nullable=True
+        )
+        batch.create_index("ix_users_username", ["username"], unique=True)
+
+    op.add_column(
+        "roles",
+        sa.Column(
+            "is_default", sa.Boolean(), nullable=False, server_default=sa.false()
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("roles", "is_default")
+
+    with op.batch_alter_table("users") as batch:
+        batch.drop_index("ix_users_username")
+        batch.alter_column(
+            "hashed_password", existing_type=sa.String(length=255), nullable=False
+        )
+        batch.drop_column("auth_source")
+        batch.drop_column("username")