Skip to main content

CMS Users & Authentication

Overview​

This domain covers CMS-side (admin) users — a separate population from the LINE friends described in LINE Friends. It spans user accounts, password history, forgot-password tokens, and per-channel access restrictions.

Users come in two flavours via the UserType enum: onemoby (the platform team) and customer (client-side users). Customer login looks up (email, type='customer', status='active'), and a unique index enforces that combination.

Core Data Structure​

user (model User)​

Stores email, firstname, lastname, avatar, type (UserType) and status (CommonStatus), with an organization_id FK to organization.id and a role_id FK to system_role.id (default 0). Deletion is soft, via deleted_date.

Worth noting is the partial unique index user_email_customer_uq, built on lower(email) and applying only to rows where type='customer', deleted_date IS NULL, and status is not delete. Making it partial is deliberate: it lets an onemoby user reuse the same email address as their own customer account.

password_history​

Keeps historical bcrypt password hashes per user, with user_id (FK to user.id), password, created_date and expired_date.

The current password is simply the most recent row that has not expired — the user table has no password column at all.

forgot_password​

Password-reset tokens, made up of code (VARCHAR 50), user_id, expired_date, status and deleted_date.

user_line_oa​

Created through a migration / manual SQL and absent from Prisma, this table restricts which channels each user can access, with a unique constraint on (user_id, line_oa_id).

The rule is simple: a user with no rows here sees every OA in the organization (backward compatible with existing data), while a user with rows sees only the OAs listed.

  • prisma/schema.prisma:215 — model User
  • prisma/schema.prisma:464 — model PasswordHistory
  • prisma/schema.prisma:477 — model ForgotPassword
  • prisma/migrations/20260727120000_add_user_line_oa/migration.sql — the user_line_oa table
  • prisma/migrations/20260727150000_user_email_customer_unique/migration.sql — the customer email unique index
  • seed-data/05.user.sql — seeds the 1Moby team as both onemoby and customer users
  • seed-data/10.password_history.sql — seeds the initial password (bcrypt hash, expiring in 2099)

Connections to Other Services​

  • cms-api-go — handles login and token refresh, the forgot/reset password flow, user management, and uses user_line_oa to filter the channel list each user sees.
  • user.id is referenced as created_by and updated_by across nearly every table in the system. There is no real FK; it is stored as a plain numeric value.
  • Connects to Roles & Module Permissions through role_id, and Organizations & Plans through organization_id.