Schema

Read from the live database, not from a migration file:

CREATE TABLE users (
	id          INTEGER PRIMARY KEY AUTOINCREMENT,
	provider    TEXT NOT NULL DEFAULT 'github',
	provider_id TEXT NOT NULL DEFAULT '',
	login       TEXT NOT NULL,
	email       TEXT NOT NULL DEFAULT '',
	name        TEXT NOT NULL DEFAULT '',
	avatar_url  TEXT NOT NULL DEFAULT '',
	role        TEXT NOT NULL DEFAULT 'member',
	created_at  TEXT NOT NULL,
	last_login  TEXT NOT NULL DEFAULT '',
	UNIQUE(provider, login)
);

Semantics

• An allowlist, not an account. A row grants permission; it does not create a credential. OAuth never provisions — an unknown GitHub identity is refused, so deleting the row is a complete revocation.
• provider_id binds on first sign-in. It is empty until the person actually authenticates, which is why it is possible to have a correct allowlist of people who have never used the system.
• role is one of master, admin, member, bot. master and admin are human decisions; bot is the machine principal and is never grantable through the MCP surface.

Roles

Invariants

• login is unique per provider — two rows cannot claim the same GitHub identity.
• Deleting a user cascades to their sessions and conversations (ON DELETE CASCADE), so a removal does not leave orphaned threads.

Rendered from nx-master/data-model/users.md · OKF bundle · regenerate with npm run render