Add multi-IP binding modes and deployment guide

app/models/db.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from sqlalchemy import text
 from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession, async_sessionmaker, create_async_engine
 from sqlalchemy.orm import DeclarativeBase
 
@@ -40,6 +41,31 @@ def get_session_factory() -> async_sessionmaker[AsyncSession]:
     return _session_factory
 
 
+async def ensure_schema_compatibility() -> None:
+    engine = get_engine()
+    statements = [
+        "DROP INDEX IF EXISTS idx_token_bindings_ip",
+        "ALTER TABLE token_bindings ALTER COLUMN bound_ip TYPE TEXT USING bound_ip::text",
+        "ALTER TABLE intercept_logs ALTER COLUMN bound_ip TYPE TEXT USING bound_ip::text",
+        "ALTER TABLE token_bindings ADD COLUMN IF NOT EXISTS binding_mode VARCHAR(16) DEFAULT 'single'",
+        "ALTER TABLE token_bindings ADD COLUMN IF NOT EXISTS allowed_ips JSONB DEFAULT '[]'::jsonb",
+        "UPDATE token_bindings SET binding_mode = 'single' WHERE binding_mode IS NULL OR binding_mode = ''",
+        """
+        UPDATE token_bindings
+        SET allowed_ips = jsonb_build_array(bound_ip)
+        WHERE allowed_ips IS NULL OR allowed_ips = '[]'::jsonb
+        """,
+        "ALTER TABLE token_bindings ALTER COLUMN binding_mode SET NOT NULL",
+        "ALTER TABLE token_bindings ALTER COLUMN allowed_ips SET NOT NULL",
+        "ALTER TABLE token_bindings ALTER COLUMN binding_mode SET DEFAULT 'single'",
+        "ALTER TABLE token_bindings ALTER COLUMN allowed_ips SET DEFAULT '[]'::jsonb",
+        "CREATE INDEX IF NOT EXISTS idx_token_bindings_ip ON token_bindings(bound_ip)",
+    ]
+    async with engine.begin() as connection:
+        for statement in statements:
+            await connection.execute(text(statement))
+
+
 async def close_db() -> None:
     global _engine, _session_factory
     if _engine is not None: