create-safest-tools 0.2.0

package/template/migrations/0016_operator_accounts.sql

@@ -0,0 +1,67 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE operator_users (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL COLLATE NOCASE UNIQUE,
+  display_name TEXT NOT NULL,
+  avatar_url TEXT,
+  roles_json TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active'
+    CHECK (status IN ('active', 'suspended')),
+  password_hash TEXT,
+  password_salt TEXT,
+  password_iterations INTEGER,
+  invited_by TEXT,
+  accepted_at TEXT,
+  last_login_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX operator_users_status_idx
+  ON operator_users(status, email, id);
+
+CREATE TABLE operator_invitations (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL COLLATE NOCASE,
+  role TEXT NOT NULL
+    CHECK (role IN ('administrator', 'reviewer', 'appeal_reviewer', 'auditor')),
+  token_hash TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending', 'accepted', 'revoked')),
+  invited_by TEXT NOT NULL,
+  accepted_by TEXT REFERENCES operator_users(id),
+  expires_at TEXT NOT NULL,
+  accepted_at TEXT,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE UNIQUE INDEX operator_invitations_pending_email_idx
+  ON operator_invitations(email)
+  WHERE status = 'pending';
+CREATE INDEX operator_invitations_status_idx
+  ON operator_invitations(status, expires_at, created_at DESC, id);
+
+CREATE TABLE operator_sessions (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES operator_users(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  csrf_hash TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX operator_sessions_user_idx
+  ON operator_sessions(user_id, revoked_at, expires_at DESC, id);
+CREATE INDEX operator_sessions_expiry_idx
+  ON operator_sessions(revoked_at, expires_at, id);
+
+CREATE TABLE operator_login_limits (
+  key_hash TEXT PRIMARY KEY,
+  attempt_count INTEGER NOT NULL CHECK (attempt_count >= 0),
+  window_started_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);

package/template/migrations/0017_operator_profiles_and_recovery.sql

@@ -0,0 +1,33 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE operator_users ADD COLUMN avatar_object_key TEXT;
+ALTER TABLE operator_users ADD COLUMN avatar_uploaded_at TEXT;
+
+CREATE TABLE operator_password_resets (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES operator_users(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending', 'used', 'revoked')),
+  delivery_status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (delivery_status IN ('pending', 'delivered', 'failed', 'unavailable', 'manual')),
+  requested_by TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  delivered_at TEXT,
+  used_at TEXT,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX operator_password_resets_user_idx
+  ON operator_password_resets(user_id, status, expires_at DESC, id);
+CREATE INDEX operator_password_resets_expiry_idx
+  ON operator_password_resets(status, expires_at, id);
+
+CREATE TABLE operator_password_reset_limits (
+  key_hash TEXT PRIMARY KEY,
+  attempt_count INTEGER NOT NULL CHECK (attempt_count >= 0),
+  window_started_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);

package/template/migrations/0018_platform_configuration.sql

@@ -0,0 +1,382 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE installation_features (
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  feature_key TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('unavailable', 'disabled', 'setup_required', 'ready', 'degraded', 'paused')),
+  capability_json TEXT NOT NULL DEFAULT '{}',
+  checked_at TEXT NOT NULL,
+  error_code TEXT,
+  revision INTEGER NOT NULL DEFAULT 1 CHECK (revision >= 1),
+  PRIMARY KEY (installation_id, feature_key)
+);
+
+CREATE INDEX installation_features_state_idx
+  ON installation_features(installation_id, state, feature_key);
+
+CREATE TABLE service_identities (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  identity_key TEXT NOT NULL,
+  display_name TEXT NOT NULL,
+  identity_kind TEXT NOT NULL CHECK (identity_kind IN (
+    'integration', 'workflow_runtime', 'assistant', 'specialist_agent', 'delivery', 'maintenance'
+  )),
+  status TEXT NOT NULL CHECK (status IN ('active', 'paused', 'revoked')),
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  key_hash TEXT,
+  binding_reference TEXT,
+  created_at TEXT NOT NULL,
+  rotated_at TEXT,
+  revoked_at TEXT,
+  UNIQUE (installation_id, identity_key),
+  CHECK (key_hash IS NULL OR binding_reference IS NULL)
+);
+
+CREATE TABLE role_bindings (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('operator', 'service_identity')),
+  principal_id TEXT NOT NULL,
+  role TEXT NOT NULL CHECK (role IN (
+    'owner', 'administrator', 'workflow_author', 'reviewer', 'appeal_reviewer',
+    'operations', 'auditor', 'quality_reviewer'
+  )),
+  queue_scope_json TEXT NOT NULL DEFAULT '[]',
+  field_scope_json TEXT NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  revoked_at TEXT
+);
+
+CREATE INDEX role_bindings_principal_idx
+  ON role_bindings(installation_id, principal_type, principal_id, revoked_at, role);
+
+CREATE TABLE connection_definitions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  connection_key TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  kind TEXT NOT NULL CHECK (kind IN (
+    'webhook', 'external_api', 'customer_worker', 'ai_provider', 'notification', 'email'
+  )),
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'paused', 'archived')),
+  active_version_id TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (installation_id, connection_key)
+);
+
+CREATE INDEX connection_definitions_admin_idx
+  ON connection_definitions(installation_id, status, kind, name, id);
+
+CREATE TABLE connection_versions (
+  id TEXT PRIMARY KEY,
+  connection_id TEXT NOT NULL REFERENCES connection_definitions(id) ON DELETE CASCADE,
+  version INTEGER NOT NULL CHECK (version >= 1),
+  base_url TEXT,
+  service_binding_name TEXT,
+  allowed_hosts_json TEXT NOT NULL DEFAULT '[]',
+  allowed_methods_json TEXT NOT NULL DEFAULT '["POST"]',
+  allowed_path_prefixes_json TEXT NOT NULL DEFAULT '["/"]',
+  redirect_policy_json TEXT NOT NULL DEFAULT '{"follow":false,"maximum":0}',
+  request_limit_bytes INTEGER NOT NULL DEFAULT 65536 CHECK (request_limit_bytes BETWEEN 1 AND 1048576),
+  response_limit_bytes INTEGER NOT NULL DEFAULT 262144 CHECK (response_limit_bytes BETWEEN 1 AND 5242880),
+  response_content_types_json TEXT NOT NULL DEFAULT '["application/json"]',
+  timeout_ms INTEGER NOT NULL DEFAULT 5000 CHECK (timeout_ms BETWEEN 100 AND 120000),
+  concurrency_limit INTEGER NOT NULL DEFAULT 8 CHECK (concurrency_limit BETWEEN 1 AND 1000),
+  requests_per_window INTEGER NOT NULL DEFAULT 60 CHECK (requests_per_window BETWEEN 1 AND 1000000),
+  window_seconds INTEGER NOT NULL DEFAULT 60 CHECK (window_seconds BETWEEN 1 AND 86400),
+  credential_strategy TEXT NOT NULL DEFAULT 'none' CHECK (credential_strategy IN (
+    'none', 'static_header', 'bearer', 'hmac', 'oauth2_client_credentials',
+    'oauth2_authorization_code', 'mutual_tls', 'service_binding'
+  )),
+  secret_reference TEXT,
+  signing_strategy_json TEXT NOT NULL DEFAULT '{}',
+  oauth_configuration_json TEXT NOT NULL DEFAULT '{}',
+  published_at TEXT NOT NULL,
+  retired_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (connection_id, version),
+  CHECK ((base_url IS NOT NULL) != (service_binding_name IS NOT NULL))
+);
+
+CREATE INDEX connection_versions_lookup_idx
+  ON connection_versions(connection_id, version DESC, id);
+
+CREATE TABLE connection_health (
+  connection_version_id TEXT PRIMARY KEY REFERENCES connection_versions(id) ON DELETE CASCADE,
+  state TEXT NOT NULL DEFAULT 'unknown' CHECK (state IN ('unknown', 'healthy', 'degraded', 'open_circuit', 'paused')),
+  consecutive_failures INTEGER NOT NULL DEFAULT 0 CHECK (consecutive_failures >= 0),
+  opened_at TEXT,
+  next_probe_at TEXT,
+  last_success_at TEXT,
+  last_error_code TEXT,
+  revision INTEGER NOT NULL DEFAULT 1 CHECK (revision >= 1),
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX connection_health_probe_idx
+  ON connection_health(state, next_probe_at, connection_version_id);
+
+CREATE TABLE connection_credentials (
+  id TEXT PRIMARY KEY,
+  connection_version_id TEXT NOT NULL REFERENCES connection_versions(id) ON DELETE CASCADE,
+  strategy TEXT NOT NULL CHECK (strategy IN (
+    'static_header', 'bearer', 'hmac', 'oauth2_client_credentials',
+    'oauth2_authorization_code', 'mutual_tls', 'service_binding'
+  )),
+  secret_reference TEXT,
+  encrypted_access_token TEXT,
+  encrypted_refresh_token TEXT,
+  token_type TEXT,
+  granted_scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at TEXT,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'active', 'refresh_failed', 'revoked')),
+  last_refresh_at TEXT,
+  last_error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (connection_version_id)
+);
+
+CREATE INDEX connection_credentials_refresh_idx
+  ON connection_credentials(status, expires_at, id);
+
+CREATE TABLE connection_oauth_states (
+  id TEXT PRIMARY KEY,
+  connection_id TEXT NOT NULL REFERENCES connection_definitions(id) ON DELETE CASCADE,
+  actor_id TEXT NOT NULL,
+  operator_session_id TEXT,
+  state_hash TEXT NOT NULL UNIQUE,
+  pkce_verifier_ciphertext TEXT,
+  redirect_uri TEXT NOT NULL,
+  requested_scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX connection_oauth_states_expiry_idx
+  ON connection_oauth_states(expires_at, consumed_at, id);
+
+CREATE TABLE component_definitions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  component_key TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  component_kind TEXT NOT NULL CHECK (component_kind IN (
+    'built_in', 'webhook_enrichment', 'api_enrichment', 'workers_ai',
+    'specialist_agent', 'action', 'message'
+  )),
+  effect_class TEXT NOT NULL CHECK (effect_class IN ('read_only', 'side_effecting')),
+  owner_kind TEXT NOT NULL DEFAULT 'customer' CHECK (owner_kind IN ('safest', 'customer')),
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'paused', 'deprecated', 'archived')),
+  active_version_id TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (installation_id, component_key)
+);
+
+CREATE INDEX component_definitions_admin_idx
+  ON component_definitions(installation_id, status, component_kind, effect_class, name, id);
+
+CREATE TABLE component_versions (
+  id TEXT PRIMARY KEY,
+  definition_id TEXT NOT NULL REFERENCES component_definitions(id) ON DELETE CASCADE,
+  version INTEGER NOT NULL CHECK (version >= 1),
+  implementation_kind TEXT NOT NULL CHECK (implementation_kind IN (
+    'built_in', 'webhook', 'external_api', 'workers_ai', 'specialist_agent', 'message_template'
+  )),
+  implementation_reference TEXT NOT NULL,
+  input_schema_json TEXT NOT NULL,
+  output_schema_json TEXT NOT NULL,
+  allowed_input_fields_json TEXT NOT NULL DEFAULT '[]',
+  data_classifications_json TEXT NOT NULL DEFAULT '[]',
+  connection_version_id TEXT REFERENCES connection_versions(id),
+  risk_class TEXT NOT NULL DEFAULT 'low' CHECK (risk_class IN ('low', 'medium', 'high', 'critical')),
+  timeout_policy_json TEXT NOT NULL,
+  retry_policy_json TEXT NOT NULL,
+  cache_policy_json TEXT NOT NULL DEFAULT '{"enabled":false}',
+  concurrency_policy_json TEXT NOT NULL DEFAULT '{}',
+  budget_policy_json TEXT NOT NULL DEFAULT '{}',
+  approval_policy_json TEXT NOT NULL DEFAULT '{}',
+  tool_manifest_json TEXT NOT NULL DEFAULT '[]',
+  compatibility_json TEXT NOT NULL DEFAULT '{}',
+  package_digest TEXT,
+  signature_metadata_json TEXT,
+  published_at TEXT NOT NULL,
+  retired_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (definition_id, version)
+);
+
+CREATE INDEX component_versions_lookup_idx
+  ON component_versions(definition_id, version DESC, id);
+CREATE INDEX component_versions_connection_idx
+  ON component_versions(connection_version_id, definition_id, id);
+
+CREATE TABLE component_fixtures (
+  id TEXT PRIMARY KEY,
+  component_version_id TEXT NOT NULL REFERENCES component_versions(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  input_json TEXT NOT NULL,
+  expected_json TEXT NOT NULL,
+  expected_status TEXT NOT NULL DEFAULT 'succeeded' CHECK (expected_status IN ('succeeded', 'failed', 'timed_out')),
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (component_version_id, name)
+);
+
+CREATE TABLE component_test_runs (
+  id TEXT PRIMARY KEY,
+  component_version_id TEXT NOT NULL REFERENCES component_versions(id) ON DELETE CASCADE,
+  fixture_id TEXT REFERENCES component_fixtures(id) ON DELETE SET NULL,
+  status TEXT NOT NULL CHECK (status IN ('running', 'passed', 'failed')),
+  output_json TEXT,
+  error_code TEXT,
+  started_by TEXT NOT NULL,
+  started_at TEXT NOT NULL,
+  finished_at TEXT
+);
+
+CREATE INDEX component_test_runs_version_idx
+  ON component_test_runs(component_version_id, started_at DESC, id DESC);
+
+INSERT INTO connection_definitions (
+  id, installation_id, connection_key, name, description, kind, status,
+  active_version_id, created_by, created_at, updated_at
+)
+SELECT
+  'legacy-enrichment-connection:' || d.id,
+  d.installation_id,
+  'legacy-' || d.enrichment_key,
+  d.name || ' connection',
+  'Migrated from webhook enrichment ' || d.enrichment_key,
+  'webhook',
+  CASE d.status WHEN 'paused' THEN 'paused' WHEN 'archived' THEN 'archived' ELSE 'active' END,
+  'legacy-enrichment-connection-version:' || d.active_version_id,
+  d.created_by,
+  d.created_at,
+  d.updated_at
+FROM enrichment_definitions d;
+
+INSERT INTO connection_versions (
+  id, connection_id, version, base_url, service_binding_name,
+  allowed_hosts_json, allowed_methods_json, allowed_path_prefixes_json,
+  redirect_policy_json, request_limit_bytes, response_limit_bytes,
+  response_content_types_json, timeout_ms, concurrency_limit,
+  requests_per_window, window_seconds, credential_strategy, secret_reference,
+  signing_strategy_json, oauth_configuration_json, published_at, retired_at,
+  created_by, created_at
+)
+SELECT
+  'legacy-enrichment-connection-version:' || v.id,
+  'legacy-enrichment-connection:' || v.definition_id,
+  v.version,
+  v.webhook_url,
+  NULL,
+  json_array(json_extract(v.webhook_url, '$.host')),
+  '["POST"]',
+  '["/"]',
+  '{"follow":false,"maximum":0}',
+  65536,
+  262144,
+  '["application/json"]',
+  v.timeout_ms,
+  8,
+  60,
+  60,
+  'hmac',
+  v.secret_binding,
+  '{"kind":"safest_hmac_v1"}',
+  '{}',
+  v.published_at,
+  NULL,
+  v.created_by,
+  v.created_at
+FROM enrichment_definition_versions v;
+
+UPDATE connection_versions
+SET allowed_hosts_json = json_array(
+  substr(
+    base_url,
+    instr(base_url, '://') + 3,
+    CASE
+      WHEN instr(substr(base_url, instr(base_url, '://') + 3), '/') = 0
+        THEN length(base_url)
+      ELSE instr(substr(base_url, instr(base_url, '://') + 3), '/') - 1
+    END
+  )
+)
+WHERE id LIKE 'legacy-enrichment-connection-version:%';
+
+INSERT INTO connection_health (
+  connection_version_id, state, consecutive_failures, revision, updated_at
+)
+SELECT
+  'legacy-enrichment-connection-version:' || v.id,
+  'unknown',
+  0,
+  1,
+  v.created_at
+FROM enrichment_definition_versions v;
+
+INSERT INTO component_definitions (
+  id, installation_id, component_key, name, description, component_kind,
+  effect_class, owner_kind, status, active_version_id, created_by, created_at, updated_at
+)
+SELECT
+  d.id,
+  d.installation_id,
+  d.enrichment_key,
+  d.name,
+  d.description,
+  'webhook_enrichment',
+  'read_only',
+  'customer',
+  CASE d.status WHEN 'paused' THEN 'paused' WHEN 'archived' THEN 'archived' ELSE 'active' END,
+  d.active_version_id,
+  d.created_by,
+  d.created_at,
+  d.updated_at
+FROM enrichment_definitions d;
+
+INSERT INTO component_versions (
+  id, definition_id, version, implementation_kind, implementation_reference,
+  input_schema_json, output_schema_json, allowed_input_fields_json,
+  data_classifications_json, connection_version_id, risk_class,
+  timeout_policy_json, retry_policy_json, cache_policy_json,
+  concurrency_policy_json, budget_policy_json, approval_policy_json,
+  tool_manifest_json, compatibility_json, published_at, created_by, created_at
+)
+SELECT
+  v.id,
+  v.definition_id,
+  v.version,
+  'webhook',
+  v.webhook_url,
+  json_object('type', 'object', 'properties', json(v.input_fields_json)),
+  v.output_schema_json,
+  v.input_fields_json,
+  '["report_operational"]',
+  'legacy-enrichment-connection-version:' || v.id,
+  'low',
+  json_object('timeout_ms', v.timeout_ms),
+  json_object('maximum_attempts', v.max_attempts, 'backoff', 'exponential'),
+  json_object('enabled', CASE WHEN v.ttl_seconds > 0 THEN json('true') ELSE json('false') END, 'ttl_seconds', v.ttl_seconds),
+  '{"maximum_concurrency":8}',
+  '{}',
+  '{}',
+  '[]',
+  '{"legacy_enrichment":true}',
+  v.published_at,
+  v.created_by,
+  v.created_at
+FROM enrichment_definition_versions v;