indraq_cli 1.5.8 → 1.9.1

package/cloud-api/.dockerignore

@@ -0,0 +1,18 @@
+node_modules
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+*.log
+.git
+.gitignore
+.indraq
+dist
+build
+.next
+coverage
+.cache
+.vite
+.turbo
+.DS_Store
+Thumbs.db

package/cloud-api/.env.example

@@ -0,0 +1,14 @@
+PORT=4010
+DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
+JWT_SECRET=replace-with-64-random-characters
+MASTER_KEY=replace-with-64-hex-characters
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=change-this-immediately
+
+# Password-reset email (required for `indraq password reset`)
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=IndraQ <no-reply@example.com>

package/cloud-api/Dockerfile

@@ -0,0 +1,19 @@
+FROM node:22-alpine AS build
+WORKDIR /myapp
+# Copy the complete project context. .dockerignore controls all exclusions.
+COPY . .
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+RUN npm run build
+RUN npm prune --omit=dev
+
+FROM node:22-alpine AS runtime
+WORKDIR /myapp
+RUN apk add --no-cache curl
+ENV NODE_ENV=production PORT=4010
+# Copy the complete filtered project from the build stage, including generated
+# build output and production node_modules. No project filenames are guessed.
+COPY --from=build --chown=node:node /myapp ./
+USER node
+EXPOSE 4010
+HEALTHCHECK --interval=30s --timeout=3s CMD curl -fsS http://127.0.0.1:4010/health >/dev/null || exit 1
+CMD ["npm", "start"]

package/cloud-api/README.md

@@ -0,0 +1,141 @@
+# IndraQ Cloud API
+
+IndraQ Cloud API is the control plane used by IndraQ CLI. It provides authentication, RBAC, projects, shared environments, encrypted user-scoped provider credentials, managed AWS IAM credential recovery/rotation, first-login password enforcement, email-OTP password reset, project infrastructure associations, automatic PostgreSQL migrations, and audit logs.
+
+## Requirements
+
+- Node.js 22+
+- PostgreSQL
+
+## Configure
+
+```powershell
+npm install
+Copy-Item .env.example .env
+```
+
+Required environment values:
+
+```env
+PORT=4010
+DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
+JWT_SECRET=replace-with-at-least-32-random-characters
+MASTER_KEY=replace-with-exactly-64-hex-characters
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=use-a-strong-password
+
+# Required for `indraq password reset`
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=IndraQ <no-reply@example.com>
+```
+
+Rules:
+
+- `JWT_SECRET` must be at least 32 characters.
+- `MASTER_KEY` must be exactly 64 hexadecimal characters (32 bytes).
+- `BOOTSTRAP_ADMIN_PASSWORD` must be at least 12 characters.
+
+Generate a master key:
+
+```powershell
+node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+```
+
+## Start
+
+Development:
+
+```powershell
+npm run build
+npm run dev
+```
+
+Production:
+
+```powershell
+npm run build
+npm start
+```
+
+Numbered migrations in `sql/` run automatically at startup.
+
+## Bootstrap admin
+
+When no admin exists, `BOOTSTRAP_ADMIN_EMAIL` and `BOOTSTRAP_ADMIN_PASSWORD` create the first administrator.
+
+Keep `MASTER_KEY` stable. Existing encrypted provider credentials cannot be resolved with a different key.
+
+## RBAC
+
+Roles:
+
+- `user`
+- `manager`
+- `admin`
+
+Managers can create/manage normal users. Only admins can create managers/admins, change user roles, and manage shared environments. Managers/admins can view audit logs.
+
+Authentication middleware rechecks the current database user state/role for protected requests rather than relying only on a stale role claim.
+
+## User-scoped provider credentials
+
+Reusable provider credentials are stored in `user_integrations` and keyed by `(user_id, provider)`.
+
+Supported provider profiles:
+
+- AWS
+- NPM
+- Jenkins Development
+- Jenkins Production
+- GHCR
+
+Secrets use AES-256-GCM because provider APIs need the original credential later. Account passwords use bcrypt.
+
+Users cannot resolve another user's provider credentials through the normal API. Provider resolution is audited and responses use `Cache-Control: no-store`.
+
+## Managed AWS IAM credentials
+
+When unified user creation generates an AWS access key, AWS returns the secret only at creation time. IndraQ can store that generated secret encrypted in `managed_aws_credentials` for the target Cloud user.
+
+The target logged-in user can later resolve their own stored AWS credential. Users can rotate their own IndraQ-managed AWS key; managers/admins can rotate keys for users they are authorized to manage. Rotation creates the replacement key, stores it encrypted, updates the target provider credential, then deletes the previous managed key. Administrative creation/deletion/rotation and user resolution are audited.
+
+## Password lifecycle
+
+Users created through the management API receive `must_change_password=true`. The first successful login must be followed by `/auth/first-login-password` before normal protected operations are allowed. Managed NPM/Jenkins identities created through the unified workflow can be rotated to the new password as part of that first-login change.
+
+Self-service password recovery uses `/auth/password-reset/request` and `/auth/password-reset/verify`. OTP values are bcrypt-hashed in PostgreSQL, expire after 10 minutes, are rate-limited, and have an attempt limit. SMTP must be configured for delivery. AWS is not a password-reset target because IndraQ AWS users are CLI/API access-key users.
+
+## Shared environments
+
+`environments` are admin-managed reusable server targets containing values such as:
+
+- name
+- description
+- IPv4 address
+- region
+
+Environment names are arbitrary. Environments are reusable address targets only; Route53 health-check settings are chosen per DNS record. PRIMARY/SECONDARY roles are assigned by a project DNS routing configuration, not stored permanently on the environment.
+
+## Projects and project resources
+
+Projects are stored separately from reusable user credentials.
+
+`project_resources` stores project-specific associations such as:
+
+- GHCR image
+- Jenkins job
+- Route53 record/health-check metadata
+- NPM proxy
+- environment association
+
+`project_members` controls WRITE membership. Every authenticated organization user can discover/view the project catalog, while creators/members with WRITE (and managers/admins) may run infrastructure-changing workflows. Managers/admins can add or remove members with an audit reason.
+
+`project_resource_grants` records service/resource-level access granted by managers/admins. IndraQ synchronizes native access where the provider supports safe granularity (for example exact Route53 record/health-check permissions and Jenkins item roles) while retaining IndraQ Cloud as the authoritative access inventory.
+
+## Audit logs
+
+Administrative and sensitive actions are written to `audit_logs`. Audit log access is restricted to managers/admins.