indraq_cli 1.5.8 → 1.9.1

package/cloud-api/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@indraq/cloud-api",
+  "private": true,
+  "version": "0.4.0",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "bcryptjs": "^3.0.2",
+    "dotenv": "^17.2.2",
+    "express": "^5.1.0",
+    "jsonwebtoken": "^9.0.2",
+    "pg": "^8.16.3",
+    "nodemailer": "^6.9.16",
+    "@aws-sdk/client-iam": "^3.1123.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.3",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^24.3.0",
+    "@types/pg": "^8.15.5",
+    "tsx": "^4.20.5",
+    "typescript": "^5.9.2",
+    "@types/nodemailer": "^6.4.17"
+  }
+}

package/cloud-api/sql/001_init.sql

@@ -0,0 +1,8 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+CREATE TABLE IF NOT EXISTS users (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), email text UNIQUE NOT NULL, name text NOT NULL, password_hash text NOT NULL, role text NOT NULL CHECK (role IN ('user','manager','admin')), is_active boolean NOT NULL DEFAULT true, created_by uuid REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS projects (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL, kind text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS project_members (project_id uuid REFERENCES projects(id) ON DELETE CASCADE, user_id uuid REFERENCES users(id) ON DELETE CASCADE, role text NOT NULL DEFAULT 'user', PRIMARY KEY(project_id,user_id));
+CREATE TABLE IF NOT EXISTS servers (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL UNIQUE, environment text NOT NULL, ipv4 inet NOT NULL, health_path text DEFAULT '/health', is_backup boolean NOT NULL DEFAULT false, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS project_integrations (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE, provider text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, encrypted_secret text, UNIQUE(project_id,provider));
+CREATE TABLE IF NOT EXISTS audit_logs (id bigserial PRIMARY KEY, actor_id uuid REFERENCES users(id), action text NOT NULL, resource_type text NOT NULL, resource_id text, reason text, metadata jsonb NOT NULL DEFAULT '{}'::jsonb, created_at timestamptz NOT NULL DEFAULT now());
+CREATE INDEX IF NOT EXISTS audit_logs_created_at_idx ON audit_logs(created_at DESC);

package/cloud-api/sql/002_user_providers_and_project_resources.sql

@@ -0,0 +1,40 @@
+CREATE TABLE IF NOT EXISTS user_integrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  encrypted_secret text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(user_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS user_integrations_user_idx
+  ON user_integrations(user_id, provider);
+
+CREATE TABLE IF NOT EXISTS project_resources (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  environment text NOT NULL DEFAULT 'dev',
+  resource_type text NOT NULL,
+  provider text NOT NULL,
+  provider_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  external_id text,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_by uuid REFERENCES users(id),
+  updated_by uuid REFERENCES users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(project_id, environment, resource_type)
+);
+
+CREATE INDEX IF NOT EXISTS project_resources_project_idx
+  ON project_resources(project_id, environment, resource_type);
+
+CREATE INDEX IF NOT EXISTS project_resources_provider_user_idx
+  ON project_resources(provider_user_id, provider);
+
+-- provider credentials belong to an authenticated IndraQ user and are
+-- reusable across every project that user can access. Project resources keep
+-- only infrastructure associations plus the user whose provider profile last
+-- reconciled the resource.

package/cloud-api/sql/003_environment_infrastructure.sql

@@ -0,0 +1,19 @@
+-- shared admin-managed named environments.
+-- Environments are generic reusable targets. PRIMARY/SECONDARY is assigned only
+-- when a project creates a FAILOVER Route53 record.
+CREATE TABLE IF NOT EXISTS environments (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL UNIQUE,
+  description text,
+  ipv4 inet NOT NULL,
+  region text,
+  health_path text NOT NULL DEFAULT '/health',
+  created_by uuid NOT NULL REFERENCES users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS environments_name_idx ON environments(name);
+
+ALTER TABLE project_resources
+  ADD COLUMN IF NOT EXISTS environment_id uuid REFERENCES environments(id) ON DELETE SET NULL;

package/cloud-api/sql/004_managed_aws_credentials.sql

@@ -0,0 +1,20 @@
+-- managed AWS IAM credentials.
+-- AWS only returns SecretAccessKey when an access key is created. IndraQ stores
+-- the generated secret encrypted in Cloud so the owning IndraQ user can resolve
+-- it later without relying on AWS to recover it.
+CREATE TABLE IF NOT EXISTS managed_aws_credentials (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  aws_username text NOT NULL,
+  access_key_id text NOT NULL,
+  encrypted_secret_access_key text NOT NULL,
+  indraq_role text NOT NULL CHECK (indraq_role IN ('user','manager','admin')),
+  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(cloud_user_id, aws_username),
+  UNIQUE(access_key_id)
+);
+
+CREATE INDEX IF NOT EXISTS managed_aws_credentials_user_idx
+  ON managed_aws_credentials(cloud_user_id, aws_username);

package/cloud-api/sql/005_project_members_and_resource_grants.sql

@@ -0,0 +1,22 @@
+-- Project membership and per-resource access grants.
+-- Project membership lets a user work with a project; resource grants control
+-- which provider resources a normal user can read/update. Managers/admins can
+-- manage membership and grants with audited reasons.
+ALTER TABLE project_members
+  ADD COLUMN IF NOT EXISTS added_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  ADD COLUMN IF NOT EXISTS added_at timestamptz NOT NULL DEFAULT now();
+
+CREATE TABLE IF NOT EXISTS project_resource_grants (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_resource_id uuid NOT NULL REFERENCES project_resources(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  permission text NOT NULL DEFAULT 'manage' CHECK (permission IN ('view','manage')),
+  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(project_resource_id, user_id)
+);
+
+CREATE INDEX IF NOT EXISTS project_resource_grants_user_idx
+  ON project_resource_grants(user_id, project_resource_id);
+CREATE INDEX IF NOT EXISTS project_resource_grants_resource_idx
+  ON project_resource_grants(project_resource_id, user_id);

package/cloud-api/sql/006_catalog_identity_password_security.sql

@@ -0,0 +1,96 @@
+-- Organization-wide catalog constraints, project access levels, first-login
+-- password changes, self-service OTP resets, and managed external identities.
+
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS password_changed_at timestamptz,
+  ADD COLUMN IF NOT EXISTS last_login_at timestamptz;
+
+ALTER TABLE project_members
+  ADD COLUMN IF NOT EXISTS access_level text NOT NULL DEFAULT 'write';
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'project_members_access_level_check'
+  ) THEN
+    ALTER TABLE project_members
+      ADD CONSTRAINT project_members_access_level_check
+      CHECK (access_level IN ('view','write'));
+  END IF;
+END $$;
+
+UPDATE project_members SET access_level='write' WHERE role='owner';
+
+-- Resolve historical duplicate project names before enforcing organization-wide
+-- case-insensitive uniqueness. The oldest row keeps the original display name.
+WITH ranked AS (
+  SELECT id, name,
+         row_number() OVER (PARTITION BY lower(name) ORDER BY created_at, id) AS rn
+  FROM projects
+)
+UPDATE projects p
+SET name = p.name || '-legacy-' || left(p.id::text, 8), updated_at=now()
+FROM ranked r
+WHERE p.id=r.id AND r.rn > 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS projects_name_lower_unique_idx
+  ON projects (lower(name));
+
+-- GHCR image names are organization-wide claims. Resolve historical duplicate
+-- DB claims before adding the unique index; this does not mutate any registry.
+WITH ranked AS (
+  SELECT id,
+         row_number() OVER (
+           PARTITION BY lower(config->>'fullImage')
+           ORDER BY created_at, id
+         ) AS rn
+  FROM project_resources
+  WHERE provider='ghcr'
+    AND config ? 'fullImage'
+    AND coalesce(config->>'fullImage','') <> ''
+)
+UPDATE project_resources pr
+SET config = jsonb_set(
+      jsonb_set(pr.config, '{fullImage}', to_jsonb((pr.config->>'fullImage') || '-legacy-' || left(pr.id::text,8)), true),
+      '{imageName}', to_jsonb(coalesce(pr.config->>'imageName','image') || '-legacy-' || left(pr.id::text,8)), true
+    ),
+    updated_at=now()
+FROM ranked r
+WHERE pr.id=r.id AND r.rn > 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS project_resources_ghcr_full_image_unique_idx
+  ON project_resources ((lower(config->>'fullImage')))
+  WHERE provider='ghcr'
+    AND config ? 'fullImage'
+    AND coalesce(config->>'fullImage','') <> '';
+
+CREATE TABLE IF NOT EXISTS managed_external_accounts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL CHECK (provider IN ('npm','jenkins-dev','jenkins-prod')),
+  external_username text NOT NULL,
+  external_email text,
+  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(cloud_user_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS managed_external_accounts_manager_idx
+  ON managed_external_accounts(managed_by_user_id, provider);
+
+CREATE TABLE IF NOT EXISTS password_reset_otps (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  otp_hash text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  attempts integer NOT NULL DEFAULT 0,
+  max_attempts integer NOT NULL DEFAULT 5,
+  used_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS password_reset_otps_user_idx
+  ON password_reset_otps(user_id, created_at DESC);

package/cloud-api/sql/007_aws_access_key_rotation.sql

@@ -0,0 +1,16 @@
+-- AWS access-key rotation ownership.
+-- The manager/admin provider that manages an IAM user's key is tracked so a
+-- normal user can request self-service rotation without receiving broad IAM
+-- permissions. Managers/admins can rotate keys for users they are allowed to
+-- manage. Secret access keys remain encrypted at rest in IndraQ Cloud.
+
+ALTER TABLE managed_aws_credentials
+  ADD COLUMN IF NOT EXISTS managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL;
+
+UPDATE managed_aws_credentials
+SET managed_by_user_id = created_by
+WHERE managed_by_user_id IS NULL
+  AND created_by IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS managed_aws_credentials_manager_idx
+  ON managed_aws_credentials(managed_by_user_id, cloud_user_id);