indraq_cli 1.9.1 → 2.0.0

package/cloud-api/.env

@@ -0,0 +1,6 @@
+PORT=4010
+DATABASE_URL=postgresql://harry:Staykool%401@192.168.10.101:23561/indraq_cloud
+JWT_SECRET=8f3c2a9d4e6b7f00112233445566778899aabbccddeeff001122334455667788
+MASTER_KEY=8f3c2a9d4e6b7f00112233445566778899aabbccddeeff001122334455667788
+BOOTSTRAP_ADMIN_EMAIL=harkaran@indraq.com
+BOOTSTRAP_ADMIN_PASSWORD=Saini@harkaran-1

package/cloud-api/.env.example

@@ -1,14 +1,14 @@
-PORT=4010
-DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
-JWT_SECRET=replace-with-64-random-characters
-MASTER_KEY=replace-with-64-hex-characters
-BOOTSTRAP_ADMIN_EMAIL=admin@example.com
-BOOTSTRAP_ADMIN_PASSWORD=change-this-immediately
-
-# Password-reset email (required for `indraq password reset`)
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=
-SMTP_PASS=
-SMTP_FROM=IndraQ <no-reply@example.com>
+PORT=4010
+DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
+JWT_SECRET=replace-with-64-random-characters
+MASTER_KEY=replace-with-64-hex-characters
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=change-this-immediately
+
+# Password-reset email (required for `indraq password reset`)
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=IndraQ <no-reply@example.com>

package/cloud-api/README.md

@@ -1,141 +1,145 @@
-# IndraQ Cloud API
-
-IndraQ Cloud API is the control plane used by IndraQ CLI. It provides authentication, RBAC, projects, shared environments, encrypted user-scoped provider credentials, managed AWS IAM credential recovery/rotation, first-login password enforcement, email-OTP password reset, project infrastructure associations, automatic PostgreSQL migrations, and audit logs.
-
-## Requirements
-
-- Node.js 22+
-- PostgreSQL
-
-## Configure
-
-```powershell
-npm install
-Copy-Item .env.example .env
-```
-
-Required environment values:
-
-```env
-PORT=4010
-DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
-JWT_SECRET=replace-with-at-least-32-random-characters
-MASTER_KEY=replace-with-exactly-64-hex-characters
-BOOTSTRAP_ADMIN_EMAIL=admin@example.com
-BOOTSTRAP_ADMIN_PASSWORD=use-a-strong-password
-
-# Required for `indraq password reset`
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=
-SMTP_PASS=
-SMTP_FROM=IndraQ <no-reply@example.com>
-```
-
-Rules:
-
-- `JWT_SECRET` must be at least 32 characters.
-- `MASTER_KEY` must be exactly 64 hexadecimal characters (32 bytes).
-- `BOOTSTRAP_ADMIN_PASSWORD` must be at least 12 characters.
-
-Generate a master key:
-
-```powershell
-node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
-```
-
-## Start
-
-Development:
-
-```powershell
-npm run build
-npm run dev
-```
-
-Production:
-
-```powershell
-npm run build
-npm start
-```
-
-Numbered migrations in `sql/` run automatically at startup.
-
-## Bootstrap admin
-
-When no admin exists, `BOOTSTRAP_ADMIN_EMAIL` and `BOOTSTRAP_ADMIN_PASSWORD` create the first administrator.
-
-Keep `MASTER_KEY` stable. Existing encrypted provider credentials cannot be resolved with a different key.
-
-## RBAC
-
-Roles:
-
-- `user`
-- `manager`
-- `admin`
-
-Managers can create/manage normal users. Only admins can create managers/admins, change user roles, and manage shared environments. Managers/admins can view audit logs.
-
-Authentication middleware rechecks the current database user state/role for protected requests rather than relying only on a stale role claim.
-
-## User-scoped provider credentials
-
-Reusable provider credentials are stored in `user_integrations` and keyed by `(user_id, provider)`.
-
-Supported provider profiles:
-
-- AWS
-- NPM
-- Jenkins Development
-- Jenkins Production
-- GHCR
-
-Secrets use AES-256-GCM because provider APIs need the original credential later. Account passwords use bcrypt.
-
-Users cannot resolve another user's provider credentials through the normal API. Provider resolution is audited and responses use `Cache-Control: no-store`.
-
-## Managed AWS IAM credentials
-
-When unified user creation generates an AWS access key, AWS returns the secret only at creation time. IndraQ can store that generated secret encrypted in `managed_aws_credentials` for the target Cloud user.
-
-The target logged-in user can later resolve their own stored AWS credential. Users can rotate their own IndraQ-managed AWS key; managers/admins can rotate keys for users they are authorized to manage. Rotation creates the replacement key, stores it encrypted, updates the target provider credential, then deletes the previous managed key. Administrative creation/deletion/rotation and user resolution are audited.
-
-## Password lifecycle
-
-Users created through the management API receive `must_change_password=true`. The first successful login must be followed by `/auth/first-login-password` before normal protected operations are allowed. Managed NPM/Jenkins identities created through the unified workflow can be rotated to the new password as part of that first-login change.
-
-Self-service password recovery uses `/auth/password-reset/request` and `/auth/password-reset/verify`. OTP values are bcrypt-hashed in PostgreSQL, expire after 10 minutes, are rate-limited, and have an attempt limit. SMTP must be configured for delivery. AWS is not a password-reset target because IndraQ AWS users are CLI/API access-key users.
-
-## Shared environments
-
-`environments` are admin-managed reusable server targets containing values such as:
-
-- name
-- description
-- IPv4 address
-- region
-
-Environment names are arbitrary. Environments are reusable address targets only; Route53 health-check settings are chosen per DNS record. PRIMARY/SECONDARY roles are assigned by a project DNS routing configuration, not stored permanently on the environment.
-
-## Projects and project resources
-
-Projects are stored separately from reusable user credentials.
-
-`project_resources` stores project-specific associations such as:
-
-- GHCR image
-- Jenkins job
-- Route53 record/health-check metadata
-- NPM proxy
-- environment association
-
-`project_members` controls WRITE membership. Every authenticated organization user can discover/view the project catalog, while creators/members with WRITE (and managers/admins) may run infrastructure-changing workflows. Managers/admins can add or remove members with an audit reason.
-
-`project_resource_grants` records service/resource-level access granted by managers/admins. IndraQ synchronizes native access where the provider supports safe granularity (for example exact Route53 record/health-check permissions and Jenkins item roles) while retaining IndraQ Cloud as the authoritative access inventory.
-
-## Audit logs
-
-Administrative and sensitive actions are written to `audit_logs`. Audit log access is restricted to managers/admins.
+# IndraQ Cloud API
+
+IndraQ Cloud API is the control plane used by IndraQ CLI. It provides authentication, RBAC, projects, shared environments, encrypted user-scoped provider credentials, managed AWS IAM credential recovery/rotation, first-login password enforcement, email-OTP password reset, project infrastructure associations, automatic PostgreSQL migrations, and audit logs.
+
+## Requirements
+
+- Node.js 22+
+- PostgreSQL
+
+## Configure
+
+```powershell
+npm install
+Copy-Item .env.example .env
+```
+
+Required environment values:
+
+```env
+PORT=4010
+DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
+JWT_SECRET=replace-with-at-least-32-random-characters
+MASTER_KEY=replace-with-exactly-64-hex-characters
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=use-a-strong-password
+
+# Required for `indraq password reset`
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=IndraQ <no-reply@example.com>
+```
+
+Rules:
+
+- `JWT_SECRET` must be at least 32 characters.
+- `MASTER_KEY` must be exactly 64 hexadecimal characters (32 bytes).
+- `BOOTSTRAP_ADMIN_PASSWORD` must be at least 12 characters.
+
+Generate a master key:
+
+```powershell
+node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+```
+
+## Start
+
+Development:
+
+```powershell
+npm run build
+npm run dev
+```
+
+Production:
+
+```powershell
+npm run build
+npm start
+```
+
+Numbered migrations in `sql/` run automatically at startup.
+
+## Bootstrap admin
+
+When no admin exists, `BOOTSTRAP_ADMIN_EMAIL` and `BOOTSTRAP_ADMIN_PASSWORD` create the first administrator.
+
+Keep `MASTER_KEY` stable. Existing encrypted provider credentials cannot be resolved with a different key.
+
+## RBAC
+
+Roles:
+
+- `user`
+- `manager`
+- `admin`
+
+Managers can create/manage normal users. Only admins can create managers/admins, change user roles, and manage shared environments. Managers/admins can view audit logs.
+
+Authentication middleware rechecks the current database user state/role for protected requests rather than relying only on a stale role claim.
+
+## User-scoped provider credentials
+
+Reusable provider credentials are stored in `user_integrations` and keyed by `(user_id, provider)`.
+
+Supported provider profiles:
+
+- AWS
+- NPM
+- Jenkins Development
+- Jenkins Production
+- GHCR
+
+Secrets use AES-256-GCM because provider APIs need the original credential later. Account passwords use bcrypt.
+
+Users cannot resolve another user's provider credentials through the normal API. Provider resolution is audited and responses use `Cache-Control: no-store`.
+
+## Managed AWS IAM credentials
+
+When unified user creation generates an AWS access key, AWS returns the secret only at creation time. IndraQ can store that generated secret encrypted in `managed_aws_credentials` for the target Cloud user.
+
+The target logged-in user can later resolve their own stored AWS credential. Users can rotate their own IndraQ-managed AWS key; managers/admins can rotate keys for users they are authorized to manage. Rotation creates the replacement key, stores it encrypted, updates the target provider credential, then deletes the previous managed key. Administrative creation/deletion/rotation and user resolution are audited.
+
+## Password lifecycle
+
+Users created through the management API receive `must_change_password=true`. The first successful login must be followed by `/auth/first-login-password` before normal protected operations are allowed. Managed NPM/Jenkins identities created through the unified workflow can be rotated to the new password as part of that first-login change.
+
+Self-service password recovery uses `/auth/password-reset/request` and `/auth/password-reset/verify`. OTP values are bcrypt-hashed in PostgreSQL, expire after 10 minutes, are rate-limited, and have an attempt limit. SMTP must be configured for delivery. AWS is not a password-reset target because IndraQ AWS users are CLI/API access-key users.
+
+## Shared environments
+
+`environments` are admin-managed reusable server targets containing values such as:
+
+- name
+- description
+- IPv4 address
+- region
+
+Environment names are arbitrary. Environments are reusable address targets only; Route53 health-check settings are chosen per DNS record. PRIMARY/SECONDARY roles are assigned by a project DNS routing configuration, not stored permanently on the environment.
+
+## Projects and project resources
+
+Projects are stored separately from reusable user credentials.
+
+`project_resources` stores project-specific associations such as:
+
+- GHCR image
+- Jenkins job
+- Route53 record/health-check metadata
+- NPM proxy
+- environment association
+
+`project_members` controls project membership. Every authenticated organization user can discover/view the project catalog, while creators/members with WRITE (and managers/admins) may run infrastructure-changing workflows. In v2.0, adding a project member also inherits every project resource that already exists, creating matching `project_resource_grants` with VIEW or MANAGE permission. Removing the member removes that project's resource grants.
+
+`project_resource_grants` records service/resource-level access. The CLI synchronizes native access where the provider supports safe granularity (for example exact Route53 record/health-check permissions and Jenkins item roles). Nginx Proxy Manager does not expose a safe per-proxy multi-owner ACL and GHCR direct local access requires the user's own GitHub/GHCR token, so the API never leaks an administrator credential to simulate those permissions.
+
+## User deletion and project retention
+
+User deletion is a hard delete. The CLI removes configured external identities first, then calls the Cloud delete endpoint last. The Cloud API reassigns shared resource ownership to the acting manager/admin before deleting the user row. Project definitions, environments, project resources, DNS/proxy/GHCR/Jenkins metadata and audit history are retained; user-scoped memberships, grants, integrations and managed credentials cascade with the deleted identity.
+
+## Audit logs
+
+Administrative and sensitive actions are written to `audit_logs`. Audit log access is restricted to managers/admins.

package/cloud-api/package.json

@@ -1,29 +1,29 @@
-{
-  "name": "@indraq/cloud-api",
-  "private": true,
-  "version": "0.4.0",
-  "type": "module",
-  "scripts": {
-    "dev": "tsx watch src/index.ts",
-    "build": "tsc",
-    "start": "node dist/index.js"
-  },
-  "dependencies": {
-    "bcryptjs": "^3.0.2",
-    "dotenv": "^17.2.2",
-    "express": "^5.1.0",
-    "jsonwebtoken": "^9.0.2",
-    "pg": "^8.16.3",
-    "nodemailer": "^6.9.16",
-    "@aws-sdk/client-iam": "^3.1123.0"
-  },
-  "devDependencies": {
-    "@types/express": "^5.0.3",
-    "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^24.3.0",
-    "@types/pg": "^8.15.5",
-    "tsx": "^4.20.5",
-    "typescript": "^5.9.2",
-    "@types/nodemailer": "^6.4.17"
-  }
-}
+{
+  "name": "@indraq/cloud-api",
+  "private": true,
+  "version": "0.4.1",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "bcryptjs": "^3.0.2",
+    "dotenv": "^17.2.2",
+    "express": "^5.1.0",
+    "jsonwebtoken": "^9.0.2",
+    "pg": "^8.16.3",
+    "nodemailer": "^6.9.16",
+    "@aws-sdk/client-iam": "^3.1123.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.3",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^24.3.0",
+    "@types/pg": "^8.15.5",
+    "tsx": "^4.20.5",
+    "typescript": "^5.9.2",
+    "@types/nodemailer": "^6.4.17"
+  }
+}

package/cloud-api/sql/001_init.sql

@@ -1,8 +1,8 @@
-CREATE EXTENSION IF NOT EXISTS pgcrypto;
-CREATE TABLE IF NOT EXISTS users (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), email text UNIQUE NOT NULL, name text NOT NULL, password_hash text NOT NULL, role text NOT NULL CHECK (role IN ('user','manager','admin')), is_active boolean NOT NULL DEFAULT true, created_by uuid REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
-CREATE TABLE IF NOT EXISTS projects (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL, kind text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
-CREATE TABLE IF NOT EXISTS project_members (project_id uuid REFERENCES projects(id) ON DELETE CASCADE, user_id uuid REFERENCES users(id) ON DELETE CASCADE, role text NOT NULL DEFAULT 'user', PRIMARY KEY(project_id,user_id));
-CREATE TABLE IF NOT EXISTS servers (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL UNIQUE, environment text NOT NULL, ipv4 inet NOT NULL, health_path text DEFAULT '/health', is_backup boolean NOT NULL DEFAULT false, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now());
-CREATE TABLE IF NOT EXISTS project_integrations (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE, provider text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, encrypted_secret text, UNIQUE(project_id,provider));
-CREATE TABLE IF NOT EXISTS audit_logs (id bigserial PRIMARY KEY, actor_id uuid REFERENCES users(id), action text NOT NULL, resource_type text NOT NULL, resource_id text, reason text, metadata jsonb NOT NULL DEFAULT '{}'::jsonb, created_at timestamptz NOT NULL DEFAULT now());
-CREATE INDEX IF NOT EXISTS audit_logs_created_at_idx ON audit_logs(created_at DESC);
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+CREATE TABLE IF NOT EXISTS users (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), email text UNIQUE NOT NULL, name text NOT NULL, password_hash text NOT NULL, role text NOT NULL CHECK (role IN ('user','manager','admin')), is_active boolean NOT NULL DEFAULT true, created_by uuid REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS projects (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL, kind text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS project_members (project_id uuid REFERENCES projects(id) ON DELETE CASCADE, user_id uuid REFERENCES users(id) ON DELETE CASCADE, role text NOT NULL DEFAULT 'user', PRIMARY KEY(project_id,user_id));
+CREATE TABLE IF NOT EXISTS servers (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL UNIQUE, environment text NOT NULL, ipv4 inet NOT NULL, health_path text DEFAULT '/health', is_backup boolean NOT NULL DEFAULT false, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS project_integrations (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE, provider text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, encrypted_secret text, UNIQUE(project_id,provider));
+CREATE TABLE IF NOT EXISTS audit_logs (id bigserial PRIMARY KEY, actor_id uuid REFERENCES users(id), action text NOT NULL, resource_type text NOT NULL, resource_id text, reason text, metadata jsonb NOT NULL DEFAULT '{}'::jsonb, created_at timestamptz NOT NULL DEFAULT now());
+CREATE INDEX IF NOT EXISTS audit_logs_created_at_idx ON audit_logs(created_at DESC);

package/cloud-api/sql/002_user_providers_and_project_resources.sql

@@ -1,40 +1,40 @@
-CREATE TABLE IF NOT EXISTS user_integrations (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  provider text NOT NULL,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  encrypted_secret text,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(user_id, provider)
-);
-
-CREATE INDEX IF NOT EXISTS user_integrations_user_idx
-  ON user_integrations(user_id, provider);
-
-CREATE TABLE IF NOT EXISTS project_resources (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
-  environment text NOT NULL DEFAULT 'dev',
-  resource_type text NOT NULL,
-  provider text NOT NULL,
-  provider_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
-  external_id text,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_by uuid REFERENCES users(id),
-  updated_by uuid REFERENCES users(id),
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(project_id, environment, resource_type)
-);
-
-CREATE INDEX IF NOT EXISTS project_resources_project_idx
-  ON project_resources(project_id, environment, resource_type);
-
-CREATE INDEX IF NOT EXISTS project_resources_provider_user_idx
-  ON project_resources(provider_user_id, provider);
-
--- provider credentials belong to an authenticated IndraQ user and are
--- reusable across every project that user can access. Project resources keep
--- only infrastructure associations plus the user whose provider profile last
--- reconciled the resource.
+CREATE TABLE IF NOT EXISTS user_integrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  encrypted_secret text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(user_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS user_integrations_user_idx
+  ON user_integrations(user_id, provider);
+
+CREATE TABLE IF NOT EXISTS project_resources (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  environment text NOT NULL DEFAULT 'dev',
+  resource_type text NOT NULL,
+  provider text NOT NULL,
+  provider_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  external_id text,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_by uuid REFERENCES users(id),
+  updated_by uuid REFERENCES users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(project_id, environment, resource_type)
+);
+
+CREATE INDEX IF NOT EXISTS project_resources_project_idx
+  ON project_resources(project_id, environment, resource_type);
+
+CREATE INDEX IF NOT EXISTS project_resources_provider_user_idx
+  ON project_resources(provider_user_id, provider);
+
+-- provider credentials belong to an authenticated IndraQ user and are
+-- reusable across every project that user can access. Project resources keep
+-- only infrastructure associations plus the user whose provider profile last
+-- reconciled the resource.

package/cloud-api/sql/003_environment_infrastructure.sql

@@ -1,19 +1,19 @@
--- shared admin-managed named environments.
--- Environments are generic reusable targets. PRIMARY/SECONDARY is assigned only
--- when a project creates a FAILOVER Route53 record.
-CREATE TABLE IF NOT EXISTS environments (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  name text NOT NULL UNIQUE,
-  description text,
-  ipv4 inet NOT NULL,
-  region text,
-  health_path text NOT NULL DEFAULT '/health',
-  created_by uuid NOT NULL REFERENCES users(id),
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS environments_name_idx ON environments(name);
-
-ALTER TABLE project_resources
-  ADD COLUMN IF NOT EXISTS environment_id uuid REFERENCES environments(id) ON DELETE SET NULL;
+-- shared admin-managed named environments.
+-- Environments are generic reusable targets. PRIMARY/SECONDARY is assigned only
+-- when a project creates a FAILOVER Route53 record.
+CREATE TABLE IF NOT EXISTS environments (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL UNIQUE,
+  description text,
+  ipv4 inet NOT NULL,
+  region text,
+  health_path text NOT NULL DEFAULT '/health',
+  created_by uuid NOT NULL REFERENCES users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS environments_name_idx ON environments(name);
+
+ALTER TABLE project_resources
+  ADD COLUMN IF NOT EXISTS environment_id uuid REFERENCES environments(id) ON DELETE SET NULL;

package/cloud-api/sql/004_managed_aws_credentials.sql

@@ -1,20 +1,20 @@
--- managed AWS IAM credentials.
--- AWS only returns SecretAccessKey when an access key is created. IndraQ stores
--- the generated secret encrypted in Cloud so the owning IndraQ user can resolve
--- it later without relying on AWS to recover it.
-CREATE TABLE IF NOT EXISTS managed_aws_credentials (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  aws_username text NOT NULL,
-  access_key_id text NOT NULL,
-  encrypted_secret_access_key text NOT NULL,
-  indraq_role text NOT NULL CHECK (indraq_role IN ('user','manager','admin')),
-  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(cloud_user_id, aws_username),
-  UNIQUE(access_key_id)
-);
-
-CREATE INDEX IF NOT EXISTS managed_aws_credentials_user_idx
-  ON managed_aws_credentials(cloud_user_id, aws_username);
+-- managed AWS IAM credentials.
+-- AWS only returns SecretAccessKey when an access key is created. IndraQ stores
+-- the generated secret encrypted in Cloud so the owning IndraQ user can resolve
+-- it later without relying on AWS to recover it.
+CREATE TABLE IF NOT EXISTS managed_aws_credentials (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  aws_username text NOT NULL,
+  access_key_id text NOT NULL,
+  encrypted_secret_access_key text NOT NULL,
+  indraq_role text NOT NULL CHECK (indraq_role IN ('user','manager','admin')),
+  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(cloud_user_id, aws_username),
+  UNIQUE(access_key_id)
+);
+
+CREATE INDEX IF NOT EXISTS managed_aws_credentials_user_idx
+  ON managed_aws_credentials(cloud_user_id, aws_username);

package/cloud-api/sql/005_project_members_and_resource_grants.sql

@@ -1,22 +1,22 @@
--- Project membership and per-resource access grants.
--- Project membership lets a user work with a project; resource grants control
--- which provider resources a normal user can read/update. Managers/admins can
--- manage membership and grants with audited reasons.
-ALTER TABLE project_members
-  ADD COLUMN IF NOT EXISTS added_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  ADD COLUMN IF NOT EXISTS added_at timestamptz NOT NULL DEFAULT now();
-
-CREATE TABLE IF NOT EXISTS project_resource_grants (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  project_resource_id uuid NOT NULL REFERENCES project_resources(id) ON DELETE CASCADE,
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  permission text NOT NULL DEFAULT 'manage' CHECK (permission IN ('view','manage')),
-  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(project_resource_id, user_id)
-);
-
-CREATE INDEX IF NOT EXISTS project_resource_grants_user_idx
-  ON project_resource_grants(user_id, project_resource_id);
-CREATE INDEX IF NOT EXISTS project_resource_grants_resource_idx
-  ON project_resource_grants(project_resource_id, user_id);
+-- Project membership and per-resource access grants.
+-- Project membership lets a user work with a project; resource grants control
+-- which provider resources a normal user can read/update. Managers/admins can
+-- manage membership and grants with audited reasons.
+ALTER TABLE project_members
+  ADD COLUMN IF NOT EXISTS added_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  ADD COLUMN IF NOT EXISTS added_at timestamptz NOT NULL DEFAULT now();
+
+CREATE TABLE IF NOT EXISTS project_resource_grants (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_resource_id uuid NOT NULL REFERENCES project_resources(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  permission text NOT NULL DEFAULT 'manage' CHECK (permission IN ('view','manage')),
+  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(project_resource_id, user_id)
+);
+
+CREATE INDEX IF NOT EXISTS project_resource_grants_user_idx
+  ON project_resource_grants(user_id, project_resource_id);
+CREATE INDEX IF NOT EXISTS project_resource_grants_resource_idx
+  ON project_resource_grants(project_resource_id, user_id);