indraq_cli 1.9.1 → 2.0.0

package/cloud-api/sql/006_catalog_identity_password_security.sql

@@ -1,96 +1,96 @@
--- Organization-wide catalog constraints, project access levels, first-login
--- password changes, self-service OTP resets, and managed external identities.
-
-ALTER TABLE users
-  ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false,
-  ADD COLUMN IF NOT EXISTS password_changed_at timestamptz,
-  ADD COLUMN IF NOT EXISTS last_login_at timestamptz;
-
-ALTER TABLE project_members
-  ADD COLUMN IF NOT EXISTS access_level text NOT NULL DEFAULT 'write';
-
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_constraint WHERE conname = 'project_members_access_level_check'
-  ) THEN
-    ALTER TABLE project_members
-      ADD CONSTRAINT project_members_access_level_check
-      CHECK (access_level IN ('view','write'));
-  END IF;
-END $$;
-
-UPDATE project_members SET access_level='write' WHERE role='owner';
-
--- Resolve historical duplicate project names before enforcing organization-wide
--- case-insensitive uniqueness. The oldest row keeps the original display name.
-WITH ranked AS (
-  SELECT id, name,
-         row_number() OVER (PARTITION BY lower(name) ORDER BY created_at, id) AS rn
-  FROM projects
-)
-UPDATE projects p
-SET name = p.name || '-legacy-' || left(p.id::text, 8), updated_at=now()
-FROM ranked r
-WHERE p.id=r.id AND r.rn > 1;
-
-CREATE UNIQUE INDEX IF NOT EXISTS projects_name_lower_unique_idx
-  ON projects (lower(name));
-
--- GHCR image names are organization-wide claims. Resolve historical duplicate
--- DB claims before adding the unique index; this does not mutate any registry.
-WITH ranked AS (
-  SELECT id,
-         row_number() OVER (
-           PARTITION BY lower(config->>'fullImage')
-           ORDER BY created_at, id
-         ) AS rn
-  FROM project_resources
-  WHERE provider='ghcr'
-    AND config ? 'fullImage'
-    AND coalesce(config->>'fullImage','') <> ''
-)
-UPDATE project_resources pr
-SET config = jsonb_set(
-      jsonb_set(pr.config, '{fullImage}', to_jsonb((pr.config->>'fullImage') || '-legacy-' || left(pr.id::text,8)), true),
-      '{imageName}', to_jsonb(coalesce(pr.config->>'imageName','image') || '-legacy-' || left(pr.id::text,8)), true
-    ),
-    updated_at=now()
-FROM ranked r
-WHERE pr.id=r.id AND r.rn > 1;
-
-CREATE UNIQUE INDEX IF NOT EXISTS project_resources_ghcr_full_image_unique_idx
-  ON project_resources ((lower(config->>'fullImage')))
-  WHERE provider='ghcr'
-    AND config ? 'fullImage'
-    AND coalesce(config->>'fullImage','') <> '';
-
-CREATE TABLE IF NOT EXISTS managed_external_accounts (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  provider text NOT NULL CHECK (provider IN ('npm','jenkins-dev','jenkins-prod')),
-  external_username text NOT NULL,
-  external_email text,
-  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(cloud_user_id, provider)
-);
-
-CREATE INDEX IF NOT EXISTS managed_external_accounts_manager_idx
-  ON managed_external_accounts(managed_by_user_id, provider);
-
-CREATE TABLE IF NOT EXISTS password_reset_otps (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  otp_hash text NOT NULL,
-  expires_at timestamptz NOT NULL,
-  attempts integer NOT NULL DEFAULT 0,
-  max_attempts integer NOT NULL DEFAULT 5,
-  used_at timestamptz,
-  created_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS password_reset_otps_user_idx
-  ON password_reset_otps(user_id, created_at DESC);
+-- Organization-wide catalog constraints, project access levels, first-login
+-- password changes, self-service OTP resets, and managed external identities.
+
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS password_changed_at timestamptz,
+  ADD COLUMN IF NOT EXISTS last_login_at timestamptz;
+
+ALTER TABLE project_members
+  ADD COLUMN IF NOT EXISTS access_level text NOT NULL DEFAULT 'write';
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'project_members_access_level_check'
+  ) THEN
+    ALTER TABLE project_members
+      ADD CONSTRAINT project_members_access_level_check
+      CHECK (access_level IN ('view','write'));
+  END IF;
+END $$;
+
+UPDATE project_members SET access_level='write' WHERE role='owner';
+
+-- Resolve historical duplicate project names before enforcing organization-wide
+-- case-insensitive uniqueness. The oldest row keeps the original display name.
+WITH ranked AS (
+  SELECT id, name,
+         row_number() OVER (PARTITION BY lower(name) ORDER BY created_at, id) AS rn
+  FROM projects
+)
+UPDATE projects p
+SET name = p.name || '-legacy-' || left(p.id::text, 8), updated_at=now()
+FROM ranked r
+WHERE p.id=r.id AND r.rn > 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS projects_name_lower_unique_idx
+  ON projects (lower(name));
+
+-- GHCR image names are organization-wide claims. Resolve historical duplicate
+-- DB claims before adding the unique index; this does not mutate any registry.
+WITH ranked AS (
+  SELECT id,
+         row_number() OVER (
+           PARTITION BY lower(config->>'fullImage')
+           ORDER BY created_at, id
+         ) AS rn
+  FROM project_resources
+  WHERE provider='ghcr'
+    AND config ? 'fullImage'
+    AND coalesce(config->>'fullImage','') <> ''
+)
+UPDATE project_resources pr
+SET config = jsonb_set(
+      jsonb_set(pr.config, '{fullImage}', to_jsonb((pr.config->>'fullImage') || '-legacy-' || left(pr.id::text,8)), true),
+      '{imageName}', to_jsonb(coalesce(pr.config->>'imageName','image') || '-legacy-' || left(pr.id::text,8)), true
+    ),
+    updated_at=now()
+FROM ranked r
+WHERE pr.id=r.id AND r.rn > 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS project_resources_ghcr_full_image_unique_idx
+  ON project_resources ((lower(config->>'fullImage')))
+  WHERE provider='ghcr'
+    AND config ? 'fullImage'
+    AND coalesce(config->>'fullImage','') <> '';
+
+CREATE TABLE IF NOT EXISTS managed_external_accounts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL CHECK (provider IN ('npm','jenkins-dev','jenkins-prod')),
+  external_username text NOT NULL,
+  external_email text,
+  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(cloud_user_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS managed_external_accounts_manager_idx
+  ON managed_external_accounts(managed_by_user_id, provider);
+
+CREATE TABLE IF NOT EXISTS password_reset_otps (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  otp_hash text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  attempts integer NOT NULL DEFAULT 0,
+  max_attempts integer NOT NULL DEFAULT 5,
+  used_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS password_reset_otps_user_idx
+  ON password_reset_otps(user_id, created_at DESC);

package/cloud-api/sql/007_aws_access_key_rotation.sql

@@ -1,16 +1,16 @@
--- AWS access-key rotation ownership.
--- The manager/admin provider that manages an IAM user's key is tracked so a
--- normal user can request self-service rotation without receiving broad IAM
--- permissions. Managers/admins can rotate keys for users they are allowed to
--- manage. Secret access keys remain encrypted at rest in IndraQ Cloud.
-
-ALTER TABLE managed_aws_credentials
-  ADD COLUMN IF NOT EXISTS managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL;
-
-UPDATE managed_aws_credentials
-SET managed_by_user_id = created_by
-WHERE managed_by_user_id IS NULL
-  AND created_by IS NOT NULL;
-
-CREATE INDEX IF NOT EXISTS managed_aws_credentials_manager_idx
-  ON managed_aws_credentials(managed_by_user_id, cloud_user_id);
+-- AWS access-key rotation ownership.
+-- The manager/admin provider that manages an IAM user's key is tracked so a
+-- normal user can request self-service rotation without receiving broad IAM
+-- permissions. Managers/admins can rotate keys for users they are allowed to
+-- manage. Secret access keys remain encrypted at rest in IndraQ Cloud.
+
+ALTER TABLE managed_aws_credentials
+  ADD COLUMN IF NOT EXISTS managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL;
+
+UPDATE managed_aws_credentials
+SET managed_by_user_id = created_by
+WHERE managed_by_user_id IS NULL
+  AND created_by IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS managed_aws_credentials_manager_idx
+  ON managed_aws_credentials(managed_by_user_id, cloud_user_id);