indraq_cli 2.1.0 → 2.2.1

package/cloud-api/dist/index.js

@@ -106,28 +106,31 @@ const listQuery = (req, defaultLimit = 10, maximum = 5000) => {
     const limit = all ? maximum : Math.max(1, Math.min(maximum, Number.isInteger(parsed) ? parsed : defaultLimit));
     return { search, limit, all };
 };
-const projectAccessLevel = async (projectIdRaw, user) => {
+const projectAccessLevel = async (projectIdRaw, user, includeArchived = false) => {
     const projectId = ensureUuid(projectIdRaw, 'Project ID');
-    const result = await pool.query(`SELECT p.id,p.created_by,pm.role,pm.access_level
+    const result = await pool.query(`SELECT p.id,p.created_by,p.archived_at,pm.role,pm.access_level
        FROM projects p
        LEFT JOIN project_members pm ON pm.project_id=p.id AND pm.user_id=$2
       WHERE p.id=$1
       LIMIT 1`, [projectId, user.id]);
     if (!result.rowCount)
         return null;
-    if (user.role === 'admin' || user.role === 'manager')
-        return 'write';
     const row = result.rows[0];
+    if (row.archived_at && !includeArchived)
+        return null;
+    if (user.role === 'admin')
+        return 'write';
     if (row.created_by === user.id || row.role === 'owner' || row.access_level === 'write')
         return 'write';
-    // Every authenticated organization user can discover/read every project.
-    return 'view';
+    if (row.role || row.access_level === 'view')
+        return 'view';
+    return null;
 };
 const hasProjectAccess = async (projectId, user) => (await projectAccessLevel(projectId, user)) !== null;
 const hasProjectWriteAccess = async (projectId, user) => (await projectAccessLevel(projectId, user)) === 'write';
 const hasProjectResourceAccess = async (resourceIdRaw, user, manage = false) => {
     const resourceId = ensureUuid(resourceIdRaw, 'Project resource ID');
-    if (user.role === 'admin' || user.role === 'manager')
+    if (user.role === 'admin')
         return true;
     const resource = await pool.query('SELECT project_id,created_by FROM project_resources WHERE id=$1', [resourceId]);
     if (!resource.rowCount)
@@ -871,10 +874,10 @@ app.post('/me/aws-credentials/:awsUsername/resolve', auth, async (req, res) => {
 });
 app.get('/projects', auth, async (req, res) => {
     const { search, limit } = listQuery(req);
-    const privileged = req.auth.role === 'manager' || req.auth.role === 'admin';
+    const archivedMode = req.query.archived === 'only' ? 'only' : req.query.archived === 'all' ? 'all' : 'active';
     const result = await pool.query(`SELECT p.*,u.email AS creator_email,
       CASE
-        WHEN $3::boolean THEN 'write'
+        WHEN $3='admin' THEN 'write'
         WHEN p.created_by=$1 THEN 'write'
         WHEN pm.role='owner' OR pm.access_level='write' THEN 'write'
         ELSE 'view'
@@ -882,9 +885,11 @@ app.get('/projects', auth, async (req, res) => {
      FROM projects p
      JOIN users u ON u.id=p.created_by
      LEFT JOIN project_members pm ON pm.project_id=p.id AND pm.user_id=$1
-     WHERE ($2='' OR p.name ILIKE '%'||$2||'%' OR p.kind ILIKE '%'||$2||'%' OR u.email ILIKE '%'||$2||'%')
+     WHERE ($3='admin' OR p.created_by=$1 OR pm.user_id=$1)
+       AND ($2='' OR p.name ILIKE '%'||$2||'%' OR p.kind ILIKE '%'||$2||'%' OR u.email ILIKE '%'||$2||'%')
+       AND ($4='all' OR ($4='only' AND p.archived_at IS NOT NULL) OR ($4='active' AND p.archived_at IS NULL))
      ORDER BY p.created_at DESC
-     LIMIT $4`, [req.auth.id, search, privileged, limit]);
+     LIMIT $5`, [req.auth.id, search, req.auth.role, archivedMode, limit]);
     res.json(result.rows);
 });
 app.post('/projects', auth, async (req, res) => {
@@ -927,6 +932,10 @@ app.patch('/projects/:id', ...allow('manager', 'admin'), async (req, res) => {
     if (!reason)
         return;
     const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+    if (!(await hasProjectWriteAccess(id, req.auth))) {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     if (typeof req.body?.name === 'string' && req.body.name.trim()) {
         const duplicate = await pool.query('SELECT id FROM projects WHERE lower(name)=lower($1) AND id<>$2 LIMIT 1', [req.body.name.trim(), id]);
         if (duplicate.rowCount) {
@@ -946,7 +955,11 @@ app.delete('/projects/:id', ...allow('manager', 'admin'), async (req, res) => {
     const reason = requireReason(req, res);
     if (!reason)
         return;
-    const id = routeParam(req.params.id);
+    const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+    if ((await projectAccessLevel(id, req.auth, true)) !== 'write') {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     const result = await pool.query('DELETE FROM projects WHERE id=$1 RETURNING id,name', [id]);
     if (!result.rowCount) {
         res.status(404).json({ error: 'Project not found' });
@@ -955,8 +968,46 @@ app.delete('/projects/:id', ...allow('manager', 'admin'), async (req, res) => {
     await audit(req.auth.id, 'project.delete', 'project', id, reason, { name: result.rows[0].name });
     res.status(204).end();
 });
+app.post('/projects/:id/archive', ...allow('manager', 'admin'), async (req, res) => {
+    const reason = requireReason(req, res);
+    if (!reason)
+        return;
+    const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+    if ((await projectAccessLevel(id, req.auth, true)) !== 'write') {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
+    const result = await pool.query('UPDATE projects SET archived_at=COALESCE(archived_at,now()),archived_by=COALESCE(archived_by,$2),updated_at=now() WHERE id=$1 RETURNING id,name,archived_at,archived_by', [id, req.auth.id]);
+    if (!result.rowCount) {
+        res.status(404).json({ error: 'Project not found' });
+        return;
+    }
+    await audit(req.auth.id, 'project.archive', 'project', id, reason, { name: result.rows[0].name });
+    res.json(result.rows[0]);
+});
+app.post('/projects/:id/restore', ...allow('manager', 'admin'), async (req, res) => {
+    const reason = requireReason(req, res);
+    if (!reason)
+        return;
+    const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+    if ((await projectAccessLevel(id, req.auth, true)) !== 'write') {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
+    const result = await pool.query('UPDATE projects SET archived_at=NULL,archived_by=NULL,updated_at=now() WHERE id=$1 RETURNING id,name,archived_at,archived_by', [id]);
+    if (!result.rowCount) {
+        res.status(404).json({ error: 'Project not found' });
+        return;
+    }
+    await audit(req.auth.id, 'project.restore', 'project', id, reason, { name: result.rows[0].name });
+    res.json(result.rows[0]);
+});
 app.get('/projects/:id/members', ...allow('manager', 'admin'), async (req, res) => {
-    const id = routeParam(req.params.id);
+    const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+    if (!(await hasProjectWriteAccess(id, req.auth))) {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     const result = await pool.query(`SELECT pm.project_id,pm.user_id,pm.role,pm.access_level,pm.added_at,u.email,u.name,u.role AS user_role
       FROM project_members pm JOIN users u ON u.id=pm.user_id
       WHERE pm.project_id=$1 AND u.is_active=true ORDER BY u.email`, [id]);
@@ -966,7 +1017,11 @@ app.post('/projects/:id/members', ...allow('manager', 'admin'), async (req, res)
     const reason = requireReason(req, res);
     if (!reason)
         return;
-    const id = routeParam(req.params.id);
+    const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+    if (!(await hasProjectWriteAccess(id, req.auth))) {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     const userId = String(req.body?.userId || '');
     const project = await pool.query('SELECT id FROM projects WHERE id=$1', [id]);
     if (!project.rowCount) {
@@ -1002,7 +1057,11 @@ app.delete('/projects/:id/members/:userId', ...allow('manager', 'admin'), async
     const reason = requireReason(req, res);
     if (!reason)
         return;
-    const id = routeParam(req.params.id);
+    const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+    if (!(await hasProjectWriteAccess(id, req.auth))) {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     const userId = routeParam(req.params.userId);
     const target = await pool.query('SELECT email,role FROM users WHERE id=$1', [userId]);
     if (req.auth.role === 'manager' && target.rows[0]?.role && target.rows[0].role !== 'user') {
@@ -1235,6 +1294,10 @@ app.post('/scopes/:id/resolve', auth, async (req, res) => {
         res.status(404).json({ error: 'Scope not found or access denied' });
         return;
     }
+    if (access === 'use') {
+        res.status(403).json({ error: 'MANAGE access is required to resolve the provider management credential.' });
+        return;
+    }
     const result = await pool.query('SELECT id,provider,name,description,company,config,encrypted_secret FROM provider_scopes WHERE id=$1 AND is_active=true', [id]);
     if (!result.rowCount) {
         res.status(404).json({ error: 'Scope not found' });
@@ -1333,6 +1396,15 @@ app.get('/scopes/:id/audit', auth, async (req, res) => {
       ORDER BY a.created_at DESC LIMIT $2`, [id, limit]);
     res.json(result.rows);
 });
+app.get('/me/scopes', auth, async (req, res) => {
+    const result = await pool.query(`SELECT ps.id,ps.provider,ps.name,ps.description,ps.company,ps.config,(ps.encrypted_secret IS NOT NULL) has_secret,
+            CASE WHEN $2='admin' THEN 'manage' ELSE psm.access END AS access
+       FROM provider_scopes ps
+       LEFT JOIN provider_scope_members psm ON psm.scope_id=ps.id AND psm.user_id=$1
+      WHERE ps.is_active=true AND ($2='admin' OR psm.user_id=$1)
+      ORDER BY ps.provider,lower(ps.name)`, [req.auth.id, req.auth.role]);
+    res.json(result.rows);
+});
 app.get('/me/scope-defaults', auth, async (req, res) => {
     const result = await pool.query(`SELECT usd.provider,usd.scope_id,ps.name,ps.company,ps.config,ps.updated_at
        FROM user_scope_defaults usd JOIN provider_scopes ps ON ps.id=usd.scope_id
@@ -1399,20 +1471,48 @@ app.post('/me/scopes/:provider/resolve', auth, async (req, res) => {
         const visible = req.auth.role === 'admin'
             ? await pool.query('SELECT id FROM provider_scopes WHERE provider=$1 AND is_active=true ORDER BY created_at', [provider])
             : await pool.query('SELECT ps.id FROM provider_scopes ps JOIN provider_scope_members psm ON psm.scope_id=ps.id WHERE psm.user_id=$1 AND ps.provider=$2 AND ps.is_active=true ORDER BY ps.created_at', [req.auth.id, provider]);
-        if (visible.rowCount === 1)
+        if (visible.rows.length === 1)
             scopeId = visible.rows[0].id;
-        else if (visible.rowCount > 1) {
+        else if (visible.rows.length > 1) {
             res.status(409).json({ error: `Multiple ${provider} scopes are available. Link one to the project environment or set your default with \`indraq scope default\`.` });
             return;
         }
     }
-    if (!scopeId || !(await scopeVisible(scopeId, req.auth))) {
+    const access = scopeId ? await scopeAccessFor(scopeId, req.auth) : null;
+    if (!scopeId || !access) {
         res.status(404).json({ error: `No ${provider} scope is assigned to your account.` });
         return;
     }
     const row = (await pool.query('SELECT id,provider,name,description,company,config,encrypted_secret FROM provider_scopes WHERE id=$1 AND is_active=true', [scopeId])).rows[0];
-    await audit(req.auth.id, 'scope.secret.resolve', 'provider-scope', scopeId, reason, { provider, projectId: projectId || null, environment: environment || null });
-    res.json({ id: row.id, provider: row.provider, name: row.name, description: row.description, company: row.company, config: row.config || {}, secret: row.encrypted_secret ? JSON.parse(decrypt(row.encrypted_secret)) : null });
+    let secret = null;
+    let credentialSource = 'scope-management';
+    if (req.auth.role !== 'admin' && provider === 'aws') {
+        const own = await pool.query('SELECT access_key_id,encrypted_secret_access_key FROM scope_aws_credentials WHERE scope_id=$1 AND cloud_user_id=$2', [scopeId, req.auth.id]);
+        if (!own.rowCount) {
+            res.status(404).json({ error: 'No AWS credential is provisioned for you in this scope.' });
+            return;
+        }
+        secret = { accessKeyId: own.rows[0].access_key_id, secretAccessKey: decrypt(own.rows[0].encrypted_secret_access_key) };
+        credentialSource = 'user-native';
+    }
+    else if (req.auth.role !== 'admin' && ['npm', 'jenkins-dev', 'jenkins-prod'].includes(provider)) {
+        const own = await pool.query('SELECT external_username,encrypted_secret FROM scope_external_accounts WHERE scope_id=$1 AND cloud_user_id=$2', [scopeId, req.auth.id]);
+        if (!own.rowCount || !own.rows[0].encrypted_secret) {
+            res.status(404).json({ error: `No ${provider} credential is provisioned for you in this scope. Rotate your provider password or ask a scope manager to reprovision you.` });
+            return;
+        }
+        secret = provider === 'npm'
+            ? { identity: own.rows[0].external_username, secret: decrypt(own.rows[0].encrypted_secret) }
+            : { username: own.rows[0].external_username, secret: decrypt(own.rows[0].encrypted_secret) };
+        credentialSource = 'user-native';
+    }
+    else {
+        secret = row.encrypted_secret ? JSON.parse(decrypt(row.encrypted_secret)) : null;
+    }
+    await audit(req.auth.id, 'scope.credential.resolve', 'provider-scope', scopeId, reason, { provider, projectId: projectId || null, environment: environment || null, credentialSource });
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Pragma', 'no-cache');
+    res.json({ id: row.id, provider: row.provider, name: row.name, description: row.description, company: row.company, config: row.config || {}, secret, access: access === 'admin' ? 'manage' : access });
 });
 app.get('/projects/:projectId/environment-scopes', auth, async (req, res) => {
     const projectId = ensureUuid(routeParam(req.params.projectId), 'Project ID');
@@ -1558,10 +1658,11 @@ app.put('/scopes/:scopeId/users/:userId/external-account', ...allow('manager', '
         return;
     }
     const externalEmail = req.body?.externalEmail ? String(req.body.externalEmail).trim() : null;
-    const result = await pool.query(`INSERT INTO scope_external_accounts(scope_id,cloud_user_id,provider,external_username,external_email,managed_by_user_id,config)
-     VALUES($1,$2,$3,$4,$5,$6,$7)
-     ON CONFLICT(scope_id,cloud_user_id) DO UPDATE SET external_username=excluded.external_username,external_email=excluded.external_email,managed_by_user_id=excluded.managed_by_user_id,config=excluded.config,updated_at=now()
-     RETURNING id,scope_id,cloud_user_id,provider,external_username,external_email,config,updated_at`, [scopeId, userId, scope.rows[0].provider, externalUsername, externalEmail, req.auth.id, req.body?.config || {}]);
+    const encryptedSecret = req.body?.secret ? encrypt(String(req.body.secret)) : null;
+    const result = await pool.query(`INSERT INTO scope_external_accounts(scope_id,cloud_user_id,provider,external_username,external_email,managed_by_user_id,config,encrypted_secret)
+     VALUES($1,$2,$3,$4,$5,$6,$7,$8)
+     ON CONFLICT(scope_id,cloud_user_id) DO UPDATE SET external_username=excluded.external_username,external_email=excluded.external_email,managed_by_user_id=excluded.managed_by_user_id,config=excluded.config,encrypted_secret=COALESCE(excluded.encrypted_secret,scope_external_accounts.encrypted_secret),updated_at=now()
+     RETURNING id,scope_id,cloud_user_id,provider,external_username,external_email,config,updated_at`, [scopeId, userId, scope.rows[0].provider, externalUsername, externalEmail, req.auth.id, req.body?.config || {}, encryptedSecret]);
     await audit(req.auth.id, 'scope.native-account.upsert', 'provider-scope', scopeId, reason, { userId, provider: scope.rows[0].provider, externalUsername, externalEmail });
     res.json(result.rows[0]);
 });
@@ -1699,6 +1800,128 @@ app.post('/me/scopes/:scopeId/aws-credential/resolve', auth, async (req, res) =>
     await audit(req.auth.id, 'scope.aws-credential.resolve', 'provider-scope', scopeId, reason, { awsUsername: row.aws_username, accessKeyId: row.access_key_id });
     res.json({ awsUsername: row.aws_username, accessKeyId: row.access_key_id, secretAccessKey: decrypt(row.encrypted_secret_access_key), indraqRole: row.indraq_role });
 });
+app.post('/me/scopes/:scopeId/aws-credential/rotate', auth, async (req, res) => {
+    const reason = requireReason(req, res);
+    if (!reason)
+        return;
+    const scopeId = ensureUuid(routeParam(req.params.scopeId), 'Scope ID');
+    if (!(await scopeVisible(scopeId, req.auth))) {
+        res.status(403).json({ error: 'Scope access denied.' });
+        return;
+    }
+    const own = await pool.query('SELECT aws_username,access_key_id,encrypted_secret_access_key FROM scope_aws_credentials WHERE scope_id=$1 AND cloud_user_id=$2', [scopeId, req.auth.id]);
+    if (!own.rowCount) {
+        res.status(404).json({ error: 'No AWS credential is stored for you in this scope.' });
+        return;
+    }
+    const scope = await pool.query('SELECT config,encrypted_secret FROM provider_scopes WHERE id=$1 AND provider=\'aws\' AND is_active=true', [scopeId]);
+    if (!scope.rowCount || !scope.rows[0].encrypted_secret) {
+        res.status(409).json({ error: 'AWS scope management credential is unavailable.' });
+        return;
+    }
+    const management = JSON.parse(decrypt(scope.rows[0].encrypted_secret));
+    const region = String(scope.rows[0].config?.region || 'us-east-1');
+    const iam = new IAMClient({ region, credentials: { accessKeyId: management.accessKeyId, secretAccessKey: management.secretAccessKey, ...(management.sessionToken ? { sessionToken: management.sessionToken } : {}) } });
+    const created = await iam.send(new CreateAccessKeyCommand({ UserName: own.rows[0].aws_username }));
+    const next = created.AccessKey;
+    if (!next?.AccessKeyId || !next.SecretAccessKey) {
+        res.status(502).json({ error: 'AWS did not return a replacement access key.' });
+        return;
+    }
+    try {
+        await pool.query('UPDATE scope_aws_credentials SET access_key_id=$1,encrypted_secret_access_key=$2,updated_at=now() WHERE scope_id=$3 AND cloud_user_id=$4', [next.AccessKeyId, encrypt(next.SecretAccessKey), scopeId, req.auth.id]);
+        await iam.send(new DeleteAccessKeyCommand({ UserName: own.rows[0].aws_username, AccessKeyId: own.rows[0].access_key_id }));
+    }
+    catch (error) {
+        try {
+            await iam.send(new DeleteAccessKeyCommand({ UserName: own.rows[0].aws_username, AccessKeyId: next.AccessKeyId }));
+        }
+        catch { /* best effort */ }
+        throw error;
+    }
+    await audit(req.auth.id, 'scope.aws-credential.self-rotate', 'provider-scope', scopeId, reason, { awsUsername: own.rows[0].aws_username, previousAccessKeyId: own.rows[0].access_key_id, accessKeyId: next.AccessKeyId });
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Pragma', 'no-cache');
+    res.json({ awsUsername: own.rows[0].aws_username, accessKeyId: next.AccessKeyId, secretAccessKey: next.SecretAccessKey });
+});
+app.post('/me/scopes/:scopeId/external-account/rotate', auth, async (req, res) => {
+    const reason = requireReason(req, res);
+    if (!reason)
+        return;
+    const scopeId = ensureUuid(routeParam(req.params.scopeId), 'Scope ID');
+    if (!(await scopeVisible(scopeId, req.auth))) {
+        res.status(403).json({ error: 'Scope access denied.' });
+        return;
+    }
+    const password = String(req.body?.password || '');
+    if (password.length < 10) {
+        res.status(400).json({ error: 'Password must be at least 10 characters.' });
+        return;
+    }
+    const account = await pool.query('SELECT provider,external_username FROM scope_external_accounts WHERE scope_id=$1 AND cloud_user_id=$2', [scopeId, req.auth.id]);
+    if (!account.rowCount) {
+        res.status(404).json({ error: 'No NPM/Jenkins account is stored for you in this scope.' });
+        return;
+    }
+    const scope = await pool.query('SELECT provider,config,encrypted_secret FROM provider_scopes WHERE id=$1 AND is_active=true', [scopeId]);
+    if (!scope.rowCount || !scope.rows[0].encrypted_secret) {
+        res.status(409).json({ error: 'Provider management credential is unavailable.' });
+        return;
+    }
+    const provider = String(account.rows[0].provider);
+    const management = JSON.parse(decrypt(scope.rows[0].encrypted_secret));
+    const username = String(account.rows[0].external_username);
+    if (provider === 'npm') {
+        const base = String(scope.rows[0].config?.url || '').replace(/\/+$/, '');
+        const tokenResponse = await fetch(`${base}/api/tokens`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ identity: management.identity, secret: management.secret }) });
+        if (!tokenResponse.ok) {
+            res.status(502).json({ error: `NPM management authentication failed (HTTP ${tokenResponse.status}).` });
+            return;
+        }
+        const token = (await tokenResponse.json()).token;
+        if (!token) {
+            res.status(502).json({ error: 'NPM did not return a management token.' });
+            return;
+        }
+        const headers = { authorization: `Bearer ${token}`, 'content-type': 'application/json' };
+        const usersResponse = await fetch(`${base}/api/users?expand=permissions`, { headers });
+        if (!usersResponse.ok) {
+            res.status(502).json({ error: `Unable to list NPM users (HTTP ${usersResponse.status}).` });
+            return;
+        }
+        const users = await usersResponse.json();
+        const wanted = username.toLowerCase();
+        const target = users.find((u) => String(u.email || '').toLowerCase() === wanted || String(u.nickname || '').toLowerCase() === wanted || String(u.name || '').toLowerCase() === wanted);
+        if (!target) {
+            res.status(404).json({ error: `NPM user ${username} was not found.` });
+            return;
+        }
+        const update = await fetch(`${base}/api/users/${target.id}/auth`, { method: 'PUT', headers, body: JSON.stringify({ type: 'password', secret: password }) });
+        if (!update.ok) {
+            res.status(502).json({ error: `NPM password reset failed (HTTP ${update.status}).` });
+            return;
+        }
+    }
+    else if (provider === 'jenkins-dev' || provider === 'jenkins-prod') {
+        const url = String(scope.rows[0].config?.url || '').replace(/\/+$/, '');
+        const adminUsername = String(management.username || '');
+        const adminSecret = String(management.secret || '');
+        const headers = await jenkinsRequestHeaders(url, adminUsername, adminSecret);
+        const script = `import hudson.security.HudsonPrivateSecurityRealm\ndef user = hudson.model.User.getById(${JSON.stringify(username)}, false)\nif (user == null) throw new IllegalStateException('Jenkins user not found')\nuser.addProperty(HudsonPrivateSecurityRealm.Details.fromPlainPassword(${JSON.stringify(password)}))\nuser.save()\nprintln 'updated'`;
+        const response = await fetch(`${url}/scriptText`, { method: 'POST', headers: { ...headers, 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ script }).toString() });
+        if (!response.ok) {
+            res.status(502).json({ error: `Jenkins password reset failed (HTTP ${response.status}).` });
+            return;
+        }
+    }
+    else {
+        res.status(400).json({ error: 'Scope must be NPM or Jenkins.' });
+        return;
+    }
+    await pool.query('UPDATE scope_external_accounts SET encrypted_secret=$1,updated_at=now() WHERE scope_id=$2 AND cloud_user_id=$3', [encrypt(password), scopeId, req.auth.id]);
+    await audit(req.auth.id, 'scope.external-account.self-rotate', 'provider-scope', scopeId, reason, { provider, username });
+    res.status(204).end();
+});
 // Reusable provider credentials are scoped to the authenticated IndraQ user.
 // A user configures AWS/NPM/Jenkins/GHCR once and can reuse that profile across
 // every project they are allowed to access. Secrets are encrypted at rest and
@@ -1969,17 +2192,25 @@ app.get('/users/:id/resource-grants', ...allow('manager', 'admin'), async (req,
         res.status(403).json({ error: 'Managers may inspect grants only for normal users.' });
         return;
     }
+    const managerFilter = req.auth.role === 'manager'
+        ? ` AND (p.created_by=$2 OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id=p.id AND pm.user_id=$2 AND (pm.role='owner' OR pm.access_level='write')))`
+        : '';
+    const params = req.auth.role === 'manager' ? [userId, req.auth.id] : [userId];
     const result = await pool.query(`SELECT g.id,g.project_resource_id,g.user_id,g.permission,g.created_at,
       pr.project_id,p.name AS project_name,pr.resource_type,pr.provider,pr.environment,pr.external_id,pr.config
       FROM project_resource_grants g
       JOIN project_resources pr ON pr.id=g.project_resource_id
       JOIN projects p ON p.id=pr.project_id
-      WHERE g.user_id=$1
-      ORDER BY p.name,pr.provider,pr.resource_type`, [userId]);
+      WHERE g.user_id=$1 AND p.archived_at IS NULL${managerFilter}
+      ORDER BY p.name,pr.provider,pr.resource_type`, params);
     res.json(result.rows);
 });
 app.get('/projects/:projectId/resource-grants', ...allow('manager', 'admin'), async (req, res) => {
     const projectId = routeParam(req.params.projectId);
+    if (!(await hasProjectWriteAccess(projectId, req.auth))) {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     const userId = typeof req.query.userId === 'string' ? req.query.userId : undefined;
     const result = await pool.query(`SELECT g.id,g.project_resource_id,g.user_id,g.permission,g.created_at,
       u.email,u.name,pr.resource_type,pr.provider,pr.environment,pr.external_id,pr.config
@@ -1995,6 +2226,10 @@ app.post('/projects/:projectId/resources/:resourceId/grants', ...allow('manager'
     if (!reason)
         return;
     const projectId = routeParam(req.params.projectId);
+    if (!(await hasProjectWriteAccess(projectId, req.auth))) {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     const resourceId = routeParam(req.params.resourceId);
     const userId = String(req.body?.userId || '');
     const permission = req.body?.permission === 'view' ? 'view' : 'manage';
@@ -2023,6 +2258,10 @@ app.delete('/projects/:projectId/resources/:resourceId/grants/:userId', ...allow
     if (!reason)
         return;
     const projectId = routeParam(req.params.projectId);
+    if (!(await hasProjectWriteAccess(projectId, req.auth))) {
+        res.status(403).json({ error: 'WRITE access to the project is required.' });
+        return;
+    }
     const resourceId = routeParam(req.params.resourceId);
     const userId = routeParam(req.params.userId);
     const target = await pool.query('SELECT email,role FROM users WHERE id=$1', [userId]);
@@ -2155,4 +2394,3 @@ const bootstrap = async () => {
 await runMigrations();
 await bootstrap();
 app.listen(Number(process.env.PORT || 4010), () => console.log(`IndraQ Cloud API listening on ${process.env.PORT || 4010}`));
-//# sourceMappingURL=index.js.map

package/cloud-api/node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@indraq/cloud-api",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/cloud-api/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@indraq/cloud-api",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@indraq/cloud-api",
-      "version": "0.6.0",
+      "version": "0.7.0",
       "dependencies": {
         "@aws-sdk/client-iam": "^3.1123.0",
         "bcryptjs": "^3.0.2",

package/cloud-api/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@indraq/cloud-api",
   "private": true,
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "scripts": {
     "dev": "tsx watch src/index.ts",

package/cloud-api/sql/001_init.sql

@@ -1,8 +1,8 @@
-CREATE EXTENSION IF NOT EXISTS pgcrypto;
-CREATE TABLE IF NOT EXISTS users (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), email text UNIQUE NOT NULL, name text NOT NULL, password_hash text NOT NULL, role text NOT NULL CHECK (role IN ('user','manager','admin')), is_active boolean NOT NULL DEFAULT true, created_by uuid REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
-CREATE TABLE IF NOT EXISTS projects (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL, kind text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
-CREATE TABLE IF NOT EXISTS project_members (project_id uuid REFERENCES projects(id) ON DELETE CASCADE, user_id uuid REFERENCES users(id) ON DELETE CASCADE, role text NOT NULL DEFAULT 'user', PRIMARY KEY(project_id,user_id));
-CREATE TABLE IF NOT EXISTS servers (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL UNIQUE, environment text NOT NULL, ipv4 inet NOT NULL, health_path text DEFAULT '/health', is_backup boolean NOT NULL DEFAULT false, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now());
-CREATE TABLE IF NOT EXISTS project_integrations (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE, provider text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, encrypted_secret text, UNIQUE(project_id,provider));
-CREATE TABLE IF NOT EXISTS audit_logs (id bigserial PRIMARY KEY, actor_id uuid REFERENCES users(id), action text NOT NULL, resource_type text NOT NULL, resource_id text, reason text, metadata jsonb NOT NULL DEFAULT '{}'::jsonb, created_at timestamptz NOT NULL DEFAULT now());
-CREATE INDEX IF NOT EXISTS audit_logs_created_at_idx ON audit_logs(created_at DESC);
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+CREATE TABLE IF NOT EXISTS users (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), email text UNIQUE NOT NULL, name text NOT NULL, password_hash text NOT NULL, role text NOT NULL CHECK (role IN ('user','manager','admin')), is_active boolean NOT NULL DEFAULT true, created_by uuid REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS projects (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL, kind text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS project_members (project_id uuid REFERENCES projects(id) ON DELETE CASCADE, user_id uuid REFERENCES users(id) ON DELETE CASCADE, role text NOT NULL DEFAULT 'user', PRIMARY KEY(project_id,user_id));
+CREATE TABLE IF NOT EXISTS servers (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), name text NOT NULL UNIQUE, environment text NOT NULL, ipv4 inet NOT NULL, health_path text DEFAULT '/health', is_backup boolean NOT NULL DEFAULT false, created_by uuid NOT NULL REFERENCES users(id), created_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS project_integrations (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE, provider text NOT NULL, config jsonb NOT NULL DEFAULT '{}'::jsonb, encrypted_secret text, UNIQUE(project_id,provider));
+CREATE TABLE IF NOT EXISTS audit_logs (id bigserial PRIMARY KEY, actor_id uuid REFERENCES users(id), action text NOT NULL, resource_type text NOT NULL, resource_id text, reason text, metadata jsonb NOT NULL DEFAULT '{}'::jsonb, created_at timestamptz NOT NULL DEFAULT now());
+CREATE INDEX IF NOT EXISTS audit_logs_created_at_idx ON audit_logs(created_at DESC);

package/cloud-api/sql/002_user_providers_and_project_resources.sql

@@ -1,40 +1,40 @@
-CREATE TABLE IF NOT EXISTS user_integrations (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  provider text NOT NULL,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  encrypted_secret text,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(user_id, provider)
-);
-
-CREATE INDEX IF NOT EXISTS user_integrations_user_idx
-  ON user_integrations(user_id, provider);
-
-CREATE TABLE IF NOT EXISTS project_resources (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
-  environment text NOT NULL DEFAULT 'dev',
-  resource_type text NOT NULL,
-  provider text NOT NULL,
-  provider_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
-  external_id text,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_by uuid REFERENCES users(id),
-  updated_by uuid REFERENCES users(id),
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(project_id, environment, resource_type)
-);
-
-CREATE INDEX IF NOT EXISTS project_resources_project_idx
-  ON project_resources(project_id, environment, resource_type);
-
-CREATE INDEX IF NOT EXISTS project_resources_provider_user_idx
-  ON project_resources(provider_user_id, provider);
-
--- provider credentials belong to an authenticated IndraQ user and are
--- reusable across every project that user can access. Project resources keep
--- only infrastructure associations plus the user whose provider profile last
--- reconciled the resource.
+CREATE TABLE IF NOT EXISTS user_integrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  encrypted_secret text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(user_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS user_integrations_user_idx
+  ON user_integrations(user_id, provider);
+
+CREATE TABLE IF NOT EXISTS project_resources (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  environment text NOT NULL DEFAULT 'dev',
+  resource_type text NOT NULL,
+  provider text NOT NULL,
+  provider_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  external_id text,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_by uuid REFERENCES users(id),
+  updated_by uuid REFERENCES users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(project_id, environment, resource_type)
+);
+
+CREATE INDEX IF NOT EXISTS project_resources_project_idx
+  ON project_resources(project_id, environment, resource_type);
+
+CREATE INDEX IF NOT EXISTS project_resources_provider_user_idx
+  ON project_resources(provider_user_id, provider);
+
+-- provider credentials belong to an authenticated IndraQ user and are
+-- reusable across every project that user can access. Project resources keep
+-- only infrastructure associations plus the user whose provider profile last
+-- reconciled the resource.

package/cloud-api/sql/003_environment_infrastructure.sql

@@ -1,19 +1,19 @@
--- shared admin-managed named environments.
--- Environments are generic reusable targets. PRIMARY/SECONDARY is assigned only
--- when a project creates a FAILOVER Route53 record.
-CREATE TABLE IF NOT EXISTS environments (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  name text NOT NULL UNIQUE,
-  description text,
-  ipv4 inet NOT NULL,
-  region text,
-  health_path text NOT NULL DEFAULT '/health',
-  created_by uuid NOT NULL REFERENCES users(id),
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS environments_name_idx ON environments(name);
-
-ALTER TABLE project_resources
-  ADD COLUMN IF NOT EXISTS environment_id uuid REFERENCES environments(id) ON DELETE SET NULL;
+-- shared admin-managed named environments.
+-- Environments are generic reusable targets. PRIMARY/SECONDARY is assigned only
+-- when a project creates a FAILOVER Route53 record.
+CREATE TABLE IF NOT EXISTS environments (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL UNIQUE,
+  description text,
+  ipv4 inet NOT NULL,
+  region text,
+  health_path text NOT NULL DEFAULT '/health',
+  created_by uuid NOT NULL REFERENCES users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS environments_name_idx ON environments(name);
+
+ALTER TABLE project_resources
+  ADD COLUMN IF NOT EXISTS environment_id uuid REFERENCES environments(id) ON DELETE SET NULL;