indraq_cli 2.1.0 → 2.2.1

package/cloud-api/sql/004_managed_aws_credentials.sql

@@ -1,20 +1,20 @@
--- managed AWS IAM credentials.
--- AWS only returns SecretAccessKey when an access key is created. IndraQ stores
--- the generated secret encrypted in Cloud so the owning IndraQ user can resolve
--- it later without relying on AWS to recover it.
-CREATE TABLE IF NOT EXISTS managed_aws_credentials (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  aws_username text NOT NULL,
-  access_key_id text NOT NULL,
-  encrypted_secret_access_key text NOT NULL,
-  indraq_role text NOT NULL CHECK (indraq_role IN ('user','manager','admin')),
-  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(cloud_user_id, aws_username),
-  UNIQUE(access_key_id)
-);
-
-CREATE INDEX IF NOT EXISTS managed_aws_credentials_user_idx
-  ON managed_aws_credentials(cloud_user_id, aws_username);
+-- managed AWS IAM credentials.
+-- AWS only returns SecretAccessKey when an access key is created. IndraQ stores
+-- the generated secret encrypted in Cloud so the owning IndraQ user can resolve
+-- it later without relying on AWS to recover it.
+CREATE TABLE IF NOT EXISTS managed_aws_credentials (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  aws_username text NOT NULL,
+  access_key_id text NOT NULL,
+  encrypted_secret_access_key text NOT NULL,
+  indraq_role text NOT NULL CHECK (indraq_role IN ('user','manager','admin')),
+  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(cloud_user_id, aws_username),
+  UNIQUE(access_key_id)
+);
+
+CREATE INDEX IF NOT EXISTS managed_aws_credentials_user_idx
+  ON managed_aws_credentials(cloud_user_id, aws_username);

package/cloud-api/sql/005_project_members_and_resource_grants.sql

@@ -1,22 +1,22 @@
--- Project membership and per-resource access grants.
--- Project membership lets a user work with a project; resource grants control
--- which provider resources a normal user can read/update. Managers/admins can
--- manage membership and grants with audited reasons.
-ALTER TABLE project_members
-  ADD COLUMN IF NOT EXISTS added_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  ADD COLUMN IF NOT EXISTS added_at timestamptz NOT NULL DEFAULT now();
-
-CREATE TABLE IF NOT EXISTS project_resource_grants (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  project_resource_id uuid NOT NULL REFERENCES project_resources(id) ON DELETE CASCADE,
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  permission text NOT NULL DEFAULT 'manage' CHECK (permission IN ('view','manage')),
-  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(project_resource_id, user_id)
-);
-
-CREATE INDEX IF NOT EXISTS project_resource_grants_user_idx
-  ON project_resource_grants(user_id, project_resource_id);
-CREATE INDEX IF NOT EXISTS project_resource_grants_resource_idx
-  ON project_resource_grants(project_resource_id, user_id);
+-- Project membership and per-resource access grants.
+-- Project membership lets a user work with a project; resource grants control
+-- which provider resources a normal user can read/update. Managers/admins can
+-- manage membership and grants with audited reasons.
+ALTER TABLE project_members
+  ADD COLUMN IF NOT EXISTS added_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  ADD COLUMN IF NOT EXISTS added_at timestamptz NOT NULL DEFAULT now();
+
+CREATE TABLE IF NOT EXISTS project_resource_grants (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_resource_id uuid NOT NULL REFERENCES project_resources(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  permission text NOT NULL DEFAULT 'manage' CHECK (permission IN ('view','manage')),
+  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(project_resource_id, user_id)
+);
+
+CREATE INDEX IF NOT EXISTS project_resource_grants_user_idx
+  ON project_resource_grants(user_id, project_resource_id);
+CREATE INDEX IF NOT EXISTS project_resource_grants_resource_idx
+  ON project_resource_grants(project_resource_id, user_id);

package/cloud-api/sql/006_catalog_identity_password_security.sql

@@ -1,96 +1,96 @@
--- Organization-wide catalog constraints, project access levels, first-login
--- password changes, self-service OTP resets, and managed external identities.
-
-ALTER TABLE users
-  ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false,
-  ADD COLUMN IF NOT EXISTS password_changed_at timestamptz,
-  ADD COLUMN IF NOT EXISTS last_login_at timestamptz;
-
-ALTER TABLE project_members
-  ADD COLUMN IF NOT EXISTS access_level text NOT NULL DEFAULT 'write';
-
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_constraint WHERE conname = 'project_members_access_level_check'
-  ) THEN
-    ALTER TABLE project_members
-      ADD CONSTRAINT project_members_access_level_check
-      CHECK (access_level IN ('view','write'));
-  END IF;
-END $$;
-
-UPDATE project_members SET access_level='write' WHERE role='owner';
-
--- Resolve historical duplicate project names before enforcing organization-wide
--- case-insensitive uniqueness. The oldest row keeps the original display name.
-WITH ranked AS (
-  SELECT id, name,
-         row_number() OVER (PARTITION BY lower(name) ORDER BY created_at, id) AS rn
-  FROM projects
-)
-UPDATE projects p
-SET name = p.name || '-legacy-' || left(p.id::text, 8), updated_at=now()
-FROM ranked r
-WHERE p.id=r.id AND r.rn > 1;
-
-CREATE UNIQUE INDEX IF NOT EXISTS projects_name_lower_unique_idx
-  ON projects (lower(name));
-
--- GHCR image names are organization-wide claims. Resolve historical duplicate
--- DB claims before adding the unique index; this does not mutate any registry.
-WITH ranked AS (
-  SELECT id,
-         row_number() OVER (
-           PARTITION BY lower(config->>'fullImage')
-           ORDER BY created_at, id
-         ) AS rn
-  FROM project_resources
-  WHERE provider='ghcr'
-    AND config ? 'fullImage'
-    AND coalesce(config->>'fullImage','') <> ''
-)
-UPDATE project_resources pr
-SET config = jsonb_set(
-      jsonb_set(pr.config, '{fullImage}', to_jsonb((pr.config->>'fullImage') || '-legacy-' || left(pr.id::text,8)), true),
-      '{imageName}', to_jsonb(coalesce(pr.config->>'imageName','image') || '-legacy-' || left(pr.id::text,8)), true
-    ),
-    updated_at=now()
-FROM ranked r
-WHERE pr.id=r.id AND r.rn > 1;
-
-CREATE UNIQUE INDEX IF NOT EXISTS project_resources_ghcr_full_image_unique_idx
-  ON project_resources ((lower(config->>'fullImage')))
-  WHERE provider='ghcr'
-    AND config ? 'fullImage'
-    AND coalesce(config->>'fullImage','') <> '';
-
-CREATE TABLE IF NOT EXISTS managed_external_accounts (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  provider text NOT NULL CHECK (provider IN ('npm','jenkins-dev','jenkins-prod')),
-  external_username text NOT NULL,
-  external_email text,
-  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(cloud_user_id, provider)
-);
-
-CREATE INDEX IF NOT EXISTS managed_external_accounts_manager_idx
-  ON managed_external_accounts(managed_by_user_id, provider);
-
-CREATE TABLE IF NOT EXISTS password_reset_otps (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  otp_hash text NOT NULL,
-  expires_at timestamptz NOT NULL,
-  attempts integer NOT NULL DEFAULT 0,
-  max_attempts integer NOT NULL DEFAULT 5,
-  used_at timestamptz,
-  created_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS password_reset_otps_user_idx
-  ON password_reset_otps(user_id, created_at DESC);
+-- Organization-wide catalog constraints, project access levels, first-login
+-- password changes, self-service OTP resets, and managed external identities.
+
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS password_changed_at timestamptz,
+  ADD COLUMN IF NOT EXISTS last_login_at timestamptz;
+
+ALTER TABLE project_members
+  ADD COLUMN IF NOT EXISTS access_level text NOT NULL DEFAULT 'write';
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'project_members_access_level_check'
+  ) THEN
+    ALTER TABLE project_members
+      ADD CONSTRAINT project_members_access_level_check
+      CHECK (access_level IN ('view','write'));
+  END IF;
+END $$;
+
+UPDATE project_members SET access_level='write' WHERE role='owner';
+
+-- Resolve historical duplicate project names before enforcing organization-wide
+-- case-insensitive uniqueness. The oldest row keeps the original display name.
+WITH ranked AS (
+  SELECT id, name,
+         row_number() OVER (PARTITION BY lower(name) ORDER BY created_at, id) AS rn
+  FROM projects
+)
+UPDATE projects p
+SET name = p.name || '-legacy-' || left(p.id::text, 8), updated_at=now()
+FROM ranked r
+WHERE p.id=r.id AND r.rn > 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS projects_name_lower_unique_idx
+  ON projects (lower(name));
+
+-- GHCR image names are organization-wide claims. Resolve historical duplicate
+-- DB claims before adding the unique index; this does not mutate any registry.
+WITH ranked AS (
+  SELECT id,
+         row_number() OVER (
+           PARTITION BY lower(config->>'fullImage')
+           ORDER BY created_at, id
+         ) AS rn
+  FROM project_resources
+  WHERE provider='ghcr'
+    AND config ? 'fullImage'
+    AND coalesce(config->>'fullImage','') <> ''
+)
+UPDATE project_resources pr
+SET config = jsonb_set(
+      jsonb_set(pr.config, '{fullImage}', to_jsonb((pr.config->>'fullImage') || '-legacy-' || left(pr.id::text,8)), true),
+      '{imageName}', to_jsonb(coalesce(pr.config->>'imageName','image') || '-legacy-' || left(pr.id::text,8)), true
+    ),
+    updated_at=now()
+FROM ranked r
+WHERE pr.id=r.id AND r.rn > 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS project_resources_ghcr_full_image_unique_idx
+  ON project_resources ((lower(config->>'fullImage')))
+  WHERE provider='ghcr'
+    AND config ? 'fullImage'
+    AND coalesce(config->>'fullImage','') <> '';
+
+CREATE TABLE IF NOT EXISTS managed_external_accounts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL CHECK (provider IN ('npm','jenkins-dev','jenkins-prod')),
+  external_username text NOT NULL,
+  external_email text,
+  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(cloud_user_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS managed_external_accounts_manager_idx
+  ON managed_external_accounts(managed_by_user_id, provider);
+
+CREATE TABLE IF NOT EXISTS password_reset_otps (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  otp_hash text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  attempts integer NOT NULL DEFAULT 0,
+  max_attempts integer NOT NULL DEFAULT 5,
+  used_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS password_reset_otps_user_idx
+  ON password_reset_otps(user_id, created_at DESC);

package/cloud-api/sql/007_aws_access_key_rotation.sql

@@ -1,16 +1,16 @@
--- AWS access-key rotation ownership.
--- The manager/admin provider that manages an IAM user's key is tracked so a
--- normal user can request self-service rotation without receiving broad IAM
--- permissions. Managers/admins can rotate keys for users they are allowed to
--- manage. Secret access keys remain encrypted at rest in IndraQ Cloud.
-
-ALTER TABLE managed_aws_credentials
-  ADD COLUMN IF NOT EXISTS managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL;
-
-UPDATE managed_aws_credentials
-SET managed_by_user_id = created_by
-WHERE managed_by_user_id IS NULL
-  AND created_by IS NOT NULL;
-
-CREATE INDEX IF NOT EXISTS managed_aws_credentials_manager_idx
-  ON managed_aws_credentials(managed_by_user_id, cloud_user_id);
+-- AWS access-key rotation ownership.
+-- The manager/admin provider that manages an IAM user's key is tracked so a
+-- normal user can request self-service rotation without receiving broad IAM
+-- permissions. Managers/admins can rotate keys for users they are allowed to
+-- manage. Secret access keys remain encrypted at rest in IndraQ Cloud.
+
+ALTER TABLE managed_aws_credentials
+  ADD COLUMN IF NOT EXISTS managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL;
+
+UPDATE managed_aws_credentials
+SET managed_by_user_id = created_by
+WHERE managed_by_user_id IS NULL
+  AND created_by IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS managed_aws_credentials_manager_idx
+  ON managed_aws_credentials(managed_by_user_id, cloud_user_id);

package/cloud-api/sql/008_provider_scopes.sql

@@ -1,91 +1,91 @@
--- v2.1.0 provider scopes: organization-owned provider credentials with explicit
--- membership, per-user defaults, project/environment bindings and scope-aware
--- native identity tracking.
-
-CREATE TABLE IF NOT EXISTS provider_scopes (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  provider text NOT NULL CHECK (provider IN ('aws','npm','jenkins-dev','jenkins-prod','ghcr')),
-  name text NOT NULL,
-  description text,
-  company text,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  encrypted_secret text,
-  created_by uuid NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
-  is_active boolean NOT NULL DEFAULT true,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS provider_scopes_provider_name_unique_idx
-  ON provider_scopes(provider, lower(name));
-CREATE INDEX IF NOT EXISTS provider_scopes_provider_idx
-  ON provider_scopes(provider, is_active, created_at DESC);
-
-CREATE TABLE IF NOT EXISTS provider_scope_members (
-  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  access text NOT NULL CHECK (access IN ('use','manage')),
-  added_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  added_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY(scope_id, user_id)
-);
-
-CREATE INDEX IF NOT EXISTS provider_scope_members_user_idx
-  ON provider_scope_members(user_id, scope_id);
-
-CREATE TABLE IF NOT EXISTS user_scope_defaults (
-  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  provider text NOT NULL CHECK (provider IN ('aws','npm','jenkins-dev','jenkins-prod','ghcr')),
-  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY(user_id, provider)
-);
-
-CREATE TABLE IF NOT EXISTS project_environment_scopes (
-  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
-  environment text NOT NULL,
-  provider text NOT NULL CHECK (provider IN ('aws','npm','jenkins-dev','jenkins-prod','ghcr')),
-  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE RESTRICT,
-  linked_by uuid REFERENCES users(id) ON DELETE SET NULL,
-  linked_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY(project_id, environment, provider)
-);
-
-CREATE INDEX IF NOT EXISTS project_environment_scopes_scope_idx
-  ON project_environment_scopes(scope_id, project_id, environment);
-
-CREATE TABLE IF NOT EXISTS scope_external_accounts (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
-  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  provider text NOT NULL CHECK (provider IN ('npm','jenkins-dev','jenkins-prod')),
-  external_username text NOT NULL,
-  external_email text,
-  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
-  config jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(scope_id, cloud_user_id)
-);
-
-CREATE INDEX IF NOT EXISTS scope_external_accounts_user_idx
-  ON scope_external_accounts(cloud_user_id, scope_id);
-
-CREATE TABLE IF NOT EXISTS scope_aws_credentials (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
-  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  aws_username text NOT NULL,
-  access_key_id text NOT NULL UNIQUE,
-  encrypted_secret_access_key text NOT NULL,
-  indraq_role text NOT NULL CHECK (indraq_role IN ('user','manager','admin')),
-  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE(scope_id, cloud_user_id)
-);
-
-CREATE INDEX IF NOT EXISTS scope_aws_credentials_user_idx
-  ON scope_aws_credentials(cloud_user_id, scope_id);
+-- v2.1.0 provider scopes: organization-owned provider credentials with explicit
+-- membership, per-user defaults, project/environment bindings and scope-aware
+-- native identity tracking.
+
+CREATE TABLE IF NOT EXISTS provider_scopes (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  provider text NOT NULL CHECK (provider IN ('aws','npm','jenkins-dev','jenkins-prod','ghcr')),
+  name text NOT NULL,
+  description text,
+  company text,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  encrypted_secret text,
+  created_by uuid NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
+  is_active boolean NOT NULL DEFAULT true,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS provider_scopes_provider_name_unique_idx
+  ON provider_scopes(provider, lower(name));
+CREATE INDEX IF NOT EXISTS provider_scopes_provider_idx
+  ON provider_scopes(provider, is_active, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS provider_scope_members (
+  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  access text NOT NULL CHECK (access IN ('use','manage')),
+  added_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  added_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY(scope_id, user_id)
+);
+
+CREATE INDEX IF NOT EXISTS provider_scope_members_user_idx
+  ON provider_scope_members(user_id, scope_id);
+
+CREATE TABLE IF NOT EXISTS user_scope_defaults (
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL CHECK (provider IN ('aws','npm','jenkins-dev','jenkins-prod','ghcr')),
+  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY(user_id, provider)
+);
+
+CREATE TABLE IF NOT EXISTS project_environment_scopes (
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  environment text NOT NULL,
+  provider text NOT NULL CHECK (provider IN ('aws','npm','jenkins-dev','jenkins-prod','ghcr')),
+  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE RESTRICT,
+  linked_by uuid REFERENCES users(id) ON DELETE SET NULL,
+  linked_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY(project_id, environment, provider)
+);
+
+CREATE INDEX IF NOT EXISTS project_environment_scopes_scope_idx
+  ON project_environment_scopes(scope_id, project_id, environment);
+
+CREATE TABLE IF NOT EXISTS scope_external_accounts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  provider text NOT NULL CHECK (provider IN ('npm','jenkins-dev','jenkins-prod')),
+  external_username text NOT NULL,
+  external_email text,
+  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(scope_id, cloud_user_id)
+);
+
+CREATE INDEX IF NOT EXISTS scope_external_accounts_user_idx
+  ON scope_external_accounts(cloud_user_id, scope_id);
+
+CREATE TABLE IF NOT EXISTS scope_aws_credentials (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  scope_id uuid NOT NULL REFERENCES provider_scopes(id) ON DELETE CASCADE,
+  cloud_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  aws_username text NOT NULL,
+  access_key_id text NOT NULL UNIQUE,
+  encrypted_secret_access_key text NOT NULL,
+  indraq_role text NOT NULL CHECK (indraq_role IN ('user','manager','admin')),
+  managed_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(scope_id, cloud_user_id)
+);
+
+CREATE INDEX IF NOT EXISTS scope_aws_credentials_user_idx
+  ON scope_aws_credentials(cloud_user_id, scope_id);

package/cloud-api/sql/009_scope_user_secrets_and_project_lifecycle.sql

@@ -0,0 +1,13 @@
+-- v2.2.0 hardening: per-user NPM/Jenkins secrets and project archive lifecycle.
+
+ALTER TABLE scope_external_accounts
+  ADD COLUMN IF NOT EXISTS encrypted_secret text;
+
+ALTER TABLE projects
+  ADD COLUMN IF NOT EXISTS archived_at timestamptz;
+
+ALTER TABLE projects
+  ADD COLUMN IF NOT EXISTS archived_by uuid REFERENCES users(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS projects_archived_at_idx
+  ON projects(archived_at, created_at DESC);