update

internal/api/build.go

@@ -19,6 +19,17 @@ type BuildHandler struct {
 	dockerClient *docker.Client
 }
 
+func (h *BuildHandler) buildUnavailable(c *gin.Context) bool {
+	if h.buildManager != nil {
+		return false
+	}
+
+	c.JSON(http.StatusServiceUnavailable, gin.H{
+		"error": "Build service is unavailable: Docker client not initialized",
+	})
+	return true
+}
+
 // NewBuildHandler creates a new build handler
 func NewBuildHandler(buildManager *build.BuildManager, dockerClient *docker.Client) *BuildHandler {
 	return &BuildHandler{
@@ -96,6 +107,10 @@ type BuildListResponse struct {
 // @Failure 500 {object} map[string]string
 // @Router /api/v1/builds [post]
 func (h *BuildHandler) StartBuild(c *gin.Context) {
+	if h.buildUnavailable(c) {
+		return
+	}
+
 	var req BuildRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -286,6 +301,10 @@ func (h *BuildHandler) GetBuildLogs(c *gin.Context) {
 // @Failure 500 {object} map[string]string
 // @Router /api/v1/builds/plan [post]
 func (h *BuildHandler) GetBuildPlan(c *gin.Context) {
+	if h.buildUnavailable(c) {
+		return
+	}
+
 	var req BuildRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -327,6 +346,10 @@ func (h *BuildHandler) GetBuildPlan(c *gin.Context) {
 // @Failure 500 {object} map[string]string
 // @Router /api/v1/builds/detect [get]
 func (h *BuildHandler) DetectBuildType(c *gin.Context) {
+	if h.buildUnavailable(c) {
+		return
+	}
+
 	sourcePath := c.Query("source_path")
 	if sourcePath == "" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "source_path is required"})

internal/api/deployments.go

@@ -4,8 +4,8 @@ import (
 	"containr/internal/database"
 	"containr/internal/deployment"
 	"context"
-	"encoding/json"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -139,6 +139,10 @@ func handleCreateDeployment(c *gin.Context) {
 		return
 	}
 
+	if req.Trigger == "" {
+		req.Trigger = "manual"
+	}
+
 	userID, exists := c.Get("user_id")
 	if !exists {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
@@ -172,11 +176,20 @@ func handleCreateDeployment(c *gin.Context) {
 		return
 	}
 
+	if req.Branch == "" {
+		req.Branch = service.GitBranch
+	}
+
 	now := time.Now()
+	var commitHash *string
+	if trimmed := strings.TrimSpace(req.CommitHash); trimmed != "" {
+		commitHash = &trimmed
+	}
+
 	d := DeploymentModel{
 		ID:         uuid.New(),
 		ServiceID:  serviceID,
-		CommitHash: &req.CommitHash,
+		CommitHash: commitHash,
 		Status:     "pending",
 		ImageName:  "",
 		ImageTag:   "",
@@ -184,10 +197,6 @@ func handleCreateDeployment(c *gin.Context) {
 		UpdatedAt:  now,
 	}
 
-	if req.CommitHash != "" {
-		d.CommitHash = &req.CommitHash
-	}
-
 	_, err = db.(*database.DB).Exec(
 		`INSERT INTO deployments 
 		 (id, service_id, commit_hash, status, image_name, image_tag, created_at, updated_at)
@@ -200,59 +209,202 @@ func handleCreateDeployment(c *gin.Context) {
 		return
 	}
 
-	_, err = db.(*database.DB).Exec(
-		`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
-		time.Now(), serviceID,
-	)
-	if err != nil {
-	}
-
 	engine, exists := c.Get("deployment_engine")
-	if exists && engine != nil {
-		go func() {
-			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
-			defer cancel()
+	if !exists || engine == nil {
+		unavailableErr := "Deployment engine unavailable. Docker may not be configured on this server."
+		completedAt := time.Now()
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE deployments
+			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+			 WHERE id = $3`,
+			unavailableErr, completedAt, d.ID,
+		)
+		d.Status = "failed"
+		d.Error = &unavailableErr
+		d.CompletedAt = &completedAt
+	} else {
+		_, err = db.(*database.DB).Exec(
+			`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
+			time.Now(), serviceID,
+		)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service status"})
+			return
+		}
 
-			envVarsJSON, _ := json.Marshal(req.EnvVars)
-			_ = envVarsJSON
-
-			deployReq := &deployment.DeploymentRequest{
-				ProjectID:   service.ProjectID.String(),
-				ServiceID:   serviceID.String(),
-				Environment: service.Environment,
-				Config: deployment.ServiceConfig{
-					Name:        service.Name,
-					Image:       service.Image,
-					Environment: req.EnvVars,
-					Replicas:    1,
-				},
-				BuildConfig: &deployment.BuildConfig{
-					BuildType:  "nixpacks",
-					SourcePath: service.BuildPath,
-					Branch:     service.GitBranch,
-					Commit:     req.CommitHash,
-				},
-				Trigger: deployment.TriggerConfig{
-					Type:      req.Trigger,
-					Source:    "api",
-					User:      userID.(string),
-					Timestamp: now,
-				},
-			}
-
-			_, _ = engine.(*deployment.DeploymentEngine).Deploy(ctx, deployReq)
-		}()
+		engineInstance := engine.(*deployment.DeploymentEngine)
+		go runDeploymentAndSync(context.Background(), db.(*database.DB), engineInstance, &d, service, req, userID.(string))
 	}
 
 	c.JSON(http.StatusCreated, DeploymentResponse{
-		ID:         d.ID,
-		ServiceID:  d.ServiceID,
-		CommitHash: d.CommitHash,
-		Status:     d.Status,
-		CreatedAt:  d.CreatedAt,
+		ID:          d.ID,
+		ServiceID:   d.ServiceID,
+		CommitHash:  d.CommitHash,
+		Status:      d.Status,
+		Error:       d.Error,
+		CompletedAt: d.CompletedAt,
+		CreatedAt:   d.CreatedAt,
 	})
 }
 
+func runDeploymentAndSync(
+	parentCtx context.Context,
+	db *database.DB,
+	engine *deployment.DeploymentEngine,
+	dbDeployment *DeploymentModel,
+	service Service,
+	req CreateDeploymentRequest,
+	userID string,
+) {
+	ctx, cancel := context.WithTimeout(parentCtx, 30*time.Minute)
+	defer cancel()
+
+	sourcePath := strings.TrimSpace(service.BuildPath)
+	if sourcePath == "" {
+		sourcePath = "."
+	}
+
+	deployReq := &deployment.DeploymentRequest{
+		ProjectID:   service.ProjectID.String(),
+		ServiceID:   service.ID.String(),
+		Environment: service.Environment,
+		Config: deployment.ServiceConfig{
+			Name:        service.Name,
+			Image:       service.Image,
+			Environment: req.EnvVars,
+			Replicas:    1,
+		},
+		BuildConfig: &deployment.BuildConfig{
+			BuildType:  "nixpacks",
+			SourcePath: sourcePath,
+			Branch:     req.Branch,
+			Commit:     req.CommitHash,
+		},
+		Trigger: deployment.TriggerConfig{
+			Type:      req.Trigger,
+			Source:    "api",
+			User:      userID,
+			Timestamp: time.Now(),
+		},
+	}
+
+	engineDeployment, err := engine.Deploy(ctx, deployReq)
+	if err != nil {
+		failedAt := time.Now()
+		failure := "Failed to start deployment engine: " + err.Error()
+		_, _ = db.Exec(
+			`UPDATE deployments
+			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+			 WHERE id = $3`,
+			failure, failedAt, dbDeployment.ID,
+		)
+		_, _ = db.Exec(
+			`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
+			failedAt, service.ID,
+		)
+		return
+	}
+
+	syncTicker := time.NewTicker(1 * time.Second)
+	defer syncTicker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			failedAt := time.Now()
+			timeoutErr := "Deployment timed out before completion"
+			_, _ = db.Exec(
+				`UPDATE deployments
+				 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+				 WHERE id = $3`,
+				timeoutErr, failedAt, dbDeployment.ID,
+			)
+			_, _ = db.Exec(
+				`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
+				failedAt, service.ID,
+			)
+			return
+		case <-syncTicker.C:
+			current, getErr := engine.GetDeployment(engineDeployment.ID)
+			if getErr != nil {
+				continue
+			}
+
+			dbStatus := mapEngineStatusToDBStatus(current.Status)
+			imageName, imageTag := splitImageReference(current.ImageName, dbDeployment.ImageTag)
+
+			var dbError interface{}
+			if current.Error != "" {
+				dbError = current.Error
+			}
+
+			_, _ = db.Exec(
+				`UPDATE deployments
+				 SET status = $1,
+				     image_name = $2,
+				     image_tag = $3,
+				     build_log = $4,
+				     runtime_log = $5,
+				     error = $6,
+				     started_at = $7,
+				     completed_at = $8,
+				     updated_at = $9
+				 WHERE id = $10`,
+				dbStatus,
+				imageName,
+				imageTag,
+				current.BuildLog,
+				current.DeployLog,
+				dbError,
+				current.StartedAt,
+				current.CompletedAt,
+				time.Now(),
+				dbDeployment.ID,
+			)
+
+			switch dbStatus {
+			case "deployed":
+				_, _ = db.Exec(
+					`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`,
+					time.Now(), service.ID,
+				)
+				return
+			case "failed":
+				_, _ = db.Exec(
+					`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
+					time.Now(), service.ID,
+				)
+				return
+			}
+		}
+	}
+}
+
+func mapEngineStatusToDBStatus(status string) string {
+	switch status {
+	case "running":
+		return "deployed"
+	case "cancelled":
+		return "failed"
+	default:
+		return status
+	}
+}
+
+func splitImageReference(image, fallbackTag string) (string, string) {
+	if image == "" {
+		return "", fallbackTag
+	}
+
+	lastSlash := strings.LastIndex(image, "/")
+	lastColon := strings.LastIndex(image, ":")
+	if lastColon > lastSlash && !strings.Contains(image[lastColon:], "@") {
+		return image[:lastColon], image[lastColon+1:]
+	}
+
+	return image, fallbackTag
+}
+
 func handleGetDeployment(c *gin.Context) {
 	db, exists := c.Get("db")
 	if !exists {

internal/api/params.go

@@ -0,0 +1,13 @@
+package api
+
+import "github.com/gin-gonic/gin"
+
+// firstPathParam returns the first non-empty route param from the provided names.
+func firstPathParam(c *gin.Context, names ...string) string {
+	for _, name := range names {
+		if value := c.Param(name); value != "" {
+			return value
+		}
+	}
+	return ""
+}

internal/api/preview_environments.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"containr/internal/database"
+	"database/sql"
 	"fmt"
 	"net/http"
 	"strings"
@@ -32,7 +33,7 @@ type PreviewEnvironment struct {
 
 // CreatePreviewEnvironmentRequest represents a request to create a preview environment
 type CreatePreviewEnvironmentRequest struct {
-	ProjectID  uuid.UUID `json:"project_id" binding:"required"`
+	ProjectID  uuid.UUID `json:"project_id"`
 	ServiceID  uuid.UUID `json:"service_id" binding:"required"`
 	BranchName string    `json:"branch_name" binding:"required"`
 	PRNumber   *int      `json:"pr_number"`
@@ -61,7 +62,7 @@ func handleGetPreviewEnvironments(c *gin.Context) {
 		return
 	}
 
-	projectIDStr := c.Param("project_id")
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
 	projectID, err := uuid.Parse(projectIDStr)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
@@ -113,20 +114,29 @@ func handleGetPreviewEnvironments(c *gin.Context) {
 	var environments []PreviewEnvironment
 	for rows.Next() {
 		var env PreviewEnvironment
-		var service Service
+		var serviceID sql.NullString
+		var serviceName sql.NullString
+		var serviceType sql.NullString
 
 		err := rows.Scan(
 			&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
 			&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
-			&service.ID, &service.Name, &service.Type,
+			&serviceID, &serviceName, &serviceType,
 		)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan preview environment"})
 			return
 		}
 
-		if service.ID != uuid.Nil {
-			env.Service = &service
+		if serviceID.Valid {
+			parsedServiceID, parseErr := uuid.Parse(serviceID.String)
+			if parseErr == nil {
+				env.Service = &Service{
+					ID:   parsedServiceID,
+					Name: serviceName.String,
+					Type: serviceType.String,
+				}
+			}
 		}
 
 		environments = append(environments, env)
@@ -143,12 +153,26 @@ func handleCreatePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
+	projectID, err := uuid.Parse(projectIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return
+	}
+
 	var req CreatePreviewEnvironmentRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
+	if req.ProjectID == uuid.Nil {
+		req.ProjectID = projectID
+	} else if req.ProjectID != projectID {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Project ID in URL and request body must match"})
+		return
+	}
+
 	// Get user ID from JWT token
 	userID, exists := c.Get("user_id")
 	if !exists {
@@ -158,7 +182,7 @@ func handleCreatePreviewEnvironment(c *gin.Context) {
 
 	// Check if project exists and user has access
 	var project Project
-	err := db.(*database.DB).QueryRow(
+	err = db.(*database.DB).QueryRow(
 		"SELECT id, name, owner_id FROM projects WHERE id = $1",
 		req.ProjectID,
 	).Scan(&project.ID, &project.Name, &project.OwnerID)
@@ -268,7 +292,9 @@ func handleGetPreviewEnvironment(c *gin.Context) {
 
 	// Get preview environment with project ownership check
 	var env PreviewEnvironment
-	var serviceName, serviceType string
+	var serviceID sql.NullString
+	var serviceName sql.NullString
+	var serviceType sql.NullString
 	err = db.(*database.DB).QueryRow(
 		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
 				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
@@ -281,7 +307,7 @@ func handleGetPreviewEnvironment(c *gin.Context) {
 	).Scan(
 		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
 		&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
-		&env.ServiceID, &serviceName, &serviceType,
+		&serviceID, &serviceName, &serviceType,
 	)
 
 	if err != nil {
@@ -290,11 +316,14 @@ func handleGetPreviewEnvironment(c *gin.Context) {
 	}
 
 	// Populate service info if available
-	if env.ServiceID != uuid.Nil {
-		env.Service = &Service{
-			ID:   env.ServiceID,
-			Name: serviceName,
-			Type: serviceType,
+	if serviceID.Valid {
+		parsedServiceID, parseErr := uuid.Parse(serviceID.String)
+		if parseErr == nil {
+			env.Service = &Service{
+				ID:   parsedServiceID,
+				Name: serviceName.String,
+				Type: serviceType.String,
+			}
 		}
 	}
 

internal/api/routes.go

@@ -21,7 +21,8 @@ import (
 func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg *config.Config) {
 	// Initialize Docker client (non-fatal if it fails)
 	var dockerClient *docker.Client
-	buildManager := &build.BuildManager{} // Default empty manager
+	var buildManager *build.BuildManager
+	var deploymentEngine *deployment.DeploymentEngine
 
 	if client, err := docker.NewClient(); err != nil {
 		log.Printf("Warning: Failed to initialize Docker client: %v", err)
@@ -29,6 +30,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 	} else {
 		dockerClient = client
 		buildManager = build.NewBuildManager("/tmp/containr-builds", dockerClient)
+		deploymentEngine = deployment.NewDeploymentEngine(buildManager, dockerClient)
 	}
 
 	// Initialize build handler
@@ -81,6 +83,9 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		c.Set("jwt_secret", cfg.JWTSecret)
 		c.Set("docker_client", dockerClient)
 		c.Set("build_manager", buildManager)
+		if deploymentEngine != nil {
+			c.Set("deployment_engine", deploymentEngine)
+		}
 		c.Set("scheduler", scheduler)
 		c.Set("metrics_collector", metricsCollector)
 		c.Set("auto_scaler", autoScaler)

internal/api/security.go

@@ -3,6 +3,7 @@ package api
 import (
 	"containr/internal/database"
 	"containr/internal/security"
+	"database/sql"
 	"net/http"
 	"strconv"
 	"time"
@@ -48,7 +49,35 @@ func (sh *SecurityHandler) StartSecurityScan(c *gin.Context) {
 		return
 	}
 
-	userID := c.MustGet("user_id").(string)
+	userID, ok := sh.requireProjectAccess(c, req.ProjectID)
+	if !ok {
+		return
+	}
+
+	if req.ServiceID != "" {
+		if _, err := uuid.Parse(req.ServiceID); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+			return
+		}
+
+		var serviceExists bool
+		err := sh.db.QueryRow(
+			`SELECT EXISTS(
+				SELECT 1 FROM services WHERE id = $1 AND project_id = $2
+			)`,
+			req.ServiceID,
+			req.ProjectID,
+		).Scan(&serviceExists)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to validate service"})
+			return
+		}
+
+		if !serviceExists {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "Service not found in project"})
+			return
+		}
+	}
 
 	// Log audit event
 	sh.auditLogger.LogSecurityEvent(userID, "security_scan_started", "project",
@@ -69,7 +98,10 @@ func (sh *SecurityHandler) StartSecurityScan(c *gin.Context) {
 
 // GetSecurityScan retrieves a security scan
 func (sh *SecurityHandler) GetSecurityScan(c *gin.Context) {
-	scanID := c.Param("scanId")
+	scanID := firstPathParam(c, "scanId", "id")
+	if !sh.requireSecurityScanAccess(c, scanID) {
+		return
+	}
 
 	scan, err := sh.scanner.GetSecurityScan(scanID)
 	if err != nil {
@@ -82,11 +114,14 @@ func (sh *SecurityHandler) GetSecurityScan(c *gin.Context) {
 
 // GetProjectSecurityHistory retrieves security scan history for a project
 func (sh *SecurityHandler) GetProjectSecurityHistory(c *gin.Context) {
-	projectID := c.Param("projectId")
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
 
 	limit := 10
 	if limitStr := c.Query("limit"); limitStr != "" {
-		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 {
+		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 && parsedLimit <= 1000 {
 			limit = parsedLimit
 		}
 	}
@@ -102,7 +137,10 @@ func (sh *SecurityHandler) GetProjectSecurityHistory(c *gin.Context) {
 
 // GetVulnerabilities retrieves vulnerabilities for a project
 func (sh *SecurityHandler) GetVulnerabilities(c *gin.Context) {
-	projectID := c.Param("projectId")
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
 
 	// Query vulnerabilities
 	rows, err := sh.db.Query(`
@@ -146,8 +184,11 @@ func (sh *SecurityHandler) GetVulnerabilities(c *gin.Context) {
 
 // UpdateVulnerability updates a vulnerability status
 func (sh *SecurityHandler) UpdateVulnerability(c *gin.Context) {
-	vulnID := c.Param("vulnId")
-	userID := c.MustGet("user_id").(string)
+	vulnID := firstPathParam(c, "vulnId", "id")
+	userID, ok := sh.requireVulnerabilityAccess(c, vulnID)
+	if !ok {
+		return
+	}
 
 	var req struct {
 		Status string `json:"status" binding:"required,oneof=open resolved ignored"`
@@ -199,7 +240,31 @@ func (sh *SecurityHandler) StartComplianceAssessment(c *gin.Context) {
 		return
 	}
 
-	userID := c.MustGet("user_id").(string)
+	userID, ok := sh.requireProjectAccess(c, req.ProjectID)
+	if !ok {
+		return
+	}
+
+	if _, err := uuid.Parse(req.FrameworkID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid framework ID"})
+		return
+	}
+
+	var frameworkExists bool
+	err := sh.db.QueryRow(
+		`SELECT EXISTS(
+			SELECT 1 FROM compliance_frameworks WHERE id = $1
+		)`,
+		req.FrameworkID,
+	).Scan(&frameworkExists)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to validate framework"})
+		return
+	}
+	if !frameworkExists {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Compliance framework not found"})
+		return
+	}
 
 	// Log audit event
 	sh.auditLogger.LogSecurityEvent(userID, "compliance_assessment_started", "project",
@@ -219,7 +284,10 @@ func (sh *SecurityHandler) StartComplianceAssessment(c *gin.Context) {
 
 // GetComplianceReport retrieves a compliance report
 func (sh *SecurityHandler) GetComplianceReport(c *gin.Context) {
-	reportID := c.Param("reportId")
+	reportID := firstPathParam(c, "reportId", "id")
+	if !sh.requireComplianceReportAccess(c, reportID) {
+		return
+	}
 
 	report, err := sh.complianceManager.GetComplianceReport(reportID)
 	if err != nil {
@@ -280,7 +348,10 @@ func (sh *SecurityHandler) InitializeGDPRFramework(c *gin.Context) {
 
 // GetSecurityMetrics retrieves security metrics for a project
 func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
-	projectID := c.Param("projectId")
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
 
 	// Get vulnerability counts
 	var vulnMetrics struct {
@@ -293,7 +364,7 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		Resolved int `json:"resolved"`
 	}
 
-	sh.db.QueryRow(`
+	err := sh.db.QueryRow(`
 		SELECT 
 			COUNT(*) as total,
 			COUNT(*) FILTER (WHERE severity = 'critical') as critical,
@@ -306,6 +377,10 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		WHERE project_id = $1
 	`, projectID).Scan(&vulnMetrics.Total, &vulnMetrics.Critical, &vulnMetrics.High,
 		&vulnMetrics.Medium, &vulnMetrics.Low, &vulnMetrics.Open, &vulnMetrics.Resolved)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get vulnerability metrics"})
+		return
+	}
 
 	// Get latest scan
 	var latestScan struct {
@@ -315,7 +390,7 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		Status    string    `json:"status"`
 	}
 
-	err := sh.db.QueryRow(`
+	err = sh.db.QueryRow(`
 		SELECT id, score, started_at as scanned_at, status
 		FROM security_scans 
 		WHERE project_id = $1 
@@ -323,13 +398,16 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		LIMIT 1
 	`, projectID).Scan(&latestScan.ID, &latestScan.Score, &latestScan.ScannedAt, &latestScan.Status)
 
-	if err != nil {
+	if err == sql.ErrNoRows {
 		latestScan = struct {
 			ID        string    `json:"id"`
 			Score     int       `json:"score"`
 			ScannedAt time.Time `json:"scanned_at"`
 			Status    string    `json:"status"`
 		}{ID: "", Score: 0, ScannedAt: time.Time{}, Status: "never_scanned"}
+	} else if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get latest scan"})
+		return
 	}
 
 	// Get compliance status
@@ -347,12 +425,15 @@ func (sh *SecurityHandler) GetSecurityMetrics(c *gin.Context) {
 		LIMIT 1
 	`, projectID).Scan(&complianceStatus.OverallStatus, &complianceStatus.Score, &complianceStatus.LastAssessed)
 
-	if err != nil {
+	if err == sql.ErrNoRows {
 		complianceStatus = struct {
 			OverallStatus string     `json:"overall_status"`
 			Score         int        `json:"score"`
 			LastAssessed  *time.Time `json:"last_assessed"`
 		}{OverallStatus: "not_assessed", Score: 0, LastAssessed: nil}
+	} else if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get compliance status"})
+		return
 	}
 
 	metrics := gin.H{
@@ -386,7 +467,10 @@ func (sh *SecurityHandler) calculateOverallSecurityScore(vulnMetrics struct {
 
 // GetAuditLogs retrieves audit logs for security events
 func (sh *SecurityHandler) GetAuditLogs(c *gin.Context) {
-	_ = c.Param("projectId") // projectID is available but not used in this implementation
+	projectID := firstPathParam(c, "projectId", "id", "project_id")
+	if _, ok := sh.requireProjectAccess(c, projectID); !ok {
+		return
+	}
 
 	limit := 50
 	if limitStr := c.Query("limit"); limitStr != "" {
@@ -414,6 +498,111 @@ func (sh *SecurityHandler) GetAuditLogs(c *gin.Context) {
 	})
 }
 
+func (sh *SecurityHandler) requireProjectAccess(c *gin.Context, projectID string) (string, bool) {
+	userIDValue, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return "", false
+	}
+	userID, ok := userIDValue.(string)
+	if !ok || userID == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
+		return "", false
+	}
+
+	if _, err := uuid.Parse(projectID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return "", false
+	}
+
+	var hasAccess bool
+	err := sh.db.QueryRow(
+		`SELECT EXISTS (
+			SELECT 1
+			FROM projects p
+			WHERE p.id = $1
+			  AND (p.owner_id = $2 OR EXISTS (
+					SELECT 1 FROM project_members pm
+					WHERE pm.project_id = p.id AND pm.user_id = $2
+			  ))
+		)`,
+		projectID, userID,
+	).Scan(&hasAccess)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify project access"})
+		return "", false
+	}
+
+	if !hasAccess {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return "", false
+	}
+
+	return userID, true
+}
+
+func (sh *SecurityHandler) requireSecurityScanAccess(c *gin.Context, scanID string) bool {
+	if _, err := uuid.Parse(scanID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid scan ID"})
+		return false
+	}
+
+	var projectID string
+	err := sh.db.QueryRow("SELECT project_id FROM security_scans WHERE id = $1", scanID).Scan(&projectID)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Security scan not found"})
+		return false
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify scan access"})
+		return false
+	}
+
+	_, ok := sh.requireProjectAccess(c, projectID)
+	return ok
+}
+
+func (sh *SecurityHandler) requireComplianceReportAccess(c *gin.Context, reportID string) bool {
+	if _, err := uuid.Parse(reportID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid report ID"})
+		return false
+	}
+
+	var projectID string
+	err := sh.db.QueryRow("SELECT project_id FROM compliance_reports WHERE id = $1", reportID).Scan(&projectID)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Compliance report not found"})
+		return false
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify report access"})
+		return false
+	}
+
+	_, ok := sh.requireProjectAccess(c, projectID)
+	return ok
+}
+
+func (sh *SecurityHandler) requireVulnerabilityAccess(c *gin.Context, vulnID string) (string, bool) {
+	if _, err := uuid.Parse(vulnID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid vulnerability ID"})
+		return "", false
+	}
+
+	var projectID string
+	err := sh.db.QueryRow("SELECT project_id FROM vulnerabilities WHERE id = $1", vulnID).Scan(&projectID)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Vulnerability not found"})
+		return "", false
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify vulnerability access"})
+		return "", false
+	}
+
+	return sh.requireProjectAccess(c, projectID)
+}
+
 // max helper function
 func max(a, b int) int {
 	if a > b {

internal/api/services.go

@@ -30,7 +30,7 @@ type Service struct {
 
 // CreateServiceRequest represents a request to create a service
 type CreateServiceRequest struct {
-	ProjectID   uuid.UUID `json:"project_id" binding:"required"`
+	ProjectID   uuid.UUID `json:"project_id"`
 	Name        string    `json:"name" binding:"required,min=1,max=255"`
 	Type        string    `json:"type" binding:"required,oneof=web worker database cron"`
 	Image       string    `json:"image"`
@@ -65,7 +65,7 @@ func handleGetServices(c *gin.Context) {
 		return
 	}
 
-	projectIDStr := c.Param("project_id")
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
 	projectID, err := uuid.Parse(projectIDStr)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
@@ -139,12 +139,26 @@ func handleCreateService(c *gin.Context) {
 		return
 	}
 
+	projectIDStr := firstPathParam(c, "id", "project_id", "projectId")
+	projectID, err := uuid.Parse(projectIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
+		return
+	}
+
 	var req CreateServiceRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
+	if req.ProjectID == uuid.Nil {
+		req.ProjectID = projectID
+	} else if req.ProjectID != projectID {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Project ID in URL and request body must match"})
+		return
+	}
+
 	// Get user ID from JWT token
 	userID, exists := c.Get("user_id")
 	if !exists {
@@ -154,7 +168,7 @@ func handleCreateService(c *gin.Context) {
 
 	// Check if project exists and user has access
 	var project Project
-	err := db.(*database.DB).QueryRow(
+	err = db.(*database.DB).QueryRow(
 		"SELECT id, name, owner_id FROM projects WHERE id = $1",
 		req.ProjectID,
 	).Scan(&project.ID, &project.Name, &project.OwnerID)