mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
refactor(db): port auth and security handlers to sqlc
- auth.sql: user lookups, counts, register/mirror inserts, profile update - security.sql: access EXISTS, vulnerability list/metrics/status, framework list, latest scan/report, project-id guards - NULL description/service_id rows stay filtered, matching the original scan-error-and-skip behavior - auth_users probe and filtered audit-log queries stay raw: one is a Better Auth table outside the schema, the other is dynamically built - TestSecurityLiveInvariants covers the access predicate, severity ordering, upsert conflict path, and latest-row lookups against live Postgres Authored By: TDvorak <[email protected]>
This commit is contained in:
Tomas Dvorak committed
1 parent
6bcbc1369e
commit
549790c611
10 files changed
+1169
-155
No files matched your search
@@ -0,0 +1,37 @@
|
||||
-- name: GetUserByEmailForAuth :one
|
||||
SELECT id, email, password_hash, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at
|
||||
FROM users WHERE email = $1;
|
||||
|
||||
-- name: CountUsers :one
|
||||
SELECT COUNT(*) FROM users;
|
||||
|
||||
-- name: CountUsersByEmail :one
|
||||
SELECT COUNT(*) FROM users WHERE email = $1;
|
||||
|
||||
-- name: UpsertLocalUser :one
|
||||
INSERT INTO users (email, password_hash, name, avatar_url, is_admin)
|
||||
VALUES ($1, $2, $3, NULLIF($4::varchar, ''), $5)
|
||||
ON CONFLICT (email) DO UPDATE
|
||||
SET name = EXCLUDED.name,
|
||||
avatar_url = COALESCE(EXCLUDED.avatar_url, users.avatar_url),
|
||||
updated_at = NOW()
|
||||
RETURNING id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at;
|
||||
|
||||
-- name: InsertUserAdmin :one
|
||||
INSERT INTO users (email, password_hash, name, is_admin)
|
||||
VALUES ($1, $2, $3, $4)
|
||||
RETURNING id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at;
|
||||
|
||||
-- name: InsertUser :one
|
||||
INSERT INTO users (email, password_hash, name)
|
||||
VALUES ($1, $2, $3)
|
||||
RETURNING id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at;
|
||||
|
||||
-- name: GetUserByID :one
|
||||
SELECT id, email, name, COALESCE(avatar_url, '') AS avatar_url, is_admin, created_at
|
||||
FROM users WHERE id = $1;
|
||||
|
||||
-- name: UpdateUserProfile :exec
|
||||
UPDATE users
|
||||
SET name = COALESCE($1::varchar, name), avatar_url = COALESCE($2::varchar, avatar_url)
|
||||
WHERE id = $3;
|
||||
@@ -0,0 +1,78 @@
|
||||
-- name: GetProjectOwnerText :one
|
||||
SELECT owner_id::text FROM projects WHERE id = $1;
|
||||
|
||||
-- name: ServiceExistsInProject :one
|
||||
SELECT EXISTS(SELECT 1 FROM services WHERE id = $1 AND project_id = $2);
|
||||
|
||||
-- name: ListVulnerabilities :many
|
||||
SELECT id, type, severity, title, description, service_id, status, found_at, resolved_at
|
||||
FROM vulnerabilities
|
||||
WHERE project_id = $1
|
||||
ORDER BY
|
||||
CASE severity
|
||||
WHEN 'critical' THEN 1
|
||||
WHEN 'high' THEN 2
|
||||
WHEN 'medium' THEN 3
|
||||
WHEN 'low' THEN 4
|
||||
END,
|
||||
found_at DESC;
|
||||
|
||||
-- name: UpdateVulnerabilityStatus :exec
|
||||
UPDATE vulnerabilities SET status = $1, resolved_at = $2 WHERE id = $3;
|
||||
|
||||
-- name: ComplianceFrameworkExists :one
|
||||
SELECT EXISTS(SELECT 1 FROM compliance_frameworks WHERE id = $1);
|
||||
|
||||
-- name: ListComplianceFrameworks :many
|
||||
SELECT id, name, description, version, enabled, created_at
|
||||
FROM compliance_frameworks
|
||||
WHERE enabled = true
|
||||
ORDER BY name;
|
||||
|
||||
-- name: GetVulnerabilityMetrics :one
|
||||
SELECT
|
||||
COUNT(*) AS total,
|
||||
COUNT(*) FILTER (WHERE severity = 'critical') AS critical,
|
||||
COUNT(*) FILTER (WHERE severity = 'high') AS high,
|
||||
COUNT(*) FILTER (WHERE severity = 'medium') AS medium,
|
||||
COUNT(*) FILTER (WHERE severity = 'low') AS low,
|
||||
COUNT(*) FILTER (WHERE status = 'open') AS open,
|
||||
COUNT(*) FILTER (WHERE status = 'resolved') AS resolved
|
||||
FROM vulnerabilities
|
||||
WHERE project_id = $1;
|
||||
|
||||
-- name: GetLatestSecurityScan :one
|
||||
SELECT id, COALESCE((summary->>'score')::int, 0)::int AS score, started_at AS scanned_at, status
|
||||
FROM security_scans
|
||||
WHERE project_id = $1
|
||||
ORDER BY started_at DESC
|
||||
LIMIT 1;
|
||||
|
||||
-- name: GetLatestComplianceReport :one
|
||||
SELECT overall_status, score, assessment_date
|
||||
FROM compliance_reports
|
||||
WHERE project_id = $1
|
||||
ORDER BY assessment_date DESC
|
||||
LIMIT 1;
|
||||
|
||||
-- name: CheckSecurityProjectAccess :one
|
||||
SELECT EXISTS (
|
||||
SELECT 1
|
||||
FROM projects p
|
||||
WHERE p.id = $1
|
||||
AND (p.is_approved
|
||||
OR $3::bool
|
||||
OR p.owner_id = $2 OR EXISTS (
|
||||
SELECT 1 FROM project_members pm
|
||||
WHERE pm.project_id = p.id AND pm.user_id = $2
|
||||
))
|
||||
);
|
||||
|
||||
-- name: GetSecurityScanProjectID :one
|
||||
SELECT project_id FROM security_scans WHERE id = $1;
|
||||
|
||||
-- name: GetComplianceReportProjectID :one
|
||||
SELECT project_id FROM compliance_reports WHERE id = $1;
|
||||
|
||||
-- name: GetVulnerabilityProjectID :one
|
||||
SELECT project_id FROM vulnerabilities WHERE id = $1;
|
||||
@@ -529,3 +529,64 @@ CREATE TABLE git_webhooks (
|
||||
created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
|
||||
updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE TABLE users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email VARCHAR(255) NOT NULL UNIQUE,
|
||||
password_hash VARCHAR(255) NOT NULL,
|
||||
name VARCHAR(255) NOT NULL,
|
||||
avatar_url VARCHAR(500),
|
||||
created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
|
||||
updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
|
||||
is_admin BOOLEAN NOT NULL DEFAULT false
|
||||
);
|
||||
|
||||
CREATE TABLE compliance_frameworks (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
name VARCHAR(100) NOT NULL UNIQUE,
|
||||
description TEXT,
|
||||
version VARCHAR(20) NOT NULL,
|
||||
enabled BOOLEAN NOT NULL DEFAULT true,
|
||||
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE TABLE security_scans (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
project_id UUID NOT NULL,
|
||||
service_id UUID,
|
||||
scan_type VARCHAR(50) NOT NULL,
|
||||
status VARCHAR(50) NOT NULL DEFAULT 'running',
|
||||
started_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||||
completed_at TIMESTAMP WITH TIME ZONE,
|
||||
summary JSONB DEFAULT '{}',
|
||||
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE TABLE compliance_reports (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
project_id UUID NOT NULL,
|
||||
framework_id UUID NOT NULL,
|
||||
assessment_date TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||||
assessor VARCHAR(255),
|
||||
overall_status VARCHAR(50) NOT NULL,
|
||||
score INTEGER NOT NULL DEFAULT 0,
|
||||
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE TABLE vulnerabilities (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
type VARCHAR(50) NOT NULL,
|
||||
severity VARCHAR(20) NOT NULL,
|
||||
title VARCHAR(255) NOT NULL,
|
||||
description TEXT,
|
||||
service_id UUID,
|
||||
project_id UUID NOT NULL,
|
||||
status VARCHAR(50) NOT NULL DEFAULT 'open',
|
||||
found_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||||
resolved_at TIMESTAMP WITH TIME ZONE,
|
||||
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
|
||||
);
|
||||
Reference in new issue
Block a user