mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
55edbf8b56
Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
auth middleware; scope picker + badges in Settings UI; scopeless legacy
keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY
Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
(migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)
Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
(429s = configured rate limiter working)
Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
346 lines
12 KiB
Go
346 lines
12 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.29.0
|
|
|
|
package db
|
|
|
|
import (
|
|
"database/sql/driver"
|
|
"fmt"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
)
|
|
|
|
type CoreBucketVisibility string
|
|
|
|
const (
|
|
CoreBucketVisibilityPrivate CoreBucketVisibility = "private"
|
|
CoreBucketVisibilityPublic CoreBucketVisibility = "public"
|
|
)
|
|
|
|
func (e *CoreBucketVisibility) Scan(src interface{}) error {
|
|
switch s := src.(type) {
|
|
case []byte:
|
|
*e = CoreBucketVisibility(s)
|
|
case string:
|
|
*e = CoreBucketVisibility(s)
|
|
default:
|
|
return fmt.Errorf("unsupported scan type for CoreBucketVisibility: %T", src)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
type NullCoreBucketVisibility struct {
|
|
CoreBucketVisibility CoreBucketVisibility `json:"core_bucket_visibility"`
|
|
Valid bool `json:"valid"` // Valid is true if CoreBucketVisibility is not NULL
|
|
}
|
|
|
|
// Scan implements the Scanner interface.
|
|
func (ns *NullCoreBucketVisibility) Scan(value interface{}) error {
|
|
if value == nil {
|
|
ns.CoreBucketVisibility, ns.Valid = "", false
|
|
return nil
|
|
}
|
|
ns.Valid = true
|
|
return ns.CoreBucketVisibility.Scan(value)
|
|
}
|
|
|
|
// Value implements the driver Valuer interface.
|
|
func (ns NullCoreBucketVisibility) Value() (driver.Value, error) {
|
|
if !ns.Valid {
|
|
return nil, nil
|
|
}
|
|
return string(ns.CoreBucketVisibility), nil
|
|
}
|
|
|
|
type CoreOrgRole string
|
|
|
|
const (
|
|
CoreOrgRoleOwner CoreOrgRole = "owner"
|
|
CoreOrgRoleAdmin CoreOrgRole = "admin"
|
|
CoreOrgRoleMember CoreOrgRole = "member"
|
|
)
|
|
|
|
func (e *CoreOrgRole) Scan(src interface{}) error {
|
|
switch s := src.(type) {
|
|
case []byte:
|
|
*e = CoreOrgRole(s)
|
|
case string:
|
|
*e = CoreOrgRole(s)
|
|
default:
|
|
return fmt.Errorf("unsupported scan type for CoreOrgRole: %T", src)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
type NullCoreOrgRole struct {
|
|
CoreOrgRole CoreOrgRole `json:"core_org_role"`
|
|
Valid bool `json:"valid"` // Valid is true if CoreOrgRole is not NULL
|
|
}
|
|
|
|
// Scan implements the Scanner interface.
|
|
func (ns *NullCoreOrgRole) Scan(value interface{}) error {
|
|
if value == nil {
|
|
ns.CoreOrgRole, ns.Valid = "", false
|
|
return nil
|
|
}
|
|
ns.Valid = true
|
|
return ns.CoreOrgRole.Scan(value)
|
|
}
|
|
|
|
// Value implements the driver Valuer interface.
|
|
func (ns NullCoreOrgRole) Value() (driver.Value, error) {
|
|
if !ns.Valid {
|
|
return nil, nil
|
|
}
|
|
return string(ns.CoreOrgRole), nil
|
|
}
|
|
|
|
type CoreProjectRole string
|
|
|
|
const (
|
|
CoreProjectRoleAdmin CoreProjectRole = "admin"
|
|
CoreProjectRoleDeveloper CoreProjectRole = "developer"
|
|
CoreProjectRoleViewer CoreProjectRole = "viewer"
|
|
)
|
|
|
|
func (e *CoreProjectRole) Scan(src interface{}) error {
|
|
switch s := src.(type) {
|
|
case []byte:
|
|
*e = CoreProjectRole(s)
|
|
case string:
|
|
*e = CoreProjectRole(s)
|
|
default:
|
|
return fmt.Errorf("unsupported scan type for CoreProjectRole: %T", src)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
type NullCoreProjectRole struct {
|
|
CoreProjectRole CoreProjectRole `json:"core_project_role"`
|
|
Valid bool `json:"valid"` // Valid is true if CoreProjectRole is not NULL
|
|
}
|
|
|
|
// Scan implements the Scanner interface.
|
|
func (ns *NullCoreProjectRole) Scan(value interface{}) error {
|
|
if value == nil {
|
|
ns.CoreProjectRole, ns.Valid = "", false
|
|
return nil
|
|
}
|
|
ns.Valid = true
|
|
return ns.CoreProjectRole.Scan(value)
|
|
}
|
|
|
|
// Value implements the driver Valuer interface.
|
|
func (ns NullCoreProjectRole) Value() (driver.Value, error) {
|
|
if !ns.Valid {
|
|
return nil, nil
|
|
}
|
|
return string(ns.CoreProjectRole), nil
|
|
}
|
|
|
|
type CoreApiKey struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
Name string `json:"name"`
|
|
Prefix string `json:"prefix"`
|
|
SecretHash []byte `json:"secret_hash"`
|
|
CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
|
|
LastUsedAt pgtype.Timestamptz `json:"last_used_at"`
|
|
RevokedAt pgtype.Timestamptz `json:"revoked_at"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
Scopes []string `json:"scopes"`
|
|
}
|
|
|
|
type CoreAuditLog struct {
|
|
ID uuid.UUID `json:"id"`
|
|
OrganizationID pgtype.UUID `json:"organization_id"`
|
|
ProjectID pgtype.UUID `json:"project_id"`
|
|
ActorUserID pgtype.UUID `json:"actor_user_id"`
|
|
ActorApiKeyID pgtype.UUID `json:"actor_api_key_id"`
|
|
Action string `json:"action"`
|
|
ResourceType string `json:"resource_type"`
|
|
ResourceID string `json:"resource_id"`
|
|
Metadata []byte `json:"metadata"`
|
|
RequestID string `json:"request_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreBucket struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
Slug string `json:"slug"`
|
|
Name string `json:"name"`
|
|
Visibility string `json:"visibility"`
|
|
CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreBucketObject struct {
|
|
ID uuid.UUID `json:"id"`
|
|
BucketID uuid.UUID `json:"bucket_id"`
|
|
ObjectKey string `json:"object_key"`
|
|
ContentType string `json:"content_type"`
|
|
SizeBytes int64 `json:"size_bytes"`
|
|
ChecksumSha256 string `json:"checksum_sha256"`
|
|
StoragePath string `json:"storage_path"`
|
|
UploadedByUserID pgtype.UUID `json:"uploaded_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreCollection struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
Slug string `json:"slug"`
|
|
Name string `json:"name"`
|
|
Description *string `json:"description"`
|
|
Schema []byte `json:"schema"`
|
|
CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
UpdatedAt pgtype.Timestamptz `json:"updated_at"`
|
|
}
|
|
|
|
type CoreComponent struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
Name string `json:"name"`
|
|
Kind string `json:"kind"`
|
|
Meta []byte `json:"meta"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreDbConnection struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
Name string `json:"name"`
|
|
DbType string `json:"db_type"`
|
|
Config []byte `json:"config"`
|
|
IsManaged bool `json:"is_managed"`
|
|
CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
UpdatedAt pgtype.Timestamptz `json:"updated_at"`
|
|
}
|
|
|
|
type CoreDocument struct {
|
|
ID uuid.UUID `json:"id"`
|
|
CollectionID uuid.UUID `json:"collection_id"`
|
|
Data []byte `json:"data"`
|
|
CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
UpdatedAt pgtype.Timestamptz `json:"updated_at"`
|
|
}
|
|
|
|
type CoreEvent struct {
|
|
ID int64 `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
ComponentID pgtype.UUID `json:"component_id"`
|
|
Type string `json:"type"`
|
|
Severity string `json:"severity"`
|
|
Message string `json:"message"`
|
|
Payload []byte `json:"payload"`
|
|
Fingerprint string `json:"fingerprint"`
|
|
Ts pgtype.Timestamptz `json:"ts"`
|
|
}
|
|
|
|
type CoreIntegration struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
Type string `json:"type"`
|
|
Name string `json:"name"`
|
|
BaseUrl string `json:"base_url"`
|
|
Config []byte `json:"config"`
|
|
Credentials []byte `json:"credentials"`
|
|
Status string `json:"status"`
|
|
LastHealthAt pgtype.Timestamptz `json:"last_health_at"`
|
|
CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
UpdatedAt pgtype.Timestamptz `json:"updated_at"`
|
|
}
|
|
|
|
type CoreOrganization struct {
|
|
ID uuid.UUID `json:"id"`
|
|
Slug string `json:"slug"`
|
|
Name string `json:"name"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreOrganizationMember struct {
|
|
ID uuid.UUID `json:"id"`
|
|
OrganizationID uuid.UUID `json:"organization_id"`
|
|
UserID uuid.UUID `json:"user_id"`
|
|
Role string `json:"role"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreProject struct {
|
|
ID uuid.UUID `json:"id"`
|
|
OrganizationID uuid.UUID `json:"organization_id"`
|
|
Slug string `json:"slug"`
|
|
Name string `json:"name"`
|
|
Description *string `json:"description"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
RetentionEventsDays int32 `json:"retention_events_days"`
|
|
RetentionAuditDays int32 `json:"retention_audit_days"`
|
|
RetentionWebhookDays int32 `json:"retention_webhook_days"`
|
|
}
|
|
|
|
type CoreProjectInvitation struct {
|
|
ID uuid.UUID `json:"id"`
|
|
OrganizationID uuid.UUID `json:"organization_id"`
|
|
ProjectID pgtype.UUID `json:"project_id"`
|
|
Email string `json:"email"`
|
|
OrgRole string `json:"org_role"`
|
|
ProjectRole NullCoreProjectRole `json:"project_role"`
|
|
TokenHash string `json:"token_hash"`
|
|
ExpiresAt pgtype.Timestamptz `json:"expires_at"`
|
|
AcceptedAt pgtype.Timestamptz `json:"accepted_at"`
|
|
InvitedByUserID pgtype.UUID `json:"invited_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreProjectMember struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
UserID uuid.UUID `json:"user_id"`
|
|
Role string `json:"role"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|
|
|
|
type CoreUser struct {
|
|
ID uuid.UUID `json:"id"`
|
|
AuthSubject string `json:"auth_subject"`
|
|
Email string `json:"email"`
|
|
Name string `json:"name"`
|
|
EmailVerified bool `json:"email_verified"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
UpdatedAt pgtype.Timestamptz `json:"updated_at"`
|
|
LastSeenAt pgtype.Timestamptz `json:"last_seen_at"`
|
|
}
|
|
|
|
type CoreWebhook struct {
|
|
ID uuid.UUID `json:"id"`
|
|
ProjectID uuid.UUID `json:"project_id"`
|
|
Url string `json:"url"`
|
|
Secret []byte `json:"secret"`
|
|
Events []string `json:"events"`
|
|
Enabled bool `json:"enabled"`
|
|
CreatedByUserID pgtype.UUID `json:"created_by_user_id"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
UpdatedAt pgtype.Timestamptz `json:"updated_at"`
|
|
}
|
|
|
|
type CoreWebhookDelivery struct {
|
|
ID uuid.UUID `json:"id"`
|
|
WebhookID uuid.UUID `json:"webhook_id"`
|
|
EventType string `json:"event_type"`
|
|
Payload []byte `json:"payload"`
|
|
Status string `json:"status"`
|
|
Attempts int32 `json:"attempts"`
|
|
LastStatusCode *int32 `json:"last_status_code"`
|
|
LastError string `json:"last_error"`
|
|
DeliveredAt pgtype.Timestamptz `json:"delivered_at"`
|
|
NextRetryAt pgtype.Timestamptz `json:"next_retry_at"`
|
|
CreatedAt pgtype.Timestamptz `json:"created_at"`
|
|
}
|