Max Mayfield
eb953cdea5
Some checks failed
CI — P2 Drift (Go + Node) / agent (push) Successful in 43s
CI — P2 Drift (Go + Node) / saas (push) Failing after 5s
CI — P3 Alert / test (push) Failing after 4s
CI — P4 Portal / test (push) Failing after 4s
CI — P5 Cost / test (push) Failing after 4s
CI — P6 Run / saas (push) Failing after 5s
CI — P2 Drift (Go + Node) / build-push (push) Failing after 7s
CI — P3 Alert / build-push (push) Has been skipped
CI — P4 Portal / build-push (push) Has been skipped
CI — P5 Cost / build-push (push) Has been skipped
CI — P6 Run / build-push (push) Failing after 5s
Phase 1 (Security Critical):
- Auth plugin encapsulation: replaced global addHook with Fastify plugin scope
- Removed startsWith URL matching; public routes registered outside auth scope
- JWT verify now enforces algorithms: ['HS256'] (prevents algorithm confusion)
- Raw pool no longer exported from db.ts; systemQuery() + getPoolForAuth() instead
- withTenant() remains primary tenant-scoped query path
Phase 2 (Infrastructure):
- docker-compose.yml: all secrets via env var substitution (${VAR:-default})
- Per-service Postgres users (dd0c_drift, dd0c_alert, etc.) in docker-init-db.sh
- .env.example with all configurable secrets
- build-push.sh uses $REGISTRY_PASSWORD instead of hardcoded
- .gitignore excludes .env files
- @fastify/rate-limit: 100 req/min global, 5/min login, 3/min signup
- CORS_ORIGIN default changed from '*' to 'http://localhost:5173'
Phase 3 (Product):
- Team invite flow: tenant_invites table, POST /invite, GET /invites, DELETE /invites/:id
- Signup accepts optional invite_token to join existing tenant
- Async webhook ingestion (P3): LPUSH to Redis, BRPOP worker, dead-letter queue
Console:
- All 5 product modules wired: drift, alert, portal, cost, run
- PageHeader accepts children prop
- 71 modules, 70KB gzipped production build
All 6 projects compile clean (tsc --noEmit).
50 lines
2.0 KiB
Bash
Executable File
50 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
# Create per-product databases
|
|
for db in dd0c_route dd0c_drift dd0c_alert dd0c_portal dd0c_cost dd0c_run; do
|
|
echo "Creating database: $db"
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname postgres -c "CREATE DATABASE $db;" 2>/dev/null || true
|
|
done
|
|
|
|
# Create per-service DB users with least-privilege access
|
|
create_service_user() {
|
|
local db=$1
|
|
local user=$2
|
|
local pass_var=$3
|
|
local pass="${!pass_var:-dd0c-dev}"
|
|
echo "Creating user $user for $db"
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname postgres -c "CREATE USER $user WITH PASSWORD '$pass';" 2>/dev/null || true
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -c "GRANT ALL PRIVILEGES ON DATABASE $db TO $user;" 2>/dev/null || true
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -c "GRANT ALL ON SCHEMA public TO $user;" 2>/dev/null || true
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO $user;" 2>/dev/null || true
|
|
}
|
|
|
|
create_service_user dd0c_drift dd0c_drift DB_DRIFT_PASSWORD
|
|
create_service_user dd0c_alert dd0c_alert DB_ALERT_PASSWORD
|
|
create_service_user dd0c_portal dd0c_portal DB_PORTAL_PASSWORD
|
|
create_service_user dd0c_cost dd0c_cost DB_COST_PASSWORD
|
|
create_service_user dd0c_run dd0c_run DB_RUN_PASSWORD
|
|
|
|
# Run migrations for each product (as superuser so tables are created correctly)
|
|
run_migrations() {
|
|
local db=$1
|
|
local dir=$2
|
|
if [ -d "$dir" ]; then
|
|
for sql in "$dir"/*.sql; do
|
|
[ -f "$sql" ] || continue
|
|
echo " $db ← $(basename $sql)"
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -f "$sql" 2>/dev/null || true
|
|
done
|
|
fi
|
|
}
|
|
|
|
run_migrations dd0c_route /migrations/01-route
|
|
run_migrations dd0c_drift /migrations/02-drift
|
|
run_migrations dd0c_alert /migrations/03-alert
|
|
run_migrations dd0c_portal /migrations/04-portal
|
|
run_migrations dd0c_cost /migrations/05-cost
|
|
run_migrations dd0c_run /migrations/06-run
|
|
|
|
echo "All databases initialized."
|