keyhan
22359be40e
Close billing, tenancy, migration, build, and CI/CD gaps identified in the audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with base schema, stateful service stability, safer Dockerfiles/git builds, and platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off). Co-authored-by: Cursor <cursoragent@cursor.com>
45 lines
1.5 KiB
SQL
45 lines
1.5 KiB
SQL
-- Temporary external access grants (Redis, RabbitMQ, database)
|
|
DO $$ BEGIN
|
|
CREATE TYPE service_access_target AS ENUM (
|
|
'database',
|
|
'redis',
|
|
'rabbitmq_amqp',
|
|
'rabbitmq_management'
|
|
);
|
|
EXCEPTION WHEN duplicate_object THEN null; END $$;
|
|
|
|
DO $$ BEGIN
|
|
CREATE TYPE service_access_grant_status AS ENUM (
|
|
'active',
|
|
'expired',
|
|
'revoked'
|
|
);
|
|
EXCEPTION WHEN duplicate_object THEN null; END $$;
|
|
|
|
CREATE TABLE IF NOT EXISTS service_access_grants (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
"applicationId" UUID NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
|
|
"userId" UUID NOT NULL,
|
|
"clusterId" UUID NOT NULL,
|
|
namespace VARCHAR(255) NOT NULL,
|
|
target service_access_target NOT NULL,
|
|
"nodePort" INTEGER NOT NULL,
|
|
"targetPort" INTEGER NOT NULL,
|
|
host VARCHAR(255) NOT NULL,
|
|
"k8sServiceName" VARCHAR(255) NOT NULL,
|
|
status service_access_grant_status NOT NULL DEFAULT 'active',
|
|
"expiresAt" TIMESTAMPTZ NOT NULL,
|
|
"createdAt" TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_service_access_grants_app_target_status
|
|
ON service_access_grants ("applicationId", target, status);
|
|
|
|
INSERT INTO platform_settings (id, key, value, description, "createdAt", "updatedAt")
|
|
SELECT gen_random_uuid(), 'access_max_duration_minutes', '240',
|
|
'Maximum duration (minutes) for temporary external service access',
|
|
NOW(), NOW()
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM platform_settings WHERE key = 'access_max_duration_minutes'
|
|
);
|