v0.0.1 (#8)

Co-authored-by: Tasnim Kabir Sadik <tksadik92@gmail.com>
Reviewed-on: wrenn/sandbox#8

db/queries/audit.sql

@@ -0,0 +1,14 @@
+-- name: InsertAuditLog :exec
+INSERT INTO audit_logs (id, team_id, actor_type, actor_id, actor_name, resource_type, resource_id, action, scope, status, metadata)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11);
+
+-- name: ListAuditLogs :many
+SELECT * FROM audit_logs
+WHERE team_id = $1
+  AND scope = ANY($2::text[])
+  AND (cardinality($3::text[]) = 0 OR resource_type = ANY($3::text[]))
+  AND (cardinality($4::text[]) = 0 OR action = ANY($4::text[]))
+  AND ($5::timestamptz IS NULL OR created_at < $5
+       OR (created_at = $5 AND id < $6))
+ORDER BY created_at DESC, id DESC
+LIMIT $7;

db/queries/channels.sql

@@ -0,0 +1,29 @@
+-- name: InsertChannel :one
+INSERT INTO channels (id, team_id, name, provider, config, event_types)
+VALUES ($1, $2, $3, $4, $5, $6)
+RETURNING *;
+
+-- name: ListChannelsByTeam :many
+SELECT * FROM channels WHERE team_id = $1 ORDER BY created_at DESC;
+
+-- name: GetChannelByTeam :one
+SELECT * FROM channels WHERE id = $1 AND team_id = $2;
+
+-- name: UpdateChannel :one
+UPDATE channels SET name = $3, event_types = $4, updated_at = NOW()
+WHERE id = $1 AND team_id = $2
+RETURNING *;
+
+-- name: UpdateChannelConfig :one
+UPDATE channels SET config = $3, updated_at = NOW()
+WHERE id = $1 AND team_id = $2
+RETURNING *;
+
+-- name: DeleteChannelByTeam :exec
+DELETE FROM channels WHERE id = $1 AND team_id = $2;
+
+-- name: ListChannelsForEvent :many
+SELECT * FROM channels
+WHERE team_id = $1
+  AND sqlc.arg(event_type)::text = ANY(event_types)
+ORDER BY created_at;

db/queries/host_refresh_tokens.sql

@@ -0,0 +1,19 @@
+-- name: InsertHostRefreshToken :one
+INSERT INTO host_refresh_tokens (id, host_id, token_hash, expires_at)
+VALUES ($1, $2, $3, $4)
+RETURNING *;
+
+-- name: GetHostRefreshTokenByHash :one
+SELECT * FROM host_refresh_tokens
+WHERE token_hash = $1 AND revoked_at IS NULL AND expires_at > NOW();
+
+-- name: RevokeHostRefreshToken :exec
+UPDATE host_refresh_tokens SET revoked_at = NOW() WHERE id = $1;
+
+-- name: RevokeHostRefreshTokensByHost :exec
+UPDATE host_refresh_tokens SET revoked_at = NOW()
+WHERE host_id = $1 AND revoked_at IS NULL;
+
+-- name: DeleteExpiredHostRefreshTokens :exec
+DELETE FROM host_refresh_tokens
+WHERE expires_at < NOW() OR revoked_at IS NOT NULL;

db/queries/hosts.sql

@@ -20,16 +20,25 @@ SELECT * FROM hosts WHERE status = $1 ORDER BY created_at DESC;
 
 -- name: RegisterHost :execrows
 UPDATE hosts
-SET arch = $2,
-    cpu_cores = $3,
-    memory_mb = $4,
-    disk_gb = $5,
-    address = $6,
-    status = 'online',
+SET arch             = $2,
+    cpu_cores        = $3,
+    memory_mb        = $4,
+    disk_gb          = $5,
+    address          = $6,
+    cert_fingerprint = $7,
+    cert_expires_at  = $8,
+    status           = 'online',
     last_heartbeat_at = NOW(),
-    updated_at = NOW()
+    updated_at        = NOW()
 WHERE id = $1 AND status = 'pending';
 
+-- name: UpdateHostCert :exec
+UPDATE hosts
+SET cert_fingerprint = $2,
+    cert_expires_at  = $3,
+    updated_at       = NOW()
+WHERE id = $1;
+
 -- name: UpdateHostStatus :exec
 UPDATE hosts SET status = $2, updated_at = NOW() WHERE id = $1;
 
@@ -67,3 +76,19 @@ SELECT * FROM host_tokens WHERE host_id = $1 ORDER BY created_at DESC;
 
 -- name: GetHostByTeam :one
 SELECT * FROM hosts WHERE id = $1 AND team_id = $2;
+
+-- name: ListActiveHosts :many
+-- Returns all hosts that have completed registration (not pending/offline).
+SELECT * FROM hosts WHERE status NOT IN ('pending', 'offline') ORDER BY created_at;
+
+-- name: UpdateHostHeartbeatAndStatus :execrows
+-- Updates last_heartbeat_at and transitions unreachable hosts back to online.
+-- Returns 0 if no host was found (deleted), which the caller treats as 404.
+UPDATE hosts
+SET last_heartbeat_at = NOW(),
+    status            = CASE WHEN status = 'unreachable' THEN 'online' ELSE status END,
+    updated_at        = NOW()
+WHERE id = $1;
+
+-- name: MarkHostUnreachable :exec
+UPDATE hosts SET status = 'unreachable', updated_at = NOW() WHERE id = $1;

db/queries/metrics.sql

@@ -0,0 +1,68 @@
+-- name: InsertMetricsSnapshot :exec
+INSERT INTO sandbox_metrics_snapshots (team_id, running_count, vcpus_reserved, memory_mb_reserved)
+VALUES ($1, $2, $3, $4);
+
+-- name: GetLiveMetrics :one
+-- Reads directly from sandboxes for accurate real-time current values.
+-- CPU reserved = running + starting only (paused VMs release CPU).
+-- RAM reserved = running + starting + sum(ceil(each_paused/2)) (per-VM ceiling).
+SELECT
+    (COUNT(*) FILTER (WHERE status IN ('running', 'starting')))::INTEGER                                              AS running_count,
+    (COALESCE(SUM(vcpus)     FILTER (WHERE status IN ('running', 'starting')), 0))::INTEGER                          AS vcpus_reserved,
+    (COALESCE(SUM(memory_mb) FILTER (WHERE status IN ('running', 'starting')), 0)
+     + COALESCE(SUM(CEIL(memory_mb::NUMERIC / 2)) FILTER (WHERE status = 'paused'), 0))::INTEGER                     AS memory_mb_reserved
+FROM sandboxes
+WHERE team_id = $1;
+
+-- name: GetPeakMetrics :one
+SELECT
+    COALESCE(MAX(running_count), 0)::INTEGER      AS peak_running_count,
+    COALESCE(MAX(vcpus_reserved), 0)::INTEGER     AS peak_vcpus,
+    COALESCE(MAX(memory_mb_reserved), 0)::INTEGER AS peak_memory_mb
+FROM sandbox_metrics_snapshots
+WHERE team_id = $1
+  AND sampled_at > NOW() - INTERVAL '30 days';
+
+-- name: PruneOldMetrics :exec
+DELETE FROM sandbox_metrics_snapshots
+WHERE sampled_at < NOW() - INTERVAL '60 days';
+
+-- name: InsertSandboxMetricPoint :exec
+INSERT INTO sandbox_metric_points (sandbox_id, tier, ts, cpu_pct, mem_bytes, disk_bytes)
+VALUES ($1, $2, $3, $4, $5, $6)
+ON CONFLICT (sandbox_id, tier, ts) DO NOTHING;
+
+-- name: GetSandboxMetricPoints :many
+SELECT ts, cpu_pct, mem_bytes, disk_bytes
+FROM sandbox_metric_points
+WHERE sandbox_id = $1 AND tier = $2 AND ts >= $3
+ORDER BY ts ASC;
+
+-- name: DeleteSandboxMetricPoints :exec
+DELETE FROM sandbox_metric_points
+WHERE sandbox_id = $1;
+
+-- name: DeleteSandboxMetricPointsByTier :exec
+DELETE FROM sandbox_metric_points
+WHERE sandbox_id = $1 AND tier = $2;
+
+-- name: PruneSandboxMetricPoints :exec
+-- Remove metric points older than 30 days for destroyed sandboxes.
+DELETE FROM sandbox_metric_points
+WHERE ts < EXTRACT(EPOCH FROM NOW() - INTERVAL '30 days')::BIGINT;
+
+-- name: SampleSandboxMetrics :many
+-- Aggregates per-team resource usage from the live sandboxes table.
+-- Groups by all teams that have any sandbox row (including stopped) so that
+-- zero-value snapshots are recorded when all capsules are stopped, keeping the
+-- time-series charts continuous rather than trailing off into empty space.
+-- CPU reserved = running + starting only (paused VMs release CPU).
+-- RAM reserved = running + starting + sum(ceil(each_paused/2)) (per-VM ceiling).
+SELECT
+    team_id,
+    (COUNT(*) FILTER (WHERE status IN ('running', 'starting')))::INTEGER                                              AS running_count,
+    (COALESCE(SUM(vcpus)     FILTER (WHERE status IN ('running', 'starting')), 0))::INTEGER                          AS vcpus_reserved,
+    (COALESCE(SUM(memory_mb) FILTER (WHERE status IN ('running', 'starting')), 0)
+     + COALESCE(SUM(CEIL(memory_mb::NUMERIC / 2)) FILTER (WHERE status = 'paused'), 0))::INTEGER                     AS memory_mb_reserved
+FROM sandboxes
+GROUP BY team_id;

db/queries/sandboxes.sql

@@ -1,6 +1,6 @@
 -- name: InsertSandbox :one
-INSERT INTO sandboxes (id, team_id, host_id, template, status, vcpus, memory_mb, timeout_sec)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+INSERT INTO sandboxes (id, team_id, host_id, template, status, vcpus, memory_mb, timeout_sec, disk_size_mb, template_id, template_team_id)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
 RETURNING *;
 
 -- name: GetSandbox :one
@@ -9,6 +9,14 @@ SELECT * FROM sandboxes WHERE id = $1;
 -- name: GetSandboxByTeam :one
 SELECT * FROM sandboxes WHERE id = $1 AND team_id = $2;
 
+-- name: GetSandboxProxyTarget :one
+-- Returns the sandbox status and its host's address in one query.
+-- Used by SandboxProxyWrapper to avoid two round-trips.
+SELECT s.status, h.address AS host_address
+FROM sandboxes s
+JOIN hosts h ON h.id = s.host_id
+WHERE s.id = $1 AND s.team_id = $2;
+
 -- name: ListSandboxes :many
 SELECT * FROM sandboxes ORDER BY created_at DESC;
 
@@ -50,4 +58,26 @@ WHERE id = $1;
 UPDATE sandboxes
 SET status = $2,
     last_updated = NOW()
-WHERE id = ANY($1::text[]);
+WHERE id = ANY($1::uuid[]);
+
+-- name: ListActiveSandboxesByTeam :many
+SELECT * FROM sandboxes
+WHERE team_id = $1 AND status IN ('running', 'paused', 'starting')
+ORDER BY created_at DESC;
+
+-- name: MarkSandboxesMissingByHost :exec
+-- Called when the host monitor marks a host unreachable.
+-- Marks running/starting/pending sandboxes on that host as 'missing' so users see
+-- the sandbox is not currently reachable, without permanently losing the record.
+UPDATE sandboxes
+SET status       = 'missing',
+    last_updated = NOW()
+WHERE host_id = $1 AND status IN ('running', 'starting', 'pending');
+
+-- name: BulkRestoreRunning :exec
+-- Called by the reconciler when a host comes back online and its sandboxes are
+-- confirmed alive. Restores only sandboxes that are in 'missing' state.
+UPDATE sandboxes
+SET status       = 'running',
+    last_updated = NOW()
+WHERE id = ANY($1::uuid[]) AND status = 'missing';

db/queries/teams.sql

@@ -1,6 +1,6 @@
 -- name: InsertTeam :one
-INSERT INTO teams (id, name)
-VALUES ($1, $2)
+INSERT INTO teams (id, name, slug)
+VALUES ($1, $2, $3)
 RETURNING *;
 
 -- name: GetTeam :one
@@ -13,14 +13,43 @@ VALUES ($1, $2, $3, $4);
 -- name: GetDefaultTeamForUser :one
 SELECT t.* FROM teams t
 JOIN users_teams ut ON ut.team_id = t.id
-WHERE ut.user_id = $1 AND ut.is_default = TRUE
+WHERE ut.user_id = $1 AND ut.is_default = TRUE AND t.deleted_at IS NULL
 LIMIT 1;
 
 -- name: SetTeamBYOC :exec
 UPDATE teams SET is_byoc = $2 WHERE id = $1;
 
 -- name: GetBYOCTeams :many
-SELECT * FROM teams WHERE is_byoc = TRUE ORDER BY created_at;
+SELECT * FROM teams WHERE is_byoc = TRUE AND deleted_at IS NULL ORDER BY created_at;
 
 -- name: GetTeamMembership :one
 SELECT * FROM users_teams WHERE user_id = $1 AND team_id = $2;
+
+-- name: UpdateTeamName :exec
+UPDATE teams SET name = $2 WHERE id = $1 AND deleted_at IS NULL;
+
+-- name: SoftDeleteTeam :exec
+UPDATE teams SET deleted_at = NOW() WHERE id = $1;
+
+-- name: GetTeamBySlug :one
+SELECT * FROM teams WHERE slug = $1 AND deleted_at IS NULL;
+
+-- name: GetTeamsForUser :many
+SELECT t.id, t.name, t.slug, t.is_byoc, t.created_at, t.deleted_at, ut.role
+FROM teams t
+JOIN users_teams ut ON ut.team_id = t.id
+WHERE ut.user_id = $1 AND t.deleted_at IS NULL
+ORDER BY ut.created_at;
+
+-- name: GetTeamMembers :many
+SELECT u.id, u.name, u.email, ut.role, ut.created_at AS joined_at
+FROM users_teams ut
+JOIN users u ON u.id = ut.user_id
+WHERE ut.team_id = $1
+ORDER BY ut.created_at;
+
+-- name: UpdateMemberRole :exec
+UPDATE users_teams SET role = $3 WHERE team_id = $1 AND user_id = $2;
+
+-- name: DeleteTeamMember :exec
+DELETE FROM users_teams WHERE team_id = $1 AND user_id = $2;

db/queries/template_builds.sql

@@ -0,0 +1,33 @@
+-- name: InsertTemplateBuild :one
+INSERT INTO template_builds (id, name, base_template, recipe, healthcheck, vcpus, memory_mb, status, total_steps, template_id, team_id, skip_pre_post)
+VALUES ($1, $2, $3, $4, $5, $6, $7, 'pending', $8, $9, $10, $11)
+RETURNING *;
+
+-- name: GetTemplateBuild :one
+SELECT * FROM template_builds WHERE id = $1;
+
+-- name: ListTemplateBuilds :many
+SELECT * FROM template_builds ORDER BY created_at DESC;
+
+-- name: UpdateBuildStatus :one
+UPDATE template_builds
+SET status = $2,
+    started_at   = CASE WHEN $2 = 'running'   AND started_at   IS NULL THEN NOW() ELSE started_at   END,
+    completed_at = CASE WHEN $2 IN ('success', 'failed', 'cancelled') THEN NOW() ELSE completed_at END
+WHERE id = $1
+RETURNING *;
+
+-- name: UpdateBuildProgress :exec
+UPDATE template_builds
+SET current_step = $2, logs = $3
+WHERE id = $1;
+
+-- name: UpdateBuildSandbox :exec
+UPDATE template_builds
+SET sandbox_id = $2, host_id = $3
+WHERE id = $1;
+
+-- name: UpdateBuildError :exec
+UPDATE template_builds
+SET error = $2, status = 'failed', completed_at = NOW()
+WHERE id = $1;

db/queries/templates.sql

@@ -1,13 +1,22 @@
 -- name: InsertTemplate :one
-INSERT INTO templates (name, type, vcpus, memory_mb, size_bytes, team_id)
-VALUES ($1, $2, $3, $4, $5, $6)
+INSERT INTO templates (id, name, type, vcpus, memory_mb, size_bytes, team_id)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
 RETURNING *;
 
 -- name: GetTemplate :one
-SELECT * FROM templates WHERE name = $1;
+SELECT * FROM templates WHERE id = $1;
 
 -- name: GetTemplateByTeam :one
-SELECT * FROM templates WHERE name = $1 AND team_id = $2;
+-- Platform templates (team_id = 00000000-...) are visible to all teams.
+SELECT * FROM templates WHERE name = $1 AND (team_id = $2 OR team_id = '00000000-0000-0000-0000-000000000000');
+
+-- name: GetTemplateByName :one
+-- Look up a template by team_id and name (exact team match, no global fallback).
+SELECT * FROM templates WHERE team_id = $1 AND name = $2;
+
+-- name: GetPlatformTemplateByName :one
+-- Check if a global (platform) template exists with the given name.
+SELECT * FROM templates WHERE team_id = '00000000-0000-0000-0000-000000000000' AND name = $1;
 
 -- name: ListTemplates :many
 SELECT * FROM templates ORDER BY created_at DESC;
@@ -16,13 +25,23 @@ SELECT * FROM templates ORDER BY created_at DESC;
 SELECT * FROM templates WHERE type = $1 ORDER BY created_at DESC;
 
 -- name: ListTemplatesByTeam :many
-SELECT * FROM templates WHERE team_id = $1 ORDER BY created_at DESC;
+-- Platform templates are visible to all teams.
+SELECT * FROM templates WHERE (team_id = $1 OR team_id = '00000000-0000-0000-0000-000000000000') ORDER BY created_at DESC;
 
 -- name: ListTemplatesByTeamAndType :many
-SELECT * FROM templates WHERE team_id = $1 AND type = $2 ORDER BY created_at DESC;
+-- Platform templates are visible to all teams.
+SELECT * FROM templates WHERE (team_id = $1 OR team_id = '00000000-0000-0000-0000-000000000000') AND type = $2 ORDER BY created_at DESC;
 
 -- name: DeleteTemplate :exec
-DELETE FROM templates WHERE name = $1;
+DELETE FROM templates WHERE id = $1;
 
 -- name: DeleteTemplateByTeam :exec
 DELETE FROM templates WHERE name = $1 AND team_id = $2;
+
+-- name: DeleteTemplatesByTeam :exec
+-- Bulk delete all templates owned by a team (for team soft-delete cleanup).
+DELETE FROM templates WHERE team_id = $1;
+
+-- name: ListTemplatesByTeamOnly :many
+-- List templates owned by a specific team (NOT including platform templates).
+SELECT * FROM templates WHERE team_id = $1 ORDER BY created_at DESC;

db/queries/users.sql

@@ -1,6 +1,6 @@
 -- name: InsertUser :one
-INSERT INTO users (id, email, password_hash)
-VALUES ($1, $2, $3)
+INSERT INTO users (id, email, password_hash, name)
+VALUES ($1, $2, $3, $4)
 RETURNING *;
 
 -- name: GetUserByEmail :one
@@ -10,8 +10,8 @@ SELECT * FROM users WHERE email = $1;
 SELECT * FROM users WHERE id = $1;
 
 -- name: InsertUserOAuth :one
-INSERT INTO users (id, email)
-VALUES ($1, $2)
+INSERT INTO users (id, email, name)
+VALUES ($1, $2, $3)
 RETURNING *;
 
 -- name: SetUserAdmin :exec
@@ -34,3 +34,9 @@ SELECT * FROM admin_permissions WHERE user_id = $1 ORDER BY permission;
 SELECT EXISTS(
     SELECT 1 FROM admin_permissions WHERE user_id = $1 AND permission = $2
 ) AS has_permission;
+
+-- name: SearchUsersByEmailPrefix :many
+SELECT id, email FROM users WHERE email LIKE $1 || '%' ORDER BY email LIMIT 10;
+
+-- name: UpdateUserName :exec
+UPDATE users SET name = $2, updated_at = NOW() WHERE id = $1;