pptx704
2c66959b92
Implements the full host ↔ control plane connection flow:
- Host CRUD endpoints (POST/GET/DELETE /v1/hosts) with role-based access:
regular hosts admin-only, BYOC hosts for admins and team owners
- One-time registration token flow: admin creates host → gets token (1hr TTL
in Redis + Postgres audit trail) → host agent registers with specs → gets
long-lived JWT (1yr)
- Host agent registration client with automatic spec detection (arch, CPU,
memory, disk) and token persistence to disk
- Periodic heartbeat (30s) via POST /v1/hosts/{id}/heartbeat with X-Host-Token
auth and host ID cross-check
- Token regeneration endpoint (POST /v1/hosts/{id}/token) for retry after
failed registration
- Tag management (add/remove/list) with team-scoped access control
- Host JWT with typ:"host" claim, cross-use prevention in both VerifyJWT and
VerifyHostJWT
- requireHostToken middleware for host agent authentication
- DB-level race protection: RegisterHost uses AND status='pending' with
rows-affected check; Redis GetDel for atomic token consume
- Migration for future mTLS support (cert_fingerprint, mtls_enabled columns)
- Host agent flags: --register (one-time token), --address (required ip:port)
- serviceErrToHTTP extended with "forbidden" → 403 mapping
- OpenAPI spec, .env.example, and README updated
27 lines
678 B
SQL
27 lines
678 B
SQL
-- name: InsertTeam :one
|
|
INSERT INTO teams (id, name)
|
|
VALUES ($1, $2)
|
|
RETURNING *;
|
|
|
|
-- name: GetTeam :one
|
|
SELECT * FROM teams WHERE id = $1;
|
|
|
|
-- name: InsertTeamMember :exec
|
|
INSERT INTO users_teams (user_id, team_id, is_default, role)
|
|
VALUES ($1, $2, $3, $4);
|
|
|
|
-- name: GetDefaultTeamForUser :one
|
|
SELECT t.* FROM teams t
|
|
JOIN users_teams ut ON ut.team_id = t.id
|
|
WHERE ut.user_id = $1 AND ut.is_default = TRUE
|
|
LIMIT 1;
|
|
|
|
-- name: SetTeamBYOC :exec
|
|
UPDATE teams SET is_byoc = $2 WHERE id = $1;
|
|
|
|
-- name: GetBYOCTeams :many
|
|
SELECT * FROM teams WHERE is_byoc = TRUE ORDER BY created_at;
|
|
|
|
-- name: GetTeamMembership :one
|
|
SELECT * FROM users_teams WHERE user_id = $1 AND team_id = $2;
|