Implements the full host ↔ control plane connection flow:
- Host CRUD endpoints (POST/GET/DELETE /v1/hosts) with role-based access:
regular hosts admin-only, BYOC hosts for admins and team owners
- One-time registration token flow: admin creates host → gets token (1hr TTL
in Redis + Postgres audit trail) → host agent registers with specs → gets
long-lived JWT (1yr)
- Host agent registration client with automatic spec detection (arch, CPU,
memory, disk) and token persistence to disk
- Periodic heartbeat (30s) via POST /v1/hosts/{id}/heartbeat with X-Host-Token
auth and host ID cross-check
- Token regeneration endpoint (POST /v1/hosts/{id}/token) for retry after
failed registration
- Tag management (add/remove/list) with team-scoped access control
- Host JWT with typ:"host" claim, cross-use prevention in both VerifyJWT and
VerifyHostJWT
- requireHostToken middleware for host agent authentication
- DB-level race protection: RegisterHost uses AND status='pending' with
rows-affected check; Redis GetDel for atomic token consume
- Migration for future mTLS support (cert_fingerprint, mtls_enabled columns)
- Host agent flags: --register (one-time token), --address (required ip:port)
- serviceErrToHTTP extended with "forbidden" → 403 mapping
- OpenAPI spec, .env.example, and README updated
156 lines
3.4 KiB
Go
156 lines
3.4 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.30.0
|
|
// source: teams.sql
|
|
|
|
package db
|
|
|
|
import (
|
|
"context"
|
|
)
|
|
|
|
const getBYOCTeams = `-- name: GetBYOCTeams :many
|
|
SELECT id, name, created_at, is_byoc FROM teams WHERE is_byoc = TRUE ORDER BY created_at
|
|
`
|
|
|
|
func (q *Queries) GetBYOCTeams(ctx context.Context) ([]Team, error) {
|
|
rows, err := q.db.Query(ctx, getBYOCTeams)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var items []Team
|
|
for rows.Next() {
|
|
var i Team
|
|
if err := rows.Scan(
|
|
&i.ID,
|
|
&i.Name,
|
|
&i.CreatedAt,
|
|
&i.IsByoc,
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
items = append(items, i)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return items, nil
|
|
}
|
|
|
|
const getDefaultTeamForUser = `-- name: GetDefaultTeamForUser :one
|
|
SELECT t.id, t.name, t.created_at, t.is_byoc FROM teams t
|
|
JOIN users_teams ut ON ut.team_id = t.id
|
|
WHERE ut.user_id = $1 AND ut.is_default = TRUE
|
|
LIMIT 1
|
|
`
|
|
|
|
func (q *Queries) GetDefaultTeamForUser(ctx context.Context, userID string) (Team, error) {
|
|
row := q.db.QueryRow(ctx, getDefaultTeamForUser, userID)
|
|
var i Team
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.Name,
|
|
&i.CreatedAt,
|
|
&i.IsByoc,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const getTeam = `-- name: GetTeam :one
|
|
SELECT id, name, created_at, is_byoc FROM teams WHERE id = $1
|
|
`
|
|
|
|
func (q *Queries) GetTeam(ctx context.Context, id string) (Team, error) {
|
|
row := q.db.QueryRow(ctx, getTeam, id)
|
|
var i Team
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.Name,
|
|
&i.CreatedAt,
|
|
&i.IsByoc,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const getTeamMembership = `-- name: GetTeamMembership :one
|
|
SELECT user_id, team_id, is_default, role, created_at FROM users_teams WHERE user_id = $1 AND team_id = $2
|
|
`
|
|
|
|
type GetTeamMembershipParams struct {
|
|
UserID string `json:"user_id"`
|
|
TeamID string `json:"team_id"`
|
|
}
|
|
|
|
func (q *Queries) GetTeamMembership(ctx context.Context, arg GetTeamMembershipParams) (UsersTeam, error) {
|
|
row := q.db.QueryRow(ctx, getTeamMembership, arg.UserID, arg.TeamID)
|
|
var i UsersTeam
|
|
err := row.Scan(
|
|
&i.UserID,
|
|
&i.TeamID,
|
|
&i.IsDefault,
|
|
&i.Role,
|
|
&i.CreatedAt,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const insertTeam = `-- name: InsertTeam :one
|
|
INSERT INTO teams (id, name)
|
|
VALUES ($1, $2)
|
|
RETURNING id, name, created_at, is_byoc
|
|
`
|
|
|
|
type InsertTeamParams struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
}
|
|
|
|
func (q *Queries) InsertTeam(ctx context.Context, arg InsertTeamParams) (Team, error) {
|
|
row := q.db.QueryRow(ctx, insertTeam, arg.ID, arg.Name)
|
|
var i Team
|
|
err := row.Scan(
|
|
&i.ID,
|
|
&i.Name,
|
|
&i.CreatedAt,
|
|
&i.IsByoc,
|
|
)
|
|
return i, err
|
|
}
|
|
|
|
const insertTeamMember = `-- name: InsertTeamMember :exec
|
|
INSERT INTO users_teams (user_id, team_id, is_default, role)
|
|
VALUES ($1, $2, $3, $4)
|
|
`
|
|
|
|
type InsertTeamMemberParams struct {
|
|
UserID string `json:"user_id"`
|
|
TeamID string `json:"team_id"`
|
|
IsDefault bool `json:"is_default"`
|
|
Role string `json:"role"`
|
|
}
|
|
|
|
func (q *Queries) InsertTeamMember(ctx context.Context, arg InsertTeamMemberParams) error {
|
|
_, err := q.db.Exec(ctx, insertTeamMember,
|
|
arg.UserID,
|
|
arg.TeamID,
|
|
arg.IsDefault,
|
|
arg.Role,
|
|
)
|
|
return err
|
|
}
|
|
|
|
const setTeamBYOC = `-- name: SetTeamBYOC :exec
|
|
UPDATE teams SET is_byoc = $2 WHERE id = $1
|
|
`
|
|
|
|
type SetTeamBYOCParams struct {
|
|
ID string `json:"id"`
|
|
IsByoc bool `json:"is_byoc"`
|
|
}
|
|
|
|
func (q *Queries) SetTeamBYOC(ctx context.Context, arg SetTeamBYOCParams) error {
|
|
_, err := q.db.Exec(ctx, setTeamBYOC, arg.ID, arg.IsByoc)
|
|
return err
|
|
}
|