improvements: final feedback and ssl enforcement

backend/src/db/migrations/20250324142105_secret-rotation-v2.ts

@@ -28,6 +28,7 @@ export async function up(knex: Knex): Promise<void> {
       t.binary("encryptedLastRotationMessage"); // we encrypt this because it may contain sensitive info (SQL errors showing credentials)
       t.string("lastRotationJobId");
       t.datetime("nextRotationAt");
+      t.boolean("isLastRotationManual").notNullable().defaultTo(true); // creation is considered a "manual" rotation
     });
 
     await createOnUpdateTrigger(knex, TableName.SecretRotationV2);

backend/src/db/schemas/organizations.ts

@@ -23,10 +23,10 @@ export const OrganizationsSchema = z.object({
   defaultMembershipRole: z.string().default("member"),
   enforceMfa: z.boolean().default(false),
   selectedMfaMethod: z.string().nullable().optional(),
+  allowSecretSharingOutsideOrganization: z.boolean().default(true).nullable().optional(),
   shouldUseNewPrivilegeSystem: z.boolean().default(true),
   privilegeUpgradeInitiatedByUsername: z.string().nullable().optional(),
-  privilegeUpgradeInitiatedAt: z.date().nullable().optional(),
-  allowSecretSharingOutsideOrganization: z.boolean().default(true).nullable().optional()
+  privilegeUpgradeInitiatedAt: z.date().nullable().optional()
 });
 
 export type TOrganizations = z.infer<typeof OrganizationsSchema>;

backend/src/db/schemas/secret-rotations-v2.ts

@@ -30,7 +30,8 @@ export const SecretRotationsV2Schema = z.object({
   lastRotatedAt: z.date(),
   encryptedLastRotationMessage: zodBuffer.nullable().optional(),
   lastRotationJobId: z.string().nullable().optional(),
-  nextRotationAt: z.date().nullable().optional()
+  nextRotationAt: z.date().nullable().optional(),
+  isLastRotationManual: z.boolean().default(true)
 });
 
 export type TSecretRotationsV2 = z.infer<typeof SecretRotationsV2Schema>;