feat: changed backend-pg to backend

backend/src/db/index.ts

@@ -0,0 +1,2 @@
+export type { TDbClient } from "./instance";
+export { initDbConnection } from "./instance";

backend/src/db/instance.ts

@@ -0,0 +1,12 @@
+
+import knex from "knex"
+
+export type TDbClient = ReturnType<typeof initDbConnection>;
+export const initDbConnection = (dbConnectionUri: string) => {
+  const db = knex({
+    client: "pg",
+    connection: dbConnectionUri
+  });
+
+  return db;
+};

backend/src/db/knexfile.ts

@@ -0,0 +1,39 @@
+// eslint-disable-next-line
+import "ts-node/register";
+
+import dotenv from "dotenv";
+import type { Knex } from "knex";
+import path from "path";
+
+// Update with your config settings.
+dotenv.config({
+  path: path.join(__dirname, "../../.env"),
+  debug: true
+});
+export default {
+  development: {
+    client: "postgres",
+    connection: process.env.DB_CONNECTION_URI,
+    pool: {
+      min: 2,
+      max: 10
+    },
+    seeds: {
+      directory: "./seeds"
+    },
+    migrations: {
+      tableName: "infisical_migrations"
+    }
+  },
+  production: {
+    client: "postgres",
+    connection: process.env.DB_CONNECTION_URI,
+    pool: {
+      min: 2,
+      max: 10
+    },
+    migrations: {
+      tableName: "infisical_migrations"
+    }
+  }
+} as Knex.Config;

backend/src/db/migrations/20231128072457_user.ts

@@ -0,0 +1,37 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import {
+  createOnUpdateTrigger,
+  createUpdateAtTriggerFunction,
+  dropOnUpdateTrigger,
+  dropUpdatedAtTriggerFunction
+} from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.Users);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.Users, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("email").unique().notNullable();
+      t.specificType("authMethods", "text[]");
+      t.boolean("superAdmin").defaultTo(false);
+      t.string("firstName");
+      t.string("lastName");
+      t.boolean("isAccepted").defaultTo(false);
+      t.boolean("isMfaEnabled").defaultTo(false);
+      t.specificType("mfaMethods", "text[]");
+      t.jsonb("devices");
+      t.timestamps(true, true, true);
+    });
+  }
+  // this is a one time function
+  await createUpdateAtTriggerFunction(knex);
+  await createOnUpdateTrigger(knex, TableName.Users);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Users);
+  await dropOnUpdateTrigger(knex, TableName.Users);
+  await dropUpdatedAtTriggerFunction(knex);
+}

backend/src/db/migrations/20231128092347_user-encryption-key.ts

@@ -0,0 +1,31 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.UserEncryptionKey);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.UserEncryptionKey, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("clientPublicKey");
+      t.text("serverPrivateKey");
+      t.integer("encryptionVersion").defaultTo(2);
+      t.text("protectedKey");
+      t.text("protectedKeyIV");
+      t.text("protectedKeyTag");
+      t.text("publicKey").notNullable();
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("iv").notNullable();
+      t.text("tag").notNullable();
+      t.text("salt").notNullable();
+      t.text("verifier").notNullable();
+      // one to one relationship
+      t.uuid("userId").notNullable().unique();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.UserEncryptionKey);
+}

backend/src/db/migrations/20231129072939_auth-token.ts

@@ -0,0 +1,25 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.AuthTokens);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.AuthTokens, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("type").notNullable();
+      t.string("phoneNumber");
+      t.string("tokenHash").notNullable();
+      t.integer("triesLeft");
+      t.datetime("expiresAt").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.AuthTokens);
+}

backend/src/db/migrations/20231130072734_auth-token-session.ts

@@ -0,0 +1,29 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.AuthTokenSession);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.AuthTokenSession, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("ip").notNullable();
+      t.string("userAgent");
+      t.integer("refreshVersion").notNullable().defaultTo(1);
+      t.integer("accessVersion").notNullable().defaultTo(1);
+      t.datetime("lastUsed").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.AuthTokenSession);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.AuthTokenSession);
+  await dropOnUpdateTrigger(knex, TableName.AuthTokenSession);
+}

backend/src/db/migrations/20231201151432_backup-key.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const doesTableExist = await knex.schema.hasTable(TableName.BackupPrivateKey);
+  if (!doesTableExist) {
+    await knex.schema.createTable(TableName.BackupPrivateKey, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("iv").notNullable();
+      t.text("tag").notNullable();
+      t.string("algorithm").notNullable();
+      t.string("keyEncoding").notNullable();
+      t.text("salt").notNullable();
+      t.text("verifier").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable().unique();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.BackupPrivateKey);
+}

backend/src/db/migrations/20231204092737_organization.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.Organization);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.Organization, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("customerId");
+      t.string("slug").notNullable();
+      // does not need update trigger we will do it manually
+      t.unique("slug");
+      t.timestamps(true, true, true);
+    });
+    await knex.schema.alterTable(TableName.AuthTokens, (t) => {
+      t.uuid("orgId");
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.Organization);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.AuthTokens, "orgId")) {
+    await knex.schema.alterTable(TableName.AuthTokens, (t) => {
+      t.dropColumn("orgId");
+    });
+  }
+  await knex.schema.dropTableIfExists(TableName.Organization);
+  await dropOnUpdateTrigger(knex, TableName.Organization);
+}

backend/src/db/migrations/20231204092747_org-membership.ts

@@ -0,0 +1,48 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { OrgMembershipStatus } from "../schemas/models";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isOrgRolePresent = await knex.schema.hasTable(TableName.OrgRoles);
+  if (!isOrgRolePresent) {
+    await knex.schema.createTable(TableName.OrgRoles, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("description");
+      t.string("slug").notNullable();
+      t.jsonb("permissions").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    });
+  }
+
+  const isOrgTablePresent = await knex.schema.hasTable(TableName.OrgMembership);
+  if (!isOrgTablePresent) {
+    await knex.schema.createTable(TableName.OrgMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      t.string("status").notNullable().defaultTo(OrgMembershipStatus.Invited);
+      t.string("inviteEmail");
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.OrgRoles);
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.OrgMembership);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.OrgMembership);
+  await knex.schema.dropTableIfExists(TableName.OrgRoles);
+  await dropOnUpdateTrigger(knex, TableName.OrgMembership);
+}

backend/src/db/migrations/20231205151331_incident-contact.ts

@@ -0,0 +1,25 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.IncidentContact);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.IncidentContact, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("email").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.IncidentContact);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IncidentContact);
+  await dropOnUpdateTrigger(knex, TableName.IncidentContact);
+}

backend/src/db/migrations/20231207055643_user-action.ts

@@ -0,0 +1,20 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.UserAction);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.UserAction, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("action").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.UserAction);
+}

backend/src/db/migrations/20231207055701_super-admin.ts

@@ -0,0 +1,23 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.SuperAdmin);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.SuperAdmin, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.boolean("initialized").defaultTo(false);
+      t.boolean("allowSignUp").defaultTo(true);
+      t.timestamps(true, true, true);
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.SuperAdmin);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SuperAdmin);
+  await dropOnUpdateTrigger(knex, TableName.SuperAdmin);
+}

backend/src/db/migrations/20231207105059_api-key.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.ApiKey);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.ApiKey, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.datetime("lastUsed");
+      t.datetime("expiresAt");
+      t.string("secretHash").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ApiKey);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ApiKey);
+  await dropOnUpdateTrigger(knex, TableName.ApiKey);
+}

backend/src/db/migrations/20231212110939_project.ts

@@ -0,0 +1,62 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Project))) {
+    await knex.schema.createTable(TableName.Project, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("slug").notNullable();
+      t.boolean("autoCapitalization").defaultTo(true);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+      t.unique(["orgId", "slug"]);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Project);
+  // environments
+  if (!(await knex.schema.hasTable(TableName.Environment))) {
+    await knex.schema.createTable(TableName.Environment, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("slug").notNullable();
+      t.integer("position").notNullable();
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      // this will ensure ever env has its position
+      t.unique(["projectId", "position"], {
+        indexName: "env_pos_composite_uniqe",
+        deferrable: "deferred"
+      });
+      t.timestamps(true, true, true);
+    });
+  }
+  // project key
+  if (!(await knex.schema.hasTable(TableName.ProjectKeys))) {
+    await knex.schema.createTable(TableName.ProjectKeys, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("encryptedKey").notNullable();
+      t.text("nonce").notNullable();
+      t.uuid("receiverId").notNullable();
+      t.foreign("receiverId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.uuid("senderId");
+      // if sender is deleted just don't do anything to this record
+      t.foreign("senderId").references("id").inTable(TableName.Users).onDelete("SET NULL");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ProjectKeys);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Environment);
+  await knex.schema.dropTableIfExists(TableName.ProjectKeys);
+  await knex.schema.dropTableIfExists(TableName.Project);
+  await dropOnUpdateTrigger(knex, TableName.ProjectKeys);
+  await dropOnUpdateTrigger(knex, TableName.Project);
+}

backend/src/db/migrations/20231212110946_project-membership.ts

@@ -0,0 +1,43 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.ProjectRoles))) {
+    await knex.schema.createTable(TableName.ProjectRoles, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("description");
+      t.string("slug").notNullable();
+      t.jsonb("permissions").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+
+  if (!(await knex.schema.hasTable(TableName.ProjectMembership))) {
+    await knex.schema.createTable(TableName.ProjectMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      // until role is changed/removed the role should not deleted
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.ProjectRoles);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ProjectMembership);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ProjectMembership);
+  await knex.schema.dropTableIfExists(TableName.ProjectRoles);
+  await dropOnUpdateTrigger(knex, TableName.ProjectMembership);
+}

backend/src/db/migrations/20231218092441_secret-folder.ts

@@ -0,0 +1,42 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretFolder))) {
+    await knex.schema.createTable(TableName.SecretFolder, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.integer("version").defaultTo(1);
+      t.timestamps(true, true, true);
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.uuid("parentId");
+      t.foreign("parentId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretFolder);
+
+  if (!(await knex.schema.hasTable(TableName.SecretFolderVersion))) {
+    await knex.schema.createTable(TableName.SecretFolderVersion, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.integer("version").defaultTo(1);
+      t.timestamps(true, true, true);
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.uuid("folderId").notNullable();
+      // t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("SET NULL");
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.SecretFolderVersion);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretFolderVersion);
+  await knex.schema.dropTableIfExists(TableName.SecretFolder);
+  await dropOnUpdateTrigger(knex, TableName.SecretFolder);
+  await dropOnUpdateTrigger(knex, TableName.SecretFolderVersion);
+}

backend/src/db/migrations/20231218092508_secret-import.ts

@@ -0,0 +1,30 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretImport))) {
+    await knex.schema.createTable(TableName.SecretImport, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1);
+      t.string("importPath").notNullable();
+      t.uuid("importEnv").notNullable();
+      t.foreign("importEnv").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.integer("position").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("folderId").notNullable();
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+      t.unique(["folderId", "position"], {
+        indexName: "import_pos_composite_uniqe",
+        deferrable: "deferred"
+      });
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretImport);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretImport);
+  await dropOnUpdateTrigger(knex, TableName.SecretImport);
+}

backend/src/db/migrations/20231218092517_secret-tag.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretTag))) {
+    await knex.schema.createTable(TableName.SecretTag, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("slug").notNullable();
+      t.string("color");
+      t.timestamps(true, true, true);
+      t.uuid("createdBy");
+      t.foreign("createdBy").references("id").inTable(TableName.Users).onDelete("SET NULL");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretTag);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretTag);
+  await dropOnUpdateTrigger(knex, TableName.SecretTag);
+}

backend/src/db/migrations/20231218103423_secret.ts

@@ -0,0 +1,66 @@
+import { Knex } from "knex";
+
+import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, TableName } from "../schemas";
+import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretBlindIndex))) {
+    await knex.schema.createTable(TableName.SecretBlindIndex, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("encryptedSaltCipherText").notNullable();
+      t.text("saltIV").notNullable();
+      t.text("saltTag").notNullable();
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.string("projectId").notNullable().unique();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretBlindIndex);
+
+  if (!(await knex.schema.hasTable(TableName.Secret))) {
+    await knex.schema.createTable(TableName.Secret, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1).notNullable();
+      t.string("type").notNullable().defaultTo(SecretType.Shared);
+      // t.text("secretKeyHash").notNullable();
+      // t.text("secretValueHash");
+      // t.text("secretCommentHash");
+      t.text("secretBlindIndex");
+      t.text("secretKeyCiphertext").notNullable();
+      t.text("secretKeyIV").notNullable();
+      t.text("secretKeyTag").notNullable();
+      t.text("secretValueCiphertext").notNullable();
+      t.text("secretValueIV").notNullable(); // symmetric encryption
+      t.text("secretValueTag").notNullable();
+      t.text("secretCommentCiphertext");
+      t.text("secretCommentIV");
+      t.text("secretCommentTag");
+      t.string("secretReminderNote");
+      t.integer("secretReminderRepeatDays");
+      t.boolean("skipMultilineEncoding").defaultTo(false);
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.jsonb("metadata");
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.uuid("folderId").notNullable();
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+      t.index("secretBlindIndex");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Secret);
+  // many to many relation between tags
+  await createJunctionTable(knex, TableName.JnSecretTag, TableName.Secret, TableName.SecretTag);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretBlindIndex);
+  await dropOnUpdateTrigger(knex, TableName.SecretBlindIndex);
+
+  await knex.schema.dropTableIfExists(TableName.JnSecretTag);
+  await knex.schema.dropTableIfExists(TableName.Secret);
+  await dropOnUpdateTrigger(knex, TableName.Secret);
+}

backend/src/db/migrations/20231220052508_secret-version.ts

@@ -0,0 +1,53 @@
+import { Knex } from "knex";
+
+import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, TableName } from "../schemas";
+import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretVersion))) {
+    await knex.schema.createTable(TableName.SecretVersion, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1).notNullable();
+      t.string("type").notNullable().defaultTo(SecretType.Shared);
+      t.text("secretBlindIndex");
+      t.text("secretKeyCiphertext").notNullable();
+      t.text("secretKeyIV").notNullable();
+      t.text("secretKeyTag").notNullable();
+      t.text("secretValueCiphertext").notNullable();
+      t.text("secretValueIV").notNullable(); // symmetric encryption
+      t.text("secretValueTag").notNullable();
+      t.text("secretCommentCiphertext");
+      t.text("secretCommentIV");
+      t.text("secretCommentTag");
+      t.string("secretReminderNote");
+      t.integer("secretReminderRepeatDays");
+      t.boolean("skipMultilineEncoding").defaultTo(false);
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.jsonb("metadata");
+      // to avoid orphan rows
+      t.uuid("envId");
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.uuid("secretId").notNullable();
+      t.uuid("folderId").notNullable();
+      // t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("SET NULL");
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretVersion);
+  // many to many relation between tags
+  await createJunctionTable(
+    knex,
+    TableName.SecretVersionTag,
+    TableName.SecretVersion,
+    TableName.SecretTag
+  );
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretVersionTag);
+  await knex.schema.dropTableIfExists(TableName.SecretVersion);
+  await dropOnUpdateTrigger(knex, TableName.SecretVersion);
+}

backend/src/db/migrations/20231222092113_project-bot.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.ProjectBot))) {
+    await knex.schema.createTable(TableName.ProjectBot, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.boolean("isActive").defaultTo(false).notNullable();
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("publicKey").notNullable();
+      t.text("iv").notNullable();
+      t.text("tag").notNullable();
+      t.string("algorithm").notNullable();
+      t.string("keyEncoding").notNullable();
+      t.text("encryptedProjectKey");
+      t.text("encryptedProjectKeyNonce");
+      // one to one relationship
+      t.string("projectId").notNullable().unique();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.uuid("senderId");
+      t.foreign("senderId").references("id").inTable(TableName.Users).onDelete("SET NULL");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.ProjectBot);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ProjectBot);
+  await dropOnUpdateTrigger(knex, TableName.ProjectBot);
+}

backend/src/db/migrations/20231222172455_integration.ts

@@ -0,0 +1,71 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IntegrationAuth))) {
+    await knex.schema.createTable(TableName.IntegrationAuth, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("integration").notNullable();
+      t.string("teamId"); // vercel-specific
+      t.string("url"); // for self hosted
+      t.string("namespace"); // hashicorp specific
+      t.string("accountId"); // netlify
+      t.text("refreshCiphertext");
+      t.string("refreshIV");
+      t.string("refreshTag");
+      t.string("accessIdCiphertext");
+      t.string("accessIdIV");
+      t.string("accessIdTag");
+      t.text("accessCiphertext");
+      t.string("accessIV");
+      t.string("accessTag");
+      t.datetime("accessExpiresAt");
+      t.jsonb("metadata");
+      t.string("algorithm").notNullable();
+      t.string("keyEncoding").notNullable();
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IntegrationAuth);
+
+  if (!(await knex.schema.hasTable(TableName.Integration))) {
+    await knex.schema.createTable(TableName.Integration, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.boolean("isActive").notNullable();
+      t.string("url"); // self hosted
+      t.string("app"); // name of app in provider
+      t.string("appId");
+      t.string("targetEnvironment");
+      t.string("targetEnvironmentId");
+      t.string("targetService"); // railway - qovery specific
+      t.string("targetServiceId");
+      t.string("owner"); // github specific
+      t.string("path"); // aws parameter store / vercel preview branch
+      t.string("region"); // aws
+      t.string("scope"); // qovery specific scope
+      t.string("integration").notNullable();
+      t.jsonb("metadata");
+      t.uuid("integrationAuthId").notNullable();
+      t.foreign("integrationAuthId")
+        .references("id")
+        .inTable(TableName.IntegrationAuth)
+        .onDelete("CASCADE");
+      t.uuid("envId").notNullable();
+      t.string("secretPath").defaultTo("/").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Integration);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Integration);
+  await knex.schema.dropTableIfExists(TableName.IntegrationAuth);
+  await dropOnUpdateTrigger(knex, TableName.IntegrationAuth);
+  await dropOnUpdateTrigger(knex, TableName.Integration);
+}

backend/src/db/migrations/20231225072545_service-token.ts

@@ -0,0 +1,32 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.ServiceToken))) {
+    await knex.schema.createTable(TableName.ServiceToken, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.jsonb("scopes").notNullable();
+      t.specificType("permissions", "text[]").notNullable();
+      t.datetime("lastUsed");
+      t.datetime("expiresAt");
+      t.text("secretHash").notNullable();
+      t.text("encryptedKey");
+      t.text("iv");
+      t.text("tag");
+      t.timestamps(true, true, true);
+      // user is old one
+      t.string("createdBy").notNullable();
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ServiceToken);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ServiceToken);
+  await dropOnUpdateTrigger(knex, TableName.ServiceToken);
+}

backend/src/db/migrations/20231225072552_webhook.ts

@@ -0,0 +1,32 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Webhook))) {
+    await knex.schema.createTable(TableName.Webhook, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("secretPath").notNullable().defaultTo("/");
+      t.string("url").notNullable();
+      t.string("lastStatus");
+      t.text("lastRunErrorMessage");
+      t.boolean("isDisabled").defaultTo(false).notNullable();
+      // webhook signature
+      t.text("encryptedSecretKey");
+      t.text("iv");
+      t.text("tag");
+      t.string("algorithm");
+      t.string("keyEncoding");
+      t.timestamps(true, true, true);
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Webhook);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Webhook);
+  await dropOnUpdateTrigger(knex, TableName.Webhook);
+}

backend/src/db/migrations/20231228074856_identity.ts

@@ -0,0 +1,21 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Identity))) {
+    await knex.schema.createTable(TableName.Identity, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("authMethod");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Identity);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Identity);
+  await dropOnUpdateTrigger(knex, TableName.Identity);
+}

backend/src/db/migrations/20231228074908_identity-universal-auth.ts

@@ -0,0 +1,49 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IdentityUniversalAuth))) {
+    await knex.schema.createTable(TableName.IdentityUniversalAuth, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("clientId").notNullable();
+      t.bigInteger("accessTokenTTL").defaultTo(7200).notNullable();
+      t.bigInteger("accessTokenMaxTTL").defaultTo(7200).notNullable();
+      t.bigInteger("accessTokenNumUsesLimit").defaultTo(0).notNullable();
+      t.jsonb("clientSecretTrustedIps").notNullable();
+      t.jsonb("accessTokenTrustedIps").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("identityId").notNullable().unique();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+    });
+  }
+  if (!(await knex.schema.hasTable(TableName.IdentityUaClientSecret))) {
+    await knex.schema.createTable(TableName.IdentityUaClientSecret, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("description").notNullable();
+      t.string("clientSecretPrefix").notNullable();
+      t.string("clientSecretHash").notNullable();
+      t.datetime("clientSecretLastUsedAt");
+      t.bigInteger("clientSecretNumUses").defaultTo(0).notNullable();
+      t.bigInteger("clientSecretNumUsesLimit").defaultTo(0).notNullable();
+      t.bigInteger("clientSecretTTL").defaultTo(0).notNullable();
+      t.boolean("isClientSecretRevoked").defaultTo(false).notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("identityUAId").notNullable();
+      t.foreign("identityUAId")
+        .references("id")
+        .inTable(TableName.IdentityUniversalAuth)
+        .onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IdentityUniversalAuth);
+  await createOnUpdateTrigger(knex, TableName.IdentityUaClientSecret);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IdentityUaClientSecret);
+  await knex.schema.dropTableIfExists(TableName.IdentityUniversalAuth);
+  await dropOnUpdateTrigger(knex, TableName.IdentityUaClientSecret);
+  await dropOnUpdateTrigger(knex, TableName.IdentityUniversalAuth);
+}

backend/src/db/migrations/20231228075011_identity-access-token.ts

@@ -0,0 +1,34 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IdentityAccessToken))) {
+    await knex.schema.createTable(TableName.IdentityAccessToken, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.bigInteger("accessTokenTTL").defaultTo(2592000).notNullable(); // 30 days second
+      t.bigInteger("accessTokenMaxTTL").defaultTo(2592000).notNullable();
+      t.bigInteger("accessTokenNumUses").defaultTo(0).notNullable();
+      t.bigInteger("accessTokenNumUsesLimit").defaultTo(0).notNullable();
+      t.datetime("accessTokenLastUsedAt");
+      t.datetime("accessTokenLastRenewedAt");
+      t.boolean("isAccessTokenRevoked").defaultTo(false).notNullable();
+      t.string("identityUAClientSecretId");
+      t.foreign("identityUAClientSecretId")
+        .references("id")
+        .inTable(TableName.IdentityUaClientSecret)
+        .onDelete("CASCADE");
+        t.uuid("identityId").notNullable();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.IdentityAccessToken);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IdentityAccessToken);
+  await dropOnUpdateTrigger(knex, TableName.IdentityAccessToken);
+}

backend/src/db/migrations/20231228075023_identity-membership.ts

@@ -0,0 +1,44 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IdentityOrgMembership))) {
+    await knex.schema.createTable(TableName.IdentityOrgMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.OrgRoles);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+      t.uuid("identityId").notNullable();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IdentityOrgMembership);
+
+  if (!(await knex.schema.hasTable(TableName.IdentityProjectMembership))) {
+    await knex.schema.createTable(TableName.IdentityProjectMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.ProjectRoles);
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.uuid("identityId").notNullable();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IdentityProjectMembership);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IdentityOrgMembership);
+  await knex.schema.dropTableIfExists(TableName.IdentityProjectMembership);
+
+  await dropOnUpdateTrigger(knex, TableName.IdentityProjectMembership);
+  await dropOnUpdateTrigger(knex, TableName.IdentityOrgMembership);
+}

backend/src/db/migrations/20240101054849_secret-approval-policy.ts

@@ -0,0 +1,45 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicy))) {
+    await knex.schema.createTable(TableName.SecretApprovalPolicy, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("secretPath");
+      t.integer("approvals").defaultTo(1).notNullable();
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicy);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicyApprover))) {
+    await knex.schema.createTable(TableName.SecretApprovalPolicyApprover, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("approverId").notNullable();
+      t.foreign("approverId")
+        .references("id")
+        .inTable(TableName.ProjectMembership)
+        .onDelete("CASCADE");
+      t.uuid("policyId").notNullable();
+      t.foreign("policyId")
+        .references("id")
+        .inTable(TableName.SecretApprovalPolicy)
+        .onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyApprover);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicyApprover);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicy);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicyApprover);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicy);
+}

backend/src/db/migrations/20240101104907_secret-approval-request.ts

@@ -0,0 +1,118 @@
+import { Knex } from "knex";
+
+import { SecretEncryptionAlgo, SecretKeyEncoding, TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequest))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequest, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("policyId").notNullable();
+      t.boolean("hasMerged").defaultTo(false).notNullable();
+      t.string("status").defaultTo("open").notNullable();
+      t.jsonb("conflicts");
+      t.foreign("policyId")
+        .references("id")
+        .inTable(TableName.SecretApprovalPolicy)
+        .onDelete("CASCADE");
+      t.string("slug").notNullable();
+      t.uuid("folderId").notNullable();
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+      t.uuid("statusChangeBy");
+      t.foreign("statusChangeBy")
+        .references("id")
+        .inTable(TableName.ProjectMembership)
+        .onDelete("SET NULL");
+      t.uuid("committerId").notNullable();
+      t.foreign("committerId")
+        .references("id")
+        .inTable(TableName.ProjectMembership)
+        .onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequest);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestReviewer))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequestReviewer, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("member").notNullable();
+      t.foreign("member").references("id").inTable(TableName.ProjectMembership).onDelete("CASCADE");
+      t.string("status").notNullable();
+      t.uuid("requestId").notNullable();
+      t.foreign("requestId")
+        .references("id")
+        .inTable(TableName.SecretApprovalRequest)
+        .onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestReviewer);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecret))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequestSecret, (t) => {
+      // everything related  to secret
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1);
+      t.text("secretBlindIndex");
+      t.text("secretKeyCiphertext").notNullable();
+      t.text("secretKeyIV").notNullable();
+      t.text("secretKeyTag").notNullable();
+      t.text("secretValueCiphertext").notNullable();
+      t.text("secretValueIV").notNullable(); // symmetric encryption
+      t.text("secretValueTag").notNullable();
+      t.text("secretCommentCiphertext");
+      t.text("secretCommentIV");
+      t.text("secretCommentTag");
+      t.string("secretReminderNote");
+      t.integer("secretReminderRepeatDays");
+      t.boolean("skipMultilineEncoding").defaultTo(false);
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.jsonb("metadata");
+      t.timestamps(true, true, true);
+      // commit details
+      t.uuid("requestId").notNullable();
+      t.foreign("requestId")
+        .references("id")
+        .inTable(TableName.SecretApprovalRequest)
+        .onDelete("CASCADE");
+      t.string("op").notNullable();
+      t.uuid("secretId");
+      t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("SET NULL");
+      t.uuid("secretVersion");
+      t.foreign("secretVersion")
+        .references("id")
+        .inTable(TableName.SecretVersion)
+        .onDelete("SET NULL");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecret);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecretTag))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequestSecretTag, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("secretId").notNullable();
+      t.foreign("secretId")
+        .references("id")
+        .inTable(TableName.SecretApprovalRequestSecret)
+        .onDelete("CASCADE");
+      t.uuid("tagId").notNullable();
+      t.foreign("tagId").references("id").inTable(TableName.SecretTag).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecretTag);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecretTag);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecret);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestReviewer);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequest);
+
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecretTag);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecret);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestReviewer);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequest);
+}

backend/src/db/migrations/20240102152111_secret-rotation.ts

@@ -0,0 +1,47 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretRotation))) {
+    await knex.schema.createTable(TableName.SecretRotation, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("provider").notNullable();
+      t.string("secretPath").notNullable();
+      t.integer("interval").notNullable();
+      t.datetime("lastRotatedAt");
+      t.string("status");
+      t.text("statusMessage");
+      t.text("encryptedData");
+      t.text("encryptedDataIV");
+      t.text("encryptedDataTag");
+      t.string("algorithm");
+      t.string("keyEncoding");
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretRotation);
+
+  if (!(await knex.schema.hasTable(TableName.SecretRotationOutput))) {
+    await knex.schema.createTable(TableName.SecretRotationOutput, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("key").notNullable();
+      t.uuid("secretId").notNullable();
+      t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("CASCADE");
+      t.uuid("rotationId").notNullable();
+      t.foreign("rotationId")
+        .references("id")
+        .inTable(TableName.SecretRotation)
+        .onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretRotationOutput);
+  await knex.schema.dropTableIfExists(TableName.SecretRotation);
+  await dropOnUpdateTrigger(knex, TableName.SecretRotation);
+}

backend/src/db/migrations/20240104140641_secret-snapshot.ts

@@ -0,0 +1,61 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Snapshot))) {
+    await knex.schema.createTable(TableName.Snapshot, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      // this is not a relation kept like that
+      // this ensure snapshot are not lost when folder gets deleted and rolled back
+      t.uuid("folderId").notNullable();
+      t.uuid("parentFolderId");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Snapshot);
+
+  if (!(await knex.schema.hasTable(TableName.SnapshotSecret))) {
+    await knex.schema.createTable(TableName.SnapshotSecret, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      // not a relation kept like that to keep it when rolled back
+      t.uuid("secretVersionId").notNullable();
+      t.foreign("secretVersionId")
+        .references("id")
+        .inTable(TableName.SecretVersion)
+        .onDelete("CASCADE");
+      t.uuid("snapshotId").notNullable();
+      t.foreign("snapshotId").references("id").inTable(TableName.Snapshot).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  if (!(await knex.schema.hasTable(TableName.SnapshotFolder))) {
+    await knex.schema.createTable(TableName.SnapshotFolder, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      // not a relation kept like that to keep it when rolled back
+      t.uuid("folderVersionId").notNullable();
+      t.foreign("folderVersionId")
+        .references("id")
+        .inTable(TableName.SecretFolderVersion)
+        .onDelete("CASCADE");
+      t.uuid("snapshotId").notNullable();
+      t.foreign("snapshotId").references("id").inTable(TableName.Snapshot).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SnapshotSecret);
+  await knex.schema.dropTableIfExists(TableName.SnapshotFolder);
+  await knex.schema.dropTableIfExists(TableName.Snapshot);
+  await dropOnUpdateTrigger(knex, TableName.Snapshot);
+}

backend/src/db/migrations/20240107153439_saml-config.ts

@@ -0,0 +1,33 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SamlConfig))) {
+    await knex.schema.createTable(TableName.SamlConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("authProvider").notNullable();
+      t.boolean("isActive").notNullable();
+      t.string("encryptedEntryPoint");
+      t.string("entryPointIV");
+      t.string("entryPointTag");
+      t.string("encryptedIssuer");
+      t.string("issuerTag");
+      t.string("issuerIV");
+      t.text("encryptedCert");
+      t.string("certIV");
+      t.string("certTag");
+      t.timestamps(true, true, true);
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.SamlConfig);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SamlConfig);
+  await dropOnUpdateTrigger(knex, TableName.SamlConfig);
+}

backend/src/db/migrations/20240107163155_org-bot.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.OrgBot))) {
+    await knex.schema.createTable(TableName.OrgBot, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.text("publicKey").notNullable();
+      t.text("encryptedSymmetricKey").notNullable();
+      t.text("symmetricKeyIV").notNullable();
+      t.text("symmetricKeyTag").notNullable();
+      t.string("symmetricKeyAlgorithm").notNullable();
+      t.string("symmetricKeyKeyEncoding").notNullable();
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("privateKeyIV").notNullable();
+      t.text("privateKeyTag").notNullable();
+      t.string("privateKeyAlgorithm").notNullable();
+      t.string("privateKeyKeyEncoding").notNullable();
+      // one to one relationship
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.OrgBot);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.OrgBot);
+  await dropOnUpdateTrigger(knex, TableName.OrgBot);
+}

backend/src/db/migrations/20240108134148_audit-log.ts

@@ -0,0 +1,29 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.AuditLog))) {
+    await knex.schema.createTable(TableName.AuditLog, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("actor").notNullable();
+      t.jsonb("actorMetadata").notNullable();
+      t.string("ipAddress");
+      t.string("eventType").notNullable();
+      t.jsonb("eventMetadata");
+      t.string("userAgent");
+      t.string("userAgentType");
+      t.datetime("expiresAt");
+      t.timestamps(true, true, true);
+      // no trigger needed as this collection is append only
+      t.uuid("orgId");
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.string("projectId");
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.AuditLog);
+}

backend/src/db/migrations/20240111051011_secret-scanning.ts

@@ -0,0 +1,79 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.GitAppInstallSession))) {
+    await knex.schema.createTable(TableName.GitAppInstallSession, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("sessionId").notNullable().unique();
+      t.uuid("userId");
+      // one to one relationship
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  createOnUpdateTrigger(knex, TableName.GitAppInstallSession);
+
+  if (!(await knex.schema.hasTable(TableName.GitAppOrg))) {
+    await knex.schema.createTable(TableName.GitAppOrg, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("installationId").notNullable().unique();
+      t.uuid("userId").notNullable();
+      // one to one relationship
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  createOnUpdateTrigger(knex, TableName.GitAppOrg);
+
+  if (!(await knex.schema.hasTable(TableName.SecretScanningGitRisk))) {
+    await knex.schema.createTable(TableName.SecretScanningGitRisk, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("description");
+      t.string("startLine");
+      t.string("endLine");
+      t.string("startColumn");
+      t.string("endColumn");
+      t.string("file");
+      t.string("symlinkFile");
+      t.string("commit");
+      t.string("entropy");
+      t.string("author");
+      t.string("email");
+      t.string("date");
+      t.text("message");
+      t.specificType("tags", "text[]");
+      t.string("ruleID");
+      t.string("fingerprint").unique();
+      t.string("fingerPrintWithoutCommitId");
+      t.boolean("isFalsePositive").defaultTo(false);
+      t.boolean("isResolved").defaultTo(false);
+      t.string("riskOwner");
+      t.string("installationId").notNullable();
+      t.string("repositoryId");
+      t.string("repositoryLink");
+      t.string("repositoryFullName");
+      t.string("pusherName");
+      t.string("pusherEmail");
+      t.string("status");
+      // one to one relationship
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  createOnUpdateTrigger(knex, TableName.SecretScanningGitRisk);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretScanningGitRisk);
+  await knex.schema.dropTableIfExists(TableName.GitAppOrg);
+  await knex.schema.dropTableIfExists(TableName.GitAppInstallSession);
+  await dropOnUpdateTrigger(knex, TableName.SecretScanningGitRisk);
+  await dropOnUpdateTrigger(knex, TableName.GitAppOrg);
+  await dropOnUpdateTrigger(knex, TableName.GitAppInstallSession);
+}

backend/src/db/migrations/20240113103743_trusted-ip.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.TrustedIps))) {
+    await knex.schema.createTable(TableName.TrustedIps, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("ipAddress").notNullable();
+      t.string("type").notNullable();
+      t.integer("prefix");
+      t.boolean("isActive").defaultTo(true);
+      t.string("comment");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.TrustedIps);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.TrustedIps);
+  await dropOnUpdateTrigger(knex, TableName.TrustedIps);
+}

backend/src/db/schemas/api-keys.ts

@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ApiKeysSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  lastUsed: z.date().nullable().optional(),
+  expiresAt: z.date().nullable().optional(),
+  secretHash: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  userId: z.string().uuid(),
+});
+
+export type TApiKeys = z.infer<typeof ApiKeysSchema>;
+export type TApiKeysInsert = Omit<TApiKeys, TImmutableDBKeys>;
+export type TApiKeysUpdate = Partial<Omit<TApiKeys, TImmutableDBKeys>>;

backend/src/db/schemas/audit-logs.ts

@@ -0,0 +1,28 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const AuditLogsSchema = z.object({
+  id: z.string().uuid(),
+  actor: z.string(),
+  actorMetadata: z.unknown(),
+  ipAddress: z.string().nullable().optional(),
+  eventType: z.string(),
+  eventMetadata: z.unknown().nullable().optional(),
+  userAgent: z.string().nullable().optional(),
+  userAgentType: z.string().nullable().optional(),
+  expiresAt: z.date().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  orgId: z.string().uuid().nullable().optional(),
+  projectId: z.string().nullable().optional(),
+});
+
+export type TAuditLogs = z.infer<typeof AuditLogsSchema>;
+export type TAuditLogsInsert = Omit<TAuditLogs, TImmutableDBKeys>;
+export type TAuditLogsUpdate = Partial<Omit<TAuditLogs, TImmutableDBKeys>>;

backend/src/db/schemas/auth-token-sessions.ts

@@ -0,0 +1,24 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const AuthTokenSessionsSchema = z.object({
+  id: z.string().uuid(),
+  ip: z.string(),
+  userAgent: z.string().nullable().optional(),
+  refreshVersion: z.number().default(1),
+  accessVersion: z.number().default(1),
+  lastUsed: z.date(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  userId: z.string().uuid(),
+});
+
+export type TAuthTokenSessions = z.infer<typeof AuthTokenSessionsSchema>;
+export type TAuthTokenSessionsInsert = Omit<TAuthTokenSessions, TImmutableDBKeys>;
+export type TAuthTokenSessionsUpdate = Partial<Omit<TAuthTokenSessions, TImmutableDBKeys>>;

backend/src/db/schemas/auth-tokens.ts

@@ -0,0 +1,25 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const AuthTokensSchema = z.object({
+  id: z.string().uuid(),
+  type: z.string(),
+  phoneNumber: z.string().nullable().optional(),
+  tokenHash: z.string(),
+  triesLeft: z.number().nullable().optional(),
+  expiresAt: z.date(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  userId: z.string().uuid().nullable().optional(),
+  orgId: z.string().uuid().nullable().optional(),
+});
+
+export type TAuthTokens = z.infer<typeof AuthTokensSchema>;
+export type TAuthTokensInsert = Omit<TAuthTokens, TImmutableDBKeys>;
+export type TAuthTokensUpdate = Partial<Omit<TAuthTokens, TImmutableDBKeys>>;

backend/src/db/schemas/backup-private-key.ts

@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const BackupPrivateKeySchema = z.object({
+  id: z.string().uuid(),
+  encryptedPrivateKey: z.string(),
+  iv: z.string(),
+  tag: z.string(),
+  algorithm: z.string(),
+  keyEncoding: z.string(),
+  salt: z.string(),
+  verifier: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  userId: z.string().uuid(),
+});
+
+export type TBackupPrivateKey = z.infer<typeof BackupPrivateKeySchema>;
+export type TBackupPrivateKeyInsert = Omit<TBackupPrivateKey, TImmutableDBKeys>;
+export type TBackupPrivateKeyUpdate = Partial<Omit<TBackupPrivateKey, TImmutableDBKeys>>;

backend/src/db/schemas/git-app-install-sessions.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const GitAppInstallSessionsSchema = z.object({
+  id: z.string().uuid(),
+  sessionId: z.string(),
+  userId: z.string().uuid().nullable().optional(),
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TGitAppInstallSessions = z.infer<typeof GitAppInstallSessionsSchema>;
+export type TGitAppInstallSessionsInsert = Omit<TGitAppInstallSessions, TImmutableDBKeys>;
+export type TGitAppInstallSessionsUpdate = Partial<Omit<TGitAppInstallSessions, TImmutableDBKeys>>;

backend/src/db/schemas/git-app-org.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const GitAppOrgSchema = z.object({
+  id: z.string().uuid(),
+  installationId: z.string(),
+  userId: z.string().uuid(),
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TGitAppOrg = z.infer<typeof GitAppOrgSchema>;
+export type TGitAppOrgInsert = Omit<TGitAppOrg, TImmutableDBKeys>;
+export type TGitAppOrgUpdate = Partial<Omit<TGitAppOrg, TImmutableDBKeys>>;

backend/src/db/schemas/identities.ts

@@ -0,0 +1,20 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IdentitiesSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  authMethod: z.string().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TIdentities = z.infer<typeof IdentitiesSchema>;
+export type TIdentitiesInsert = Omit<TIdentities, TImmutableDBKeys>;
+export type TIdentitiesUpdate = Partial<Omit<TIdentities, TImmutableDBKeys>>;

backend/src/db/schemas/identity-access-tokens.ts

@@ -0,0 +1,27 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IdentityAccessTokensSchema = z.object({
+  id: z.string().uuid(),
+  accessTokenTTL: z.coerce.number().default(2592000),
+  accessTokenMaxTTL: z.coerce.number().default(2592000),
+  accessTokenNumUses: z.coerce.number().default(0),
+  accessTokenNumUsesLimit: z.coerce.number().default(0),
+  accessTokenLastUsedAt: z.date().nullable().optional(),
+  accessTokenLastRenewedAt: z.date().nullable().optional(),
+  isAccessTokenRevoked: z.boolean().default(false),
+  identityUAClientSecretId: z.string().nullable().optional(),
+  identityId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TIdentityAccessTokens = z.infer<typeof IdentityAccessTokensSchema>;
+export type TIdentityAccessTokensInsert = Omit<TIdentityAccessTokens, TImmutableDBKeys>;
+export type TIdentityAccessTokensUpdate = Partial<Omit<TIdentityAccessTokens, TImmutableDBKeys>>;

backend/src/db/schemas/identity-org-memberships.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IdentityOrgMembershipsSchema = z.object({
+  id: z.string().uuid(),
+  role: z.string(),
+  roleId: z.string().uuid().nullable().optional(),
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  identityId: z.string().uuid(),
+});
+
+export type TIdentityOrgMemberships = z.infer<typeof IdentityOrgMembershipsSchema>;
+export type TIdentityOrgMembershipsInsert = Omit<TIdentityOrgMemberships, TImmutableDBKeys>;
+export type TIdentityOrgMembershipsUpdate = Partial<Omit<TIdentityOrgMemberships, TImmutableDBKeys>>;

backend/src/db/schemas/identity-project-memberships.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IdentityProjectMembershipsSchema = z.object({
+  id: z.string().uuid(),
+  role: z.string(),
+  roleId: z.string().uuid().nullable().optional(),
+  projectId: z.string(),
+  identityId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TIdentityProjectMemberships = z.infer<typeof IdentityProjectMembershipsSchema>;
+export type TIdentityProjectMembershipsInsert = Omit<TIdentityProjectMemberships, TImmutableDBKeys>;
+export type TIdentityProjectMembershipsUpdate = Partial<Omit<TIdentityProjectMemberships, TImmutableDBKeys>>;

backend/src/db/schemas/identity-ua-client-secrets.ts

@@ -0,0 +1,27 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IdentityUaClientSecretsSchema = z.object({
+  id: z.string(),
+  description: z.string(),
+  clientSecretPrefix: z.string(),
+  clientSecretHash: z.string(),
+  clientSecretLastUsedAt: z.date().nullable().optional(),
+  clientSecretNumUses: z.coerce.number().default(0),
+  clientSecretNumUsesLimit: z.coerce.number().default(0),
+  clientSecretTTL: z.coerce.number().default(0),
+  isClientSecretRevoked: z.boolean().default(false),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  identityUAId: z.string().uuid(),
+});
+
+export type TIdentityUaClientSecrets = z.infer<typeof IdentityUaClientSecretsSchema>;
+export type TIdentityUaClientSecretsInsert = Omit<TIdentityUaClientSecrets, TImmutableDBKeys>;
+export type TIdentityUaClientSecretsUpdate = Partial<Omit<TIdentityUaClientSecrets, TImmutableDBKeys>>;

backend/src/db/schemas/identity-universal-auths.ts

@@ -0,0 +1,25 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IdentityUniversalAuthsSchema = z.object({
+  id: z.string().uuid(),
+  clientId: z.string(),
+  accessTokenTTL: z.coerce.number().default(7200),
+  accessTokenMaxTTL: z.coerce.number().default(7200),
+  accessTokenNumUsesLimit: z.coerce.number().default(0),
+  clientSecretTrustedIps: z.unknown(),
+  accessTokenTrustedIps: z.unknown(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  identityId: z.string().uuid(),
+});
+
+export type TIdentityUniversalAuths = z.infer<typeof IdentityUniversalAuthsSchema>;
+export type TIdentityUniversalAuthsInsert = Omit<TIdentityUniversalAuths, TImmutableDBKeys>;
+export type TIdentityUniversalAuthsUpdate = Partial<Omit<TIdentityUniversalAuths, TImmutableDBKeys>>;

backend/src/db/schemas/incident-contacts.ts

@@ -0,0 +1,20 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IncidentContactsSchema = z.object({
+  id: z.string().uuid(),
+  email: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  orgId: z.string().uuid(),
+});
+
+export type TIncidentContacts = z.infer<typeof IncidentContactsSchema>;
+export type TIncidentContactsInsert = Omit<TIncidentContacts, TImmutableDBKeys>;
+export type TIncidentContactsUpdate = Partial<Omit<TIncidentContacts, TImmutableDBKeys>>;

backend/src/db/schemas/index.ts

@@ -0,0 +1,56 @@
+export * from "./api-keys";
+export * from "./audit-logs";
+export * from "./auth-token-sessions";
+export * from "./auth-tokens";
+export * from "./backup-private-key";
+export * from "./git-app-install-sessions";
+export * from "./git-app-org";
+export * from "./identities";
+export * from "./identity-access-tokens";
+export * from "./identity-org-memberships";
+export * from "./identity-project-memberships";
+export * from "./identity-ua-client-secrets";
+export * from "./identity-universal-auths";
+export * from "./incident-contacts";
+export * from "./integration-auths";
+export * from "./integrations";
+export * from "./models";
+export * from "./org-bots";
+export * from "./org-memberships";
+export * from "./org-roles";
+export * from "./organizations";
+export * from "./project-bots";
+export * from "./project-environments";
+export * from "./project-keys";
+export * from "./project-memberships";
+export * from "./project-roles";
+export * from "./projects";
+export * from "./saml-configs";
+export * from "./secret-approval-policies";
+export * from "./secret-approval-policies-approvers";
+export * from "./secret-approval-request-secret-tags";
+export * from "./secret-approval-requests";
+export * from "./secret-approval-requests-reviewers";
+export * from "./secret-approval-requests-secrets";
+export * from "./secret-blind-indexes";
+export * from "./secret-folder-versions";
+export * from "./secret-folders";
+export * from "./secret-imports";
+export * from "./secret-rotation-outputs";
+export * from "./secret-rotations";
+export * from "./secret-scanning-git-risks";
+export * from "./secret-snapshot-folders";
+export * from "./secret-snapshot-secrets";
+export * from "./secret-snapshots";
+export * from "./secret-tag-junction";
+export * from "./secret-tags";
+export * from "./secret-version-tag-junction";
+export * from "./secret-versions";
+export * from "./secrets";
+export * from "./service-tokens";
+export * from "./super-admin";
+export * from "./trusted-ips";
+export * from "./user-actions";
+export * from "./user-encryption-keys";
+export * from "./users";
+export * from "./webhooks";

backend/src/db/schemas/integration-auths.ts

@@ -0,0 +1,37 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IntegrationAuthsSchema = z.object({
+  id: z.string().uuid(),
+  integration: z.string(),
+  teamId: z.string().nullable().optional(),
+  url: z.string().nullable().optional(),
+  namespace: z.string().nullable().optional(),
+  accountId: z.string().nullable().optional(),
+  refreshCiphertext: z.string().nullable().optional(),
+  refreshIV: z.string().nullable().optional(),
+  refreshTag: z.string().nullable().optional(),
+  accessIdCiphertext: z.string().nullable().optional(),
+  accessIdIV: z.string().nullable().optional(),
+  accessIdTag: z.string().nullable().optional(),
+  accessCiphertext: z.string().nullable().optional(),
+  accessIV: z.string().nullable().optional(),
+  accessTag: z.string().nullable().optional(),
+  accessExpiresAt: z.date().nullable().optional(),
+  metadata: z.unknown().nullable().optional(),
+  algorithm: z.string(),
+  keyEncoding: z.string(),
+  projectId: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TIntegrationAuths = z.infer<typeof IntegrationAuthsSchema>;
+export type TIntegrationAuthsInsert = Omit<TIntegrationAuths, TImmutableDBKeys>;
+export type TIntegrationAuthsUpdate = Partial<Omit<TIntegrationAuths, TImmutableDBKeys>>;

backend/src/db/schemas/integrations.ts

@@ -0,0 +1,35 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const IntegrationsSchema = z.object({
+  id: z.string().uuid(),
+  isActive: z.boolean(),
+  url: z.string().nullable().optional(),
+  app: z.string().nullable().optional(),
+  appId: z.string().nullable().optional(),
+  targetEnvironment: z.string().nullable().optional(),
+  targetEnvironmentId: z.string().nullable().optional(),
+  targetService: z.string().nullable().optional(),
+  targetServiceId: z.string().nullable().optional(),
+  owner: z.string().nullable().optional(),
+  path: z.string().nullable().optional(),
+  region: z.string().nullable().optional(),
+  scope: z.string().nullable().optional(),
+  integration: z.string(),
+  metadata: z.unknown().nullable().optional(),
+  integrationAuthId: z.string().uuid(),
+  envId: z.string().uuid(),
+  secretPath: z.string().default('/'),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TIntegrations = z.infer<typeof IntegrationsSchema>;
+export type TIntegrationsInsert = Omit<TIntegrations, TImmutableDBKeys>;
+export type TIntegrationsUpdate = Partial<Omit<TIntegrations, TImmutableDBKeys>>;

backend/src/db/schemas/models.ts

@@ -0,0 +1,116 @@
+import { z } from "zod";
+
+export enum TableName {
+  Users = "users",
+  UserEncryptionKey = "user_encryption_keys",
+  AuthTokens = "auth_tokens",
+  AuthTokenSession = "auth_token_sessions",
+  BackupPrivateKey = "backup_private_key",
+  Organization = "organizations",
+  OrgMembership = "org_memberships",
+  OrgRoles = "org_roles",
+  OrgBot = "org_bots",
+  IncidentContact = "incident_contacts",
+  UserAction = "user_actions",
+  SuperAdmin = "super_admin",
+  ApiKey = "api_keys",
+  Project = "projects",
+  ProjectBot = "project_bots",
+  Environment = "project_environments",
+  ProjectMembership = "project_memberships",
+  ProjectRoles = "project_roles",
+  ProjectKeys = "project_keys",
+  Secret = "secrets",
+  SecretBlindIndex = "secret_blind_indexes",
+  SecretVersion = "secret_versions",
+  SecretFolder = "secret_folders",
+  SecretFolderVersion = "secret_folder_versions",
+  SecretImport = "secret_imports",
+  Snapshot = "secret_snapshots",
+  SnapshotSecret = "secret_snapshot_secrets",
+  SnapshotFolder = "secret_snapshot_folders",
+  SecretTag = "secret_tags",
+  Integration = "integrations",
+  IntegrationAuth = "integration_auths",
+  ServiceToken = "service_tokens",
+  Webhook = "webhooks",
+  Identity = "identities",
+  IdentityAccessToken = "identity_access_tokens",
+  IdentityUniversalAuth = "identity_universal_auths",
+  IdentityUaClientSecret = "identity_ua_client_secrets",
+  IdentityOrgMembership = "identity_org_memberships",
+  IdentityProjectMembership = "identity_project_memberships",
+  SecretApprovalPolicy = "secret_approval_policies",
+  SecretApprovalPolicyApprover = "secret_approval_policies_approvers",
+  SecretApprovalRequest = "secret_approval_requests",
+  SecretApprovalRequestReviewer = "secret_approval_requests_reviewers",
+  SecretApprovalRequestSecret = "secret_approval_requests_secrets",
+  SecretApprovalRequestSecretTag = "secret_approval_request_secret_tags",
+  SecretRotation = "secret_rotations",
+  SecretRotationOutput = "secret_rotation_outputs",
+  SamlConfig = "saml_configs",
+  AuditLog = "audit_logs",
+  GitAppInstallSession = "git_app_install_sessions",
+  GitAppOrg = "git_app_org",
+  SecretScanningGitRisk = "secret_scanning_git_risks",
+  TrustedIps = "trusted_ips",
+  // junction tables with tags
+  JnSecretTag = "secret_tag_junction",
+  SecretVersionTag = "secret_version_tag_junction"
+}
+
+export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt";
+
+export const UserDeviceSchema = z
+  .object({
+    ip: z.string(),
+    userAgent: z.string()
+  })
+  .array()
+  .default([]);
+
+export const ServiceTokenScopes = z
+  .object({
+    environment: z.string(),
+    secretPath: z.string().default("/")
+  })
+  .array();
+
+export enum OrgMembershipRole {
+  Admin = "admin",
+  Member = "member",
+  NoAccess = "no-access",
+  Custom = "custom"
+}
+
+export enum OrgMembershipStatus {
+  Invited = "invited",
+  Accepted = "accepted"
+}
+
+export enum ProjectMembershipRole {
+  Admin = "admin",
+  Member = "member",
+  Custom = "custom",
+  Viewer = "viewer",
+  NoAccess = "no-access"
+}
+
+export enum SecretEncryptionAlgo {
+  AES_256_GCM = "aes-256-gcm"
+}
+
+export enum SecretKeyEncoding {
+  UTF8 = "utf8",
+  BASE64 = "base64",
+  HEX = "hex"
+}
+
+export enum SecretType {
+  Shared = "shared",
+  Personal = "personal"
+}
+
+export enum IdentityAuthMethod {
+  Univeral = "universal-auth"
+}

backend/src/db/schemas/org-bots.ts

@@ -0,0 +1,31 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const OrgBotsSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  publicKey: z.string(),
+  encryptedSymmetricKey: z.string(),
+  symmetricKeyIV: z.string(),
+  symmetricKeyTag: z.string(),
+  symmetricKeyAlgorithm: z.string(),
+  symmetricKeyKeyEncoding: z.string(),
+  encryptedPrivateKey: z.string(),
+  privateKeyIV: z.string(),
+  privateKeyTag: z.string(),
+  privateKeyAlgorithm: z.string(),
+  privateKeyKeyEncoding: z.string(),
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TOrgBots = z.infer<typeof OrgBotsSchema>;
+export type TOrgBotsInsert = Omit<TOrgBots, TImmutableDBKeys>;
+export type TOrgBotsUpdate = Partial<Omit<TOrgBots, TImmutableDBKeys>>;

backend/src/db/schemas/org-memberships.ts

@@ -0,0 +1,24 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const OrgMembershipsSchema = z.object({
+  id: z.string().uuid(),
+  role: z.string(),
+  status: z.string().default('invited'),
+  inviteEmail: z.string().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  userId: z.string().uuid().nullable().optional(),
+  orgId: z.string().uuid(),
+  roleId: z.string().uuid().nullable().optional(),
+});
+
+export type TOrgMemberships = z.infer<typeof OrgMembershipsSchema>;
+export type TOrgMembershipsInsert = Omit<TOrgMemberships, TImmutableDBKeys>;
+export type TOrgMembershipsUpdate = Partial<Omit<TOrgMemberships, TImmutableDBKeys>>;

backend/src/db/schemas/org-roles.ts

@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const OrgRolesSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  description: z.string().nullable().optional(),
+  slug: z.string(),
+  permissions: z.unknown(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  orgId: z.string().uuid(),
+});
+
+export type TOrgRoles = z.infer<typeof OrgRolesSchema>;
+export type TOrgRolesInsert = Omit<TOrgRoles, TImmutableDBKeys>;
+export type TOrgRolesUpdate = Partial<Omit<TOrgRoles, TImmutableDBKeys>>;

backend/src/db/schemas/organizations.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const OrganizationsSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  customerId: z.string().nullable().optional(),
+  slug: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TOrganizations = z.infer<typeof OrganizationsSchema>;
+export type TOrganizationsInsert = Omit<TOrganizations, TImmutableDBKeys>;
+export type TOrganizationsUpdate = Partial<Omit<TOrganizations, TImmutableDBKeys>>;

backend/src/db/schemas/project-bots.ts

@@ -0,0 +1,30 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProjectBotsSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  isActive: z.boolean().default(false),
+  encryptedPrivateKey: z.string(),
+  publicKey: z.string(),
+  iv: z.string(),
+  tag: z.string(),
+  algorithm: z.string(),
+  keyEncoding: z.string(),
+  encryptedProjectKey: z.string().nullable().optional(),
+  encryptedProjectKeyNonce: z.string().nullable().optional(),
+  projectId: z.string(),
+  senderId: z.string().uuid().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TProjectBots = z.infer<typeof ProjectBotsSchema>;
+export type TProjectBotsInsert = Omit<TProjectBots, TImmutableDBKeys>;
+export type TProjectBotsUpdate = Partial<Omit<TProjectBots, TImmutableDBKeys>>;

backend/src/db/schemas/project-environments.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProjectEnvironmentsSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  slug: z.string(),
+  position: z.number(),
+  projectId: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TProjectEnvironments = z.infer<typeof ProjectEnvironmentsSchema>;
+export type TProjectEnvironmentsInsert = Omit<TProjectEnvironments, TImmutableDBKeys>;
+export type TProjectEnvironmentsUpdate = Partial<Omit<TProjectEnvironments, TImmutableDBKeys>>;

backend/src/db/schemas/project-keys.ts

@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProjectKeysSchema = z.object({
+  id: z.string().uuid(),
+  encryptedKey: z.string(),
+  nonce: z.string(),
+  receiverId: z.string().uuid(),
+  senderId: z.string().uuid().nullable().optional(),
+  projectId: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TProjectKeys = z.infer<typeof ProjectKeysSchema>;
+export type TProjectKeysInsert = Omit<TProjectKeys, TImmutableDBKeys>;
+export type TProjectKeysUpdate = Partial<Omit<TProjectKeys, TImmutableDBKeys>>;

backend/src/db/schemas/project-memberships.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProjectMembershipsSchema = z.object({
+  id: z.string().uuid(),
+  role: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  userId: z.string().uuid(),
+  projectId: z.string(),
+  roleId: z.string().uuid().nullable().optional(),
+});
+
+export type TProjectMemberships = z.infer<typeof ProjectMembershipsSchema>;
+export type TProjectMembershipsInsert = Omit<TProjectMemberships, TImmutableDBKeys>;
+export type TProjectMembershipsUpdate = Partial<Omit<TProjectMemberships, TImmutableDBKeys>>;

backend/src/db/schemas/project-roles.ts

@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProjectRolesSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  description: z.string().nullable().optional(),
+  slug: z.string(),
+  permissions: z.unknown(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  projectId: z.string(),
+});
+
+export type TProjectRoles = z.infer<typeof ProjectRolesSchema>;
+export type TProjectRolesInsert = Omit<TProjectRoles, TImmutableDBKeys>;
+export type TProjectRolesUpdate = Partial<Omit<TProjectRoles, TImmutableDBKeys>>;

backend/src/db/schemas/projects.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProjectsSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  slug: z.string(),
+  autoCapitalization: z.boolean().default(true).nullable().optional(),
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TProjects = z.infer<typeof ProjectsSchema>;
+export type TProjectsInsert = Omit<TProjects, TImmutableDBKeys>;
+export type TProjectsUpdate = Partial<Omit<TProjects, TImmutableDBKeys>>;

backend/src/db/schemas/saml-configs.ts

@@ -0,0 +1,30 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SamlConfigsSchema = z.object({
+  id: z.string().uuid(),
+  authProvider: z.string(),
+  isActive: z.boolean(),
+  encryptedEntryPoint: z.string().nullable().optional(),
+  entryPointIV: z.string().nullable().optional(),
+  entryPointTag: z.string().nullable().optional(),
+  encryptedIssuer: z.string().nullable().optional(),
+  issuerTag: z.string().nullable().optional(),
+  issuerIV: z.string().nullable().optional(),
+  encryptedCert: z.string().nullable().optional(),
+  certIV: z.string().nullable().optional(),
+  certTag: z.string().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  orgId: z.string().uuid(),
+});
+
+export type TSamlConfigs = z.infer<typeof SamlConfigsSchema>;
+export type TSamlConfigsInsert = Omit<TSamlConfigs, TImmutableDBKeys>;
+export type TSamlConfigsUpdate = Partial<Omit<TSamlConfigs, TImmutableDBKeys>>;

backend/src/db/schemas/secret-approval-policies-approvers.ts

@@ -0,0 +1,20 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretApprovalPoliciesApproversSchema = z.object({
+  id: z.string().uuid(),
+  approverId: z.string().uuid(),
+  policyId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretApprovalPoliciesApprovers = z.infer<typeof SecretApprovalPoliciesApproversSchema>;
+export type TSecretApprovalPoliciesApproversInsert = Omit<TSecretApprovalPoliciesApprovers, TImmutableDBKeys>;
+export type TSecretApprovalPoliciesApproversUpdate = Partial<Omit<TSecretApprovalPoliciesApprovers, TImmutableDBKeys>>;

backend/src/db/schemas/secret-approval-policies.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretApprovalPoliciesSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  secretPath: z.string().nullable().optional(),
+  approvals: z.number().default(1),
+  envId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretApprovalPolicies = z.infer<typeof SecretApprovalPoliciesSchema>;
+export type TSecretApprovalPoliciesInsert = Omit<TSecretApprovalPolicies, TImmutableDBKeys>;
+export type TSecretApprovalPoliciesUpdate = Partial<Omit<TSecretApprovalPolicies, TImmutableDBKeys>>;

backend/src/db/schemas/secret-approval-request-secret-tags.ts

@@ -0,0 +1,20 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretApprovalRequestSecretTagsSchema = z.object({
+  id: z.string().uuid(),
+  secretId: z.string().uuid(),
+  tagId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretApprovalRequestSecretTags = z.infer<typeof SecretApprovalRequestSecretTagsSchema>;
+export type TSecretApprovalRequestSecretTagsInsert = Omit<TSecretApprovalRequestSecretTags, TImmutableDBKeys>;
+export type TSecretApprovalRequestSecretTagsUpdate = Partial<Omit<TSecretApprovalRequestSecretTags, TImmutableDBKeys>>;

backend/src/db/schemas/secret-approval-requests-reviewers.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretApprovalRequestsReviewersSchema = z.object({
+  id: z.string().uuid(),
+  member: z.string().uuid(),
+  status: z.string(),
+  requestId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretApprovalRequestsReviewers = z.infer<typeof SecretApprovalRequestsReviewersSchema>;
+export type TSecretApprovalRequestsReviewersInsert = Omit<TSecretApprovalRequestsReviewers, TImmutableDBKeys>;
+export type TSecretApprovalRequestsReviewersUpdate = Partial<Omit<TSecretApprovalRequestsReviewers, TImmutableDBKeys>>;

backend/src/db/schemas/secret-approval-requests-secrets.ts

@@ -0,0 +1,39 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretApprovalRequestsSecretsSchema = z.object({
+  id: z.string().uuid(),
+  version: z.number().default(1).nullable().optional(),
+  secretBlindIndex: z.string(),
+  secretKeyCiphertext: z.string(),
+  secretKeyIV: z.string(),
+  secretKeyTag: z.string(),
+  secretValueCiphertext: z.string(),
+  secretValueIV: z.string(),
+  secretValueTag: z.string(),
+  secretCommentCiphertext: z.string().nullable().optional(),
+  secretCommentIV: z.string().nullable().optional(),
+  secretCommentTag: z.string().nullable().optional(),
+  secretReminderNote: z.string().nullable().optional(),
+  secretReminderRepeatDays: z.number().nullable().optional(),
+  skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
+  algorithm: z.string().default('aes-256-gcm'),
+  keyEncoding: z.string().default('utf8'),
+  metadata: z.unknown().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  requestId: z.string().uuid(),
+  op: z.string(),
+  secretId: z.string().uuid().nullable().optional(),
+  secretVersion: z.string().uuid().nullable().optional(),
+});
+
+export type TSecretApprovalRequestsSecrets = z.infer<typeof SecretApprovalRequestsSecretsSchema>;
+export type TSecretApprovalRequestsSecretsInsert = Omit<TSecretApprovalRequestsSecrets, TImmutableDBKeys>;
+export type TSecretApprovalRequestsSecretsUpdate = Partial<Omit<TSecretApprovalRequestsSecrets, TImmutableDBKeys>>;

backend/src/db/schemas/secret-approval-requests.ts

@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretApprovalRequestsSchema = z.object({
+  id: z.string().uuid(),
+  policyId: z.string().uuid(),
+  hasMerged: z.boolean().default(false),
+  status: z.string().default('open'),
+  conflicts: z.unknown().nullable().optional(),
+  slug: z.string(),
+  folderId: z.string().uuid(),
+  statusChangeBy: z.string().uuid().nullable().optional(),
+  committerId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretApprovalRequests = z.infer<typeof SecretApprovalRequestsSchema>;
+export type TSecretApprovalRequestsInsert = Omit<TSecretApprovalRequests, TImmutableDBKeys>;
+export type TSecretApprovalRequestsUpdate = Partial<Omit<TSecretApprovalRequests, TImmutableDBKeys>>;

backend/src/db/schemas/secret-blind-indexes.ts

@@ -0,0 +1,24 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretBlindIndexesSchema = z.object({
+  id: z.string().uuid(),
+  encryptedSaltCipherText: z.string(),
+  saltIV: z.string(),
+  saltTag: z.string(),
+  algorithm: z.string().default('aes-256-gcm'),
+  keyEncoding: z.string().default('utf8'),
+  projectId: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretBlindIndexes = z.infer<typeof SecretBlindIndexesSchema>;
+export type TSecretBlindIndexesInsert = Omit<TSecretBlindIndexes, TImmutableDBKeys>;
+export type TSecretBlindIndexesUpdate = Partial<Omit<TSecretBlindIndexes, TImmutableDBKeys>>;

backend/src/db/schemas/secret-folder-versions.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretFolderVersionsSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  version: z.number().default(1).nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  envId: z.string().uuid(),
+  folderId: z.string().uuid(),
+});
+
+export type TSecretFolderVersions = z.infer<typeof SecretFolderVersionsSchema>;
+export type TSecretFolderVersionsInsert = Omit<TSecretFolderVersions, TImmutableDBKeys>;
+export type TSecretFolderVersionsUpdate = Partial<Omit<TSecretFolderVersions, TImmutableDBKeys>>;

backend/src/db/schemas/secret-folders.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretFoldersSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  version: z.number().default(1).nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  envId: z.string().uuid(),
+  parentId: z.string().uuid().nullable().optional(),
+});
+
+export type TSecretFolders = z.infer<typeof SecretFoldersSchema>;
+export type TSecretFoldersInsert = Omit<TSecretFolders, TImmutableDBKeys>;
+export type TSecretFoldersUpdate = Partial<Omit<TSecretFolders, TImmutableDBKeys>>;

backend/src/db/schemas/secret-imports.ts

@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretImportsSchema = z.object({
+  id: z.string().uuid(),
+  version: z.number().default(1).nullable().optional(),
+  importPath: z.string(),
+  importEnv: z.string().uuid(),
+  position: z.number(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  folderId: z.string().uuid(),
+});
+
+export type TSecretImports = z.infer<typeof SecretImportsSchema>;
+export type TSecretImportsInsert = Omit<TSecretImports, TImmutableDBKeys>;
+export type TSecretImportsUpdate = Partial<Omit<TSecretImports, TImmutableDBKeys>>;

backend/src/db/schemas/secret-rotation-outputs.ts

@@ -0,0 +1,19 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretRotationOutputsSchema = z.object({
+  id: z.string().uuid(),
+  key: z.string(),
+  secretId: z.string().uuid(),
+  rotationId: z.string().uuid(),
+});
+
+export type TSecretRotationOutputs = z.infer<typeof SecretRotationOutputsSchema>;
+export type TSecretRotationOutputsInsert = Omit<TSecretRotationOutputs, TImmutableDBKeys>;
+export type TSecretRotationOutputsUpdate = Partial<Omit<TSecretRotationOutputs, TImmutableDBKeys>>;

backend/src/db/schemas/secret-rotations.ts

@@ -0,0 +1,30 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretRotationsSchema = z.object({
+  id: z.string().uuid(),
+  provider: z.string(),
+  secretPath: z.string(),
+  interval: z.number(),
+  lastRotatedAt: z.date().nullable().optional(),
+  status: z.string().nullable().optional(),
+  statusMessage: z.string().nullable().optional(),
+  encryptedData: z.string().nullable().optional(),
+  encryptedDataIV: z.string().nullable().optional(),
+  encryptedDataTag: z.string().nullable().optional(),
+  algorithm: z.string().nullable().optional(),
+  keyEncoding: z.string().nullable().optional(),
+  envId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretRotations = z.infer<typeof SecretRotationsSchema>;
+export type TSecretRotationsInsert = Omit<TSecretRotations, TImmutableDBKeys>;
+export type TSecretRotationsUpdate = Partial<Omit<TSecretRotations, TImmutableDBKeys>>;

backend/src/db/schemas/secret-scanning-git-risks.ts

@@ -0,0 +1,46 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretScanningGitRisksSchema = z.object({
+  id: z.string().uuid(),
+  description: z.string().nullable().optional(),
+  startLine: z.string().nullable().optional(),
+  endLine: z.string().nullable().optional(),
+  startColumn: z.string().nullable().optional(),
+  endColumn: z.string().nullable().optional(),
+  file: z.string().nullable().optional(),
+  symlinkFile: z.string().nullable().optional(),
+  commit: z.string().nullable().optional(),
+  entropy: z.string().nullable().optional(),
+  author: z.string().nullable().optional(),
+  email: z.string().nullable().optional(),
+  date: z.string().nullable().optional(),
+  message: z.string().nullable().optional(),
+  tags: z.string().array().nullable().optional(),
+  ruleID: z.string().nullable().optional(),
+  fingerprint: z.string().nullable().optional(),
+  fingerPrintWithoutCommitId: z.string().nullable().optional(),
+  isFalsePositive: z.boolean().default(false).nullable().optional(),
+  isResolved: z.boolean().default(false).nullable().optional(),
+  riskOwner: z.string().nullable().optional(),
+  installationId: z.string(),
+  repositoryId: z.string().nullable().optional(),
+  repositoryLink: z.string().nullable().optional(),
+  repositoryFullName: z.string().nullable().optional(),
+  pusherName: z.string().nullable().optional(),
+  pusherEmail: z.string().nullable().optional(),
+  status: z.string().nullable().optional(),
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretScanningGitRisks = z.infer<typeof SecretScanningGitRisksSchema>;
+export type TSecretScanningGitRisksInsert = Omit<TSecretScanningGitRisks, TImmutableDBKeys>;
+export type TSecretScanningGitRisksUpdate = Partial<Omit<TSecretScanningGitRisks, TImmutableDBKeys>>;

backend/src/db/schemas/secret-snapshot-folders.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretSnapshotFoldersSchema = z.object({
+  id: z.string().uuid(),
+  envId: z.string().uuid(),
+  folderVersionId: z.string().uuid(),
+  snapshotId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretSnapshotFolders = z.infer<typeof SecretSnapshotFoldersSchema>;
+export type TSecretSnapshotFoldersInsert = Omit<TSecretSnapshotFolders, TImmutableDBKeys>;
+export type TSecretSnapshotFoldersUpdate = Partial<Omit<TSecretSnapshotFolders, TImmutableDBKeys>>;

backend/src/db/schemas/secret-snapshot-secrets.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretSnapshotSecretsSchema = z.object({
+  id: z.string().uuid(),
+  envId: z.string().uuid(),
+  secretVersionId: z.string().uuid(),
+  snapshotId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretSnapshotSecrets = z.infer<typeof SecretSnapshotSecretsSchema>;
+export type TSecretSnapshotSecretsInsert = Omit<TSecretSnapshotSecrets, TImmutableDBKeys>;
+export type TSecretSnapshotSecretsUpdate = Partial<Omit<TSecretSnapshotSecrets, TImmutableDBKeys>>;

backend/src/db/schemas/secret-snapshots.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretSnapshotsSchema = z.object({
+  id: z.string().uuid(),
+  envId: z.string().uuid(),
+  folderId: z.string().uuid(),
+  parentFolderId: z.string().uuid().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretSnapshots = z.infer<typeof SecretSnapshotsSchema>;
+export type TSecretSnapshotsInsert = Omit<TSecretSnapshots, TImmutableDBKeys>;
+export type TSecretSnapshotsUpdate = Partial<Omit<TSecretSnapshots, TImmutableDBKeys>>;

backend/src/db/schemas/secret-tag-junction.ts

@@ -0,0 +1,18 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretTagJunctionSchema = z.object({
+  id: z.string().uuid(),
+  secretsId: z.string().uuid(),
+  secret_tagsId: z.string().uuid(),
+});
+
+export type TSecretTagJunction = z.infer<typeof SecretTagJunctionSchema>;
+export type TSecretTagJunctionInsert = Omit<TSecretTagJunction, TImmutableDBKeys>;
+export type TSecretTagJunctionUpdate = Partial<Omit<TSecretTagJunction, TImmutableDBKeys>>;

backend/src/db/schemas/secret-tags.ts

@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretTagsSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  slug: z.string(),
+  color: z.string().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  createdBy: z.string().uuid().nullable().optional(),
+  projectId: z.string(),
+});
+
+export type TSecretTags = z.infer<typeof SecretTagsSchema>;
+export type TSecretTagsInsert = Omit<TSecretTags, TImmutableDBKeys>;
+export type TSecretTagsUpdate = Partial<Omit<TSecretTags, TImmutableDBKeys>>;

backend/src/db/schemas/secret-version-tag-junction.ts

@@ -0,0 +1,18 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretVersionTagJunctionSchema = z.object({
+  id: z.string().uuid(),
+  secret_versionsId: z.string().uuid(),
+  secret_tagsId: z.string().uuid(),
+});
+
+export type TSecretVersionTagJunction = z.infer<typeof SecretVersionTagJunctionSchema>;
+export type TSecretVersionTagJunctionInsert = Omit<TSecretVersionTagJunction, TImmutableDBKeys>;
+export type TSecretVersionTagJunctionUpdate = Partial<Omit<TSecretVersionTagJunction, TImmutableDBKeys>>;

backend/src/db/schemas/secret-versions.ts

@@ -0,0 +1,40 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretVersionsSchema = z.object({
+  id: z.string().uuid(),
+  version: z.number().default(1),
+  type: z.string().default('shared'),
+  secretBlindIndex: z.string(),
+  secretKeyCiphertext: z.string(),
+  secretKeyIV: z.string(),
+  secretKeyTag: z.string(),
+  secretValueCiphertext: z.string(),
+  secretValueIV: z.string(),
+  secretValueTag: z.string(),
+  secretCommentCiphertext: z.string().nullable().optional(),
+  secretCommentIV: z.string().nullable().optional(),
+  secretCommentTag: z.string().nullable().optional(),
+  secretReminderNote: z.string().nullable().optional(),
+  secretReminderRepeatDays: z.number().nullable().optional(),
+  skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
+  algorithm: z.string().default('aes-256-gcm'),
+  keyEncoding: z.string().default('utf8'),
+  metadata: z.unknown().nullable().optional(),
+  envId: z.string().uuid().nullable().optional(),
+  secretId: z.string().uuid(),
+  folderId: z.string().uuid(),
+  userId: z.string().uuid().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecretVersions = z.infer<typeof SecretVersionsSchema>;
+export type TSecretVersionsInsert = Omit<TSecretVersions, TImmutableDBKeys>;
+export type TSecretVersionsUpdate = Partial<Omit<TSecretVersions, TImmutableDBKeys>>;

backend/src/db/schemas/secrets.ts

@@ -0,0 +1,38 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretsSchema = z.object({
+  id: z.string().uuid(),
+  version: z.number().default(1),
+  type: z.string().default('shared'),
+  secretBlindIndex: z.string(),
+  secretKeyCiphertext: z.string(),
+  secretKeyIV: z.string(),
+  secretKeyTag: z.string(),
+  secretValueCiphertext: z.string(),
+  secretValueIV: z.string(),
+  secretValueTag: z.string(),
+  secretCommentCiphertext: z.string().nullable().optional(),
+  secretCommentIV: z.string().nullable().optional(),
+  secretCommentTag: z.string().nullable().optional(),
+  secretReminderNote: z.string().nullable().optional(),
+  secretReminderRepeatDays: z.number().nullable().optional(),
+  skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
+  algorithm: z.string().default('aes-256-gcm'),
+  keyEncoding: z.string().default('utf8'),
+  metadata: z.unknown().nullable().optional(),
+  userId: z.string().uuid().nullable().optional(),
+  folderId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSecrets = z.infer<typeof SecretsSchema>;
+export type TSecretsInsert = Omit<TSecrets, TImmutableDBKeys>;
+export type TSecretsUpdate = Partial<Omit<TSecrets, TImmutableDBKeys>>;

backend/src/db/schemas/service-tokens.ts

@@ -0,0 +1,29 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ServiceTokensSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  scopes: z.unknown(),
+  permissions: z.string().array(),
+  lastUsed: z.date().nullable().optional(),
+  expiresAt: z.date().nullable().optional(),
+  secretHash: z.string(),
+  encryptedKey: z.string().nullable().optional(),
+  iv: z.string().nullable().optional(),
+  tag: z.string().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  createdBy: z.string(),
+  projectId: z.string(),
+});
+
+export type TServiceTokens = z.infer<typeof ServiceTokensSchema>;
+export type TServiceTokensInsert = Omit<TServiceTokens, TImmutableDBKeys>;
+export type TServiceTokensUpdate = Partial<Omit<TServiceTokens, TImmutableDBKeys>>;

backend/src/db/schemas/super-admin.ts

@@ -0,0 +1,20 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SuperAdminSchema = z.object({
+  id: z.string().uuid(),
+  initialized: z.boolean().default(false).nullable().optional(),
+  allowSignUp: z.boolean().default(true).nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TSuperAdmin = z.infer<typeof SuperAdminSchema>;
+export type TSuperAdminInsert = Omit<TSuperAdmin, TImmutableDBKeys>;
+export type TSuperAdminUpdate = Partial<Omit<TSuperAdmin, TImmutableDBKeys>>;

backend/src/db/schemas/trusted-ips.ts

@@ -0,0 +1,24 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const TrustedIpsSchema = z.object({
+  id: z.string().uuid(),
+  ipAddress: z.string(),
+  type: z.string(),
+  prefix: z.number().nullable().optional(),
+  isActive: z.boolean().default(true).nullable().optional(),
+  comment: z.string().nullable().optional(),
+  projectId: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TTrustedIps = z.infer<typeof TrustedIpsSchema>;
+export type TTrustedIpsInsert = Omit<TTrustedIps, TImmutableDBKeys>;
+export type TTrustedIpsUpdate = Partial<Omit<TTrustedIps, TImmutableDBKeys>>;

backend/src/db/schemas/user-actions.ts

@@ -0,0 +1,20 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const UserActionsSchema = z.object({
+  id: z.string().uuid(),
+  action: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  userId: z.string().uuid(),
+});
+
+export type TUserActions = z.infer<typeof UserActionsSchema>;
+export type TUserActionsInsert = Omit<TUserActions, TImmutableDBKeys>;
+export type TUserActionsUpdate = Partial<Omit<TUserActions, TImmutableDBKeys>>;

backend/src/db/schemas/user-encryption-keys.ts

@@ -0,0 +1,29 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const UserEncryptionKeysSchema = z.object({
+  id: z.string().uuid(),
+  clientPublicKey: z.string().nullable().optional(),
+  serverPrivateKey: z.string().nullable().optional(),
+  encryptionVersion: z.number().default(2).nullable().optional(),
+  protectedKey: z.string().nullable(),
+  protectedKeyIV: z.string().nullable(),
+  protectedKeyTag: z.string().nullable(),
+  publicKey: z.string(),
+  encryptedPrivateKey: z.string(),
+  iv: z.string(),
+  tag: z.string(),
+  salt: z.string(),
+  verifier: z.string(),
+  userId: z.string().uuid(),
+});
+
+export type TUserEncryptionKeys = z.infer<typeof UserEncryptionKeysSchema>;
+export type TUserEncryptionKeysInsert = Omit<TUserEncryptionKeys, TImmutableDBKeys>;
+export type TUserEncryptionKeysUpdate = Partial<Omit<TUserEncryptionKeys, TImmutableDBKeys>>;

backend/src/db/schemas/users.ts

@@ -0,0 +1,27 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const UsersSchema = z.object({
+  id: z.string().uuid(),
+  email: z.string(),
+  authMethods: z.string().array().nullable().optional(),
+  superAdmin: z.boolean().default(false).nullable().optional(),
+  firstName: z.string().nullable().optional(),
+  lastName: z.string().nullable().optional(),
+  isAccepted: z.boolean().default(false).nullable().optional(),
+  isMfaEnabled: z.boolean().default(false).nullable().optional(),
+  mfaMethods: z.string().array().nullable().optional(),
+  devices: z.unknown().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TUsers = z.infer<typeof UsersSchema>;
+export type TUsersInsert = Omit<TUsers, TImmutableDBKeys>;
+export type TUsersUpdate = Partial<Omit<TUsers, TImmutableDBKeys>>;

backend/src/db/schemas/webhooks.ts

@@ -0,0 +1,29 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const WebhooksSchema = z.object({
+  id: z.string().uuid(),
+  secretPath: z.string().default('/'),
+  url: z.string(),
+  lastStatus: z.string().nullable().optional(),
+  lastRunErrorMessage: z.string().nullable().optional(),
+  isDisabled: z.boolean().default(false),
+  encryptedSecretKey: z.string().nullable().optional(),
+  iv: z.string().nullable().optional(),
+  tag: z.string().nullable().optional(),
+  algorithm: z.string().nullable().optional(),
+  keyEncoding: z.string().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  envId: z.string().uuid(),
+});
+
+export type TWebhooks = z.infer<typeof WebhooksSchema>;
+export type TWebhooksInsert = Omit<TWebhooks, TImmutableDBKeys>;
+export type TWebhooksUpdate = Partial<Omit<TWebhooks, TImmutableDBKeys>>;

backend/src/db/seed-data.ts

@@ -0,0 +1,140 @@
+import crypto from "node:crypto";
+
+import argon2, { argon2id } from "argon2";
+import jsrp from "jsrp";
+import nacl from "tweetnacl";
+import { encodeBase64 } from "tweetnacl-util";
+
+import {
+  // decryptAsymmetric,
+  decryptSymmetric,
+  encryptAsymmetric,
+  encryptSymmetric
+} from "@app/lib/crypto";
+
+import { TUserEncryptionKeys } from "./schemas";
+
+export const seedData1 = {
+  id: "3dafd81d-4388-432b-a4c5-f735616868c1",
+  email: "[email protected]",
+  password: process.env.TEST_USER_PASSWORD || "testInfisical@1",
+  organization: {
+    id: "180870b7-f464-4740-8ffe-9d11c9245ea7",
+    name: "infisical"
+  },
+  project: {
+    id: "77fa7aed-9288-401e-a4c9-3a9430be62a0",
+    name: "first project",
+    slug: "first-project"
+  },
+  environment: {
+    name: "Development",
+    slug: "dev"
+  },
+  token: {
+    id: "a9dfafba-a3b7-42e3-8618-91abb702fd36"
+  }
+};
+
+export const generateUserSrpKeys = async (password: string) => {
+  const pair = nacl.box.keyPair();
+  const secretKeyUint8Array = pair.secretKey;
+  const publicKeyUint8Array = pair.publicKey;
+  const privateKey = encodeBase64(secretKeyUint8Array);
+  const publicKey = encodeBase64(publicKeyUint8Array);
+
+  // eslint-disable-next-line
+  const client = new jsrp.client();
+  await new Promise((resolve) => {
+    client.init({ username: seedData1.email, password: seedData1.password }, () => resolve(null));
+  });
+  const { salt, verifier } = await new Promise<{ salt: string; verifier: string }>(
+    (resolve, reject) => {
+      client.createVerifier((err, res) => {
+        if (err) return reject(err);
+        return resolve(res);
+      });
+    }
+  );
+  const derivedKey = await argon2.hash(password, {
+    salt: Buffer.from(salt),
+    memoryCost: 65536,
+    timeCost: 3,
+    parallelism: 1,
+    hashLength: 32,
+    type: argon2id,
+    raw: true
+  });
+  if (!derivedKey) throw new Error("Failed to derive key from password");
+
+  const key = crypto.randomBytes(32);
+
+  // create encrypted private key by encrypting the private
+  // key with the symmetric key [key]
+  const {
+    ciphertext: encryptedPrivateKey,
+    iv: encryptedPrivateKeyIV,
+    tag: encryptedPrivateKeyTag
+  } = encryptSymmetric(privateKey, key.toString("base64"));
+
+  // create the protected key by encrypting the symmetric key
+  // [key] with the derived key
+  const {
+    ciphertext: protectedKey,
+    iv: protectedKeyIV,
+    tag: protectedKeyTag
+  } = encryptSymmetric(key.toString("hex"), derivedKey.toString("base64"));
+
+  return {
+    protectedKey,
+    protectedKeyIV,
+    protectedKeyTag,
+    publicKey,
+    encryptedPrivateKey,
+    encryptedPrivateKeyIV,
+    encryptedPrivateKeyTag,
+    salt,
+    verifier
+  };
+};
+
+export const getUserPrivateKey = async (password: string, user: TUserEncryptionKeys) => {
+  const derivedKey = await argon2.hash(password, {
+    salt: Buffer.from(user.salt),
+    memoryCost: 65536,
+    timeCost: 3,
+    parallelism: 1,
+    hashLength: 32,
+    type: argon2id,
+    raw: true
+  });
+  if (!derivedKey) throw new Error("Failed to derive key from password");
+  const key = decryptSymmetric({
+    ciphertext: user.protectedKey as string,
+    iv: user.protectedKeyIV as string,
+    tag: user.protectedKeyTag as string,
+    key: derivedKey.toString("base64")
+  });
+  const privateKey = decryptSymmetric({
+    ciphertext: user.encryptedPrivateKey,
+    iv: user.iv,
+    tag: user.tag,
+    key
+  });
+  return privateKey;
+};
+
+export const buildUserProjectKey = async (privateKey: string, publickey: string) => {
+  const randomBytes = crypto.randomBytes(16).toString("hex");
+  const { nonce, ciphertext } = encryptAsymmetric(randomBytes, publickey, privateKey);
+  return { nonce, ciphertext };
+};
+
+// export const getUserProjectKey = async (privateKey: string) => {
+//   const key = decryptAsymmetric({
+//     ciphertext: decryptFileKey.encryptedKey,
+//     nonce: decryptFileKey.nonce,
+//     publicKey: decryptFileKey.sender.publicKey,
+//     privateKey: PRIVATE_KEY
+//   });
+// };

backend/src/db/seeds/1-user.ts

@@ -0,0 +1,61 @@
+import { Knex } from "knex";
+
+import { AuthMethod } from "../../services/auth/auth-type";
+import { TableName } from "../schemas";
+import { generateUserSrpKeys, seedData1 } from "../seed-data";
+
+export async function seed(knex: Knex): Promise<void> {
+  // Deletes ALL existing entries
+  await knex(TableName.Users).del();
+  await knex(TableName.UserEncryptionKey).del();
+  await knex(TableName.SuperAdmin).del();
+  await knex(TableName.SuperAdmin).insert([{ initialized: true, allowSignUp: true }]);
+  // Inserts seed entries
+  const [user] = await knex(TableName.Users)
+    .insert([
+      {
+        // @ts-ignore to calculate predefined
+        id: seedData1.id,
+        email: seedData1.email,
+        superAdmin: true,
+        firstName: "test",
+        lastName: "",
+        authMethods: [AuthMethod.EMAIL],
+        isAccepted: true,
+        isMfaEnabled: false,
+        mfaMethods: null,
+        devices: null
+      }
+    ])
+    .returning("*");
+
+  const encKeys = await generateUserSrpKeys(seedData1.password);
+  // password: testInfisical@1
+  await knex(TableName.UserEncryptionKey).insert([
+    {
+      encryptionVersion: 2,
+      protectedKey: encKeys.protectedKey,
+      protectedKeyIV: encKeys.protectedKeyIV,
+      protectedKeyTag: encKeys.protectedKeyTag,
+      publicKey: encKeys.publicKey,
+      encryptedPrivateKey: encKeys.encryptedPrivateKey,
+      iv: encKeys.encryptedPrivateKeyIV,
+      tag: encKeys.encryptedPrivateKeyTag,
+      salt: encKeys.salt,
+      verifier: encKeys.verifier,
+      userId: user.id
+    }
+  ]);
+
+  await knex(TableName.AuthTokenSession).insert({
+    // @ts-ignore
+    id: seedData1.token.id,
+    userId: seedData1.id,
+    ip: "151.196.220.213",
+    userAgent:
+      "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36 RuxitSynthetic/1.0 v3690753611340580436 t8052286838287810618",
+    accessVersion: 1,
+    refreshVersion: 1,
+    lastUsed: new Date()
+  });
+}

backend/src/db/seeds/2-org.ts

@@ -0,0 +1,34 @@
+import { Knex } from "knex";
+
+import { OrgMembershipRole, OrgMembershipStatus, TableName } from "../schemas";
+import { seedData1 } from "../seed-data";
+
+export async function seed(knex: Knex): Promise<void> {
+  // Deletes ALL existing entries
+  await knex(TableName.Organization).del();
+  await knex(TableName.OrgMembership).del();
+
+  const user = await knex(TableName.Users).where({ email: seedData1.email }).first();
+  if (!user) throw new Error("User not found");
+  // Inserts seed entries
+  const [org] = await knex(TableName.Organization)
+    .insert([
+      {
+        // @ts-ignore because we need that id for api calls
+        id: seedData1.organization.id,
+        name: "infisical",
+        slug: "infisical",
+        customerId: null
+      }
+    ])
+    .returning("*");
+
+  await knex(TableName.OrgMembership).insert([
+    {
+      role: OrgMembershipRole.Admin,
+      orgId: org.id,
+      status: OrgMembershipStatus.Accepted,
+      userId: user.id
+    }
+  ]);
+}

backend/src/db/seeds/3-project.ts

@@ -0,0 +1,51 @@
+import { Knex } from "knex";
+
+import { OrgMembershipRole, TableName } from "../schemas";
+import { seedData1 } from "../seed-data";
+
+export const DEFAULT_PROJECT_ENVS = [
+  { name: "Development", slug: "dev" },
+  { name: "Staging", slug: "staging" },
+  { name: "Production", slug: "prod" }
+];
+
+export async function seed(knex: Knex): Promise<void> {
+  // Deletes ALL existing entries
+  await knex(TableName.Project).del();
+  await knex(TableName.Environment).del();
+  await knex(TableName.SecretFolder).del();
+
+  const [project] = await knex(TableName.Project)
+    .insert({
+      name: seedData1.project.name,
+      orgId: seedData1.organization.id,
+      slug: "first-project",
+      // @ts-ignore pre calc id
+      id: seedData1.project.id
+    })
+    .returning("*");
+
+  // await knex(TableName.ProjectKeys).insert({
+  //   projectId: project.id,
+  //   senderId: seedData1.id
+  // });
+
+  await knex(TableName.ProjectMembership).insert({
+    projectId: project.id,
+    role: OrgMembershipRole.Admin,
+    userId: seedData1.id
+  });
+  const envs = await knex(TableName.Environment)
+    .insert(
+      DEFAULT_PROJECT_ENVS.map(({ name, slug }, index) => ({
+        name,
+        slug,
+        projectId: project.id,
+        position: index + 1
+      }))
+    )
+    .returning("*");
+  await knex(TableName.SecretFolder).insert(
+    envs.map(({ id }) => ({ name: "root", envId: id, parentId: null }))
+  );
+}

backend/src/db/utils.ts

@@ -0,0 +1,45 @@
+import { Knex } from "knex";
+
+import { TableName } from "./schemas";
+
+export const createJunctionTable = (
+  knex: Knex,
+  tableName: TableName,
+  table1Name: TableName,
+  table2Name: TableName
+) =>
+  knex.schema.createTable(tableName, (table) => {
+    table.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+    table.uuid(`${table1Name}Id`).unsigned().notNullable(); // Foreign key for table1
+    table.uuid(`${table2Name}Id`).unsigned().notNullable(); // Foreign key for table2
+    table.foreign(`${table1Name}Id`).references("id").inTable(table1Name).onDelete("CASCADE");
+    table.foreign(`${table2Name}Id`).references("id").inTable(table2Name).onDelete("CASCADE");
+  });
+
+// one time logic
+// this is a postgres function log to set updateAt to present time whenever row gets updated
+export const createUpdateAtTriggerFunction = (knex: Knex) =>
+  knex.raw(`
+CREATE OR REPLACE FUNCTION on_update_timestamp() RETURNS TRIGGER AS $$ BEGIN NEW."updatedAt" = NOW();
+RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+`);
+
+export const dropUpdatedAtTriggerFunction = (knex: Knex) =>
+  knex.raw(`
+DROP FUNCTION IF EXISTS on_update_timestamp() CASCADE;
+`);
+
+// we would be using this to apply updatedAt where ever we wanta
+// remember to set `timestamps(true,true,true)` before this on schema
+export const createOnUpdateTrigger = (knex: Knex, tableName: string) =>
+  knex.raw(`
+CREATE TRIGGER "${tableName}_updatedAt"
+BEFORE UPDATE ON ${tableName}
+FOR EACH ROW
+EXECUTE PROCEDURE on_update_timestamp();
+`);
+
+export const dropOnUpdateTrigger = (knex: Knex, tableName: string) =>
+  knex.raw(`DROP TRIGGER IF EXISTS "${tableName}_updatedAt" ON ${tableName}`);