feat: changed backend-pg to backend

backend/src/db/migrations/20231128072457_user.ts

@@ -0,0 +1,37 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import {
+  createOnUpdateTrigger,
+  createUpdateAtTriggerFunction,
+  dropOnUpdateTrigger,
+  dropUpdatedAtTriggerFunction
+} from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.Users);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.Users, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("email").unique().notNullable();
+      t.specificType("authMethods", "text[]");
+      t.boolean("superAdmin").defaultTo(false);
+      t.string("firstName");
+      t.string("lastName");
+      t.boolean("isAccepted").defaultTo(false);
+      t.boolean("isMfaEnabled").defaultTo(false);
+      t.specificType("mfaMethods", "text[]");
+      t.jsonb("devices");
+      t.timestamps(true, true, true);
+    });
+  }
+  // this is a one time function
+  await createUpdateAtTriggerFunction(knex);
+  await createOnUpdateTrigger(knex, TableName.Users);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Users);
+  await dropOnUpdateTrigger(knex, TableName.Users);
+  await dropUpdatedAtTriggerFunction(knex);
+}

backend/src/db/migrations/20231128092347_user-encryption-key.ts

@@ -0,0 +1,31 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.UserEncryptionKey);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.UserEncryptionKey, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("clientPublicKey");
+      t.text("serverPrivateKey");
+      t.integer("encryptionVersion").defaultTo(2);
+      t.text("protectedKey");
+      t.text("protectedKeyIV");
+      t.text("protectedKeyTag");
+      t.text("publicKey").notNullable();
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("iv").notNullable();
+      t.text("tag").notNullable();
+      t.text("salt").notNullable();
+      t.text("verifier").notNullable();
+      // one to one relationship
+      t.uuid("userId").notNullable().unique();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.UserEncryptionKey);
+}

backend/src/db/migrations/20231129072939_auth-token.ts

@@ -0,0 +1,25 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.AuthTokens);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.AuthTokens, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("type").notNullable();
+      t.string("phoneNumber");
+      t.string("tokenHash").notNullable();
+      t.integer("triesLeft");
+      t.datetime("expiresAt").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.AuthTokens);
+}

backend/src/db/migrations/20231130072734_auth-token-session.ts

@@ -0,0 +1,29 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.AuthTokenSession);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.AuthTokenSession, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("ip").notNullable();
+      t.string("userAgent");
+      t.integer("refreshVersion").notNullable().defaultTo(1);
+      t.integer("accessVersion").notNullable().defaultTo(1);
+      t.datetime("lastUsed").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.AuthTokenSession);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.AuthTokenSession);
+  await dropOnUpdateTrigger(knex, TableName.AuthTokenSession);
+}

backend/src/db/migrations/20231201151432_backup-key.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const doesTableExist = await knex.schema.hasTable(TableName.BackupPrivateKey);
+  if (!doesTableExist) {
+    await knex.schema.createTable(TableName.BackupPrivateKey, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("iv").notNullable();
+      t.text("tag").notNullable();
+      t.string("algorithm").notNullable();
+      t.string("keyEncoding").notNullable();
+      t.text("salt").notNullable();
+      t.text("verifier").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable().unique();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.BackupPrivateKey);
+}

backend/src/db/migrations/20231204092737_organization.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.Organization);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.Organization, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("customerId");
+      t.string("slug").notNullable();
+      // does not need update trigger we will do it manually
+      t.unique("slug");
+      t.timestamps(true, true, true);
+    });
+    await knex.schema.alterTable(TableName.AuthTokens, (t) => {
+      t.uuid("orgId");
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.Organization);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.AuthTokens, "orgId")) {
+    await knex.schema.alterTable(TableName.AuthTokens, (t) => {
+      t.dropColumn("orgId");
+    });
+  }
+  await knex.schema.dropTableIfExists(TableName.Organization);
+  await dropOnUpdateTrigger(knex, TableName.Organization);
+}

backend/src/db/migrations/20231204092747_org-membership.ts

@@ -0,0 +1,48 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { OrgMembershipStatus } from "../schemas/models";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isOrgRolePresent = await knex.schema.hasTable(TableName.OrgRoles);
+  if (!isOrgRolePresent) {
+    await knex.schema.createTable(TableName.OrgRoles, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("description");
+      t.string("slug").notNullable();
+      t.jsonb("permissions").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    });
+  }
+
+  const isOrgTablePresent = await knex.schema.hasTable(TableName.OrgMembership);
+  if (!isOrgTablePresent) {
+    await knex.schema.createTable(TableName.OrgMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      t.string("status").notNullable().defaultTo(OrgMembershipStatus.Invited);
+      t.string("inviteEmail");
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.OrgRoles);
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.OrgMembership);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.OrgMembership);
+  await knex.schema.dropTableIfExists(TableName.OrgRoles);
+  await dropOnUpdateTrigger(knex, TableName.OrgMembership);
+}

backend/src/db/migrations/20231205151331_incident-contact.ts

@@ -0,0 +1,25 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.IncidentContact);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.IncidentContact, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("email").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.IncidentContact);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IncidentContact);
+  await dropOnUpdateTrigger(knex, TableName.IncidentContact);
+}

backend/src/db/migrations/20231207055643_user-action.ts

@@ -0,0 +1,20 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.UserAction);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.UserAction, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("action").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.UserAction);
+}

backend/src/db/migrations/20231207055701_super-admin.ts

@@ -0,0 +1,23 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.SuperAdmin);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.SuperAdmin, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.boolean("initialized").defaultTo(false);
+      t.boolean("allowSignUp").defaultTo(true);
+      t.timestamps(true, true, true);
+    });
+  }
+  // this is a one time function
+  await createOnUpdateTrigger(knex, TableName.SuperAdmin);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SuperAdmin);
+  await dropOnUpdateTrigger(knex, TableName.SuperAdmin);
+}

backend/src/db/migrations/20231207105059_api-key.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const isTablePresent = await knex.schema.hasTable(TableName.ApiKey);
+  if (!isTablePresent) {
+    await knex.schema.createTable(TableName.ApiKey, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.datetime("lastUsed");
+      t.datetime("expiresAt");
+      t.string("secretHash").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ApiKey);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ApiKey);
+  await dropOnUpdateTrigger(knex, TableName.ApiKey);
+}

backend/src/db/migrations/20231212110939_project.ts

@@ -0,0 +1,62 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Project))) {
+    await knex.schema.createTable(TableName.Project, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("slug").notNullable();
+      t.boolean("autoCapitalization").defaultTo(true);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+      t.unique(["orgId", "slug"]);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Project);
+  // environments
+  if (!(await knex.schema.hasTable(TableName.Environment))) {
+    await knex.schema.createTable(TableName.Environment, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("slug").notNullable();
+      t.integer("position").notNullable();
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      // this will ensure ever env has its position
+      t.unique(["projectId", "position"], {
+        indexName: "env_pos_composite_uniqe",
+        deferrable: "deferred"
+      });
+      t.timestamps(true, true, true);
+    });
+  }
+  // project key
+  if (!(await knex.schema.hasTable(TableName.ProjectKeys))) {
+    await knex.schema.createTable(TableName.ProjectKeys, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("encryptedKey").notNullable();
+      t.text("nonce").notNullable();
+      t.uuid("receiverId").notNullable();
+      t.foreign("receiverId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.uuid("senderId");
+      // if sender is deleted just don't do anything to this record
+      t.foreign("senderId").references("id").inTable(TableName.Users).onDelete("SET NULL");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ProjectKeys);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Environment);
+  await knex.schema.dropTableIfExists(TableName.ProjectKeys);
+  await knex.schema.dropTableIfExists(TableName.Project);
+  await dropOnUpdateTrigger(knex, TableName.ProjectKeys);
+  await dropOnUpdateTrigger(knex, TableName.Project);
+}

backend/src/db/migrations/20231212110946_project-membership.ts

@@ -0,0 +1,43 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.ProjectRoles))) {
+    await knex.schema.createTable(TableName.ProjectRoles, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("description");
+      t.string("slug").notNullable();
+      t.jsonb("permissions").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+
+  if (!(await knex.schema.hasTable(TableName.ProjectMembership))) {
+    await knex.schema.createTable(TableName.ProjectMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      // does not need update trigger we will do it manually
+      t.timestamps(true, true, true);
+      t.uuid("userId").notNullable();
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      // until role is changed/removed the role should not deleted
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.ProjectRoles);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ProjectMembership);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ProjectMembership);
+  await knex.schema.dropTableIfExists(TableName.ProjectRoles);
+  await dropOnUpdateTrigger(knex, TableName.ProjectMembership);
+}

backend/src/db/migrations/20231218092441_secret-folder.ts

@@ -0,0 +1,42 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretFolder))) {
+    await knex.schema.createTable(TableName.SecretFolder, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.integer("version").defaultTo(1);
+      t.timestamps(true, true, true);
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.uuid("parentId");
+      t.foreign("parentId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretFolder);
+
+  if (!(await knex.schema.hasTable(TableName.SecretFolderVersion))) {
+    await knex.schema.createTable(TableName.SecretFolderVersion, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.integer("version").defaultTo(1);
+      t.timestamps(true, true, true);
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.uuid("folderId").notNullable();
+      // t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("SET NULL");
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.SecretFolderVersion);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretFolderVersion);
+  await knex.schema.dropTableIfExists(TableName.SecretFolder);
+  await dropOnUpdateTrigger(knex, TableName.SecretFolder);
+  await dropOnUpdateTrigger(knex, TableName.SecretFolderVersion);
+}

backend/src/db/migrations/20231218092508_secret-import.ts

@@ -0,0 +1,30 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretImport))) {
+    await knex.schema.createTable(TableName.SecretImport, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1);
+      t.string("importPath").notNullable();
+      t.uuid("importEnv").notNullable();
+      t.foreign("importEnv").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.integer("position").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("folderId").notNullable();
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+      t.unique(["folderId", "position"], {
+        indexName: "import_pos_composite_uniqe",
+        deferrable: "deferred"
+      });
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretImport);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretImport);
+  await dropOnUpdateTrigger(knex, TableName.SecretImport);
+}

backend/src/db/migrations/20231218092517_secret-tag.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretTag))) {
+    await knex.schema.createTable(TableName.SecretTag, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("slug").notNullable();
+      t.string("color");
+      t.timestamps(true, true, true);
+      t.uuid("createdBy");
+      t.foreign("createdBy").references("id").inTable(TableName.Users).onDelete("SET NULL");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretTag);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretTag);
+  await dropOnUpdateTrigger(knex, TableName.SecretTag);
+}

backend/src/db/migrations/20231218103423_secret.ts

@@ -0,0 +1,66 @@
+import { Knex } from "knex";
+
+import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, TableName } from "../schemas";
+import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretBlindIndex))) {
+    await knex.schema.createTable(TableName.SecretBlindIndex, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.text("encryptedSaltCipherText").notNullable();
+      t.text("saltIV").notNullable();
+      t.text("saltTag").notNullable();
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.string("projectId").notNullable().unique();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretBlindIndex);
+
+  if (!(await knex.schema.hasTable(TableName.Secret))) {
+    await knex.schema.createTable(TableName.Secret, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1).notNullable();
+      t.string("type").notNullable().defaultTo(SecretType.Shared);
+      // t.text("secretKeyHash").notNullable();
+      // t.text("secretValueHash");
+      // t.text("secretCommentHash");
+      t.text("secretBlindIndex");
+      t.text("secretKeyCiphertext").notNullable();
+      t.text("secretKeyIV").notNullable();
+      t.text("secretKeyTag").notNullable();
+      t.text("secretValueCiphertext").notNullable();
+      t.text("secretValueIV").notNullable(); // symmetric encryption
+      t.text("secretValueTag").notNullable();
+      t.text("secretCommentCiphertext");
+      t.text("secretCommentIV");
+      t.text("secretCommentTag");
+      t.string("secretReminderNote");
+      t.integer("secretReminderRepeatDays");
+      t.boolean("skipMultilineEncoding").defaultTo(false);
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.jsonb("metadata");
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.uuid("folderId").notNullable();
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+      t.index("secretBlindIndex");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Secret);
+  // many to many relation between tags
+  await createJunctionTable(knex, TableName.JnSecretTag, TableName.Secret, TableName.SecretTag);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretBlindIndex);
+  await dropOnUpdateTrigger(knex, TableName.SecretBlindIndex);
+
+  await knex.schema.dropTableIfExists(TableName.JnSecretTag);
+  await knex.schema.dropTableIfExists(TableName.Secret);
+  await dropOnUpdateTrigger(knex, TableName.Secret);
+}

backend/src/db/migrations/20231220052508_secret-version.ts

@@ -0,0 +1,53 @@
+import { Knex } from "knex";
+
+import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, TableName } from "../schemas";
+import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretVersion))) {
+    await knex.schema.createTable(TableName.SecretVersion, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1).notNullable();
+      t.string("type").notNullable().defaultTo(SecretType.Shared);
+      t.text("secretBlindIndex");
+      t.text("secretKeyCiphertext").notNullable();
+      t.text("secretKeyIV").notNullable();
+      t.text("secretKeyTag").notNullable();
+      t.text("secretValueCiphertext").notNullable();
+      t.text("secretValueIV").notNullable(); // symmetric encryption
+      t.text("secretValueTag").notNullable();
+      t.text("secretCommentCiphertext");
+      t.text("secretCommentIV");
+      t.text("secretCommentTag");
+      t.string("secretReminderNote");
+      t.integer("secretReminderRepeatDays");
+      t.boolean("skipMultilineEncoding").defaultTo(false);
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.jsonb("metadata");
+      // to avoid orphan rows
+      t.uuid("envId");
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.uuid("secretId").notNullable();
+      t.uuid("folderId").notNullable();
+      // t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("SET NULL");
+      t.uuid("userId");
+      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretVersion);
+  // many to many relation between tags
+  await createJunctionTable(
+    knex,
+    TableName.SecretVersionTag,
+    TableName.SecretVersion,
+    TableName.SecretTag
+  );
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretVersionTag);
+  await knex.schema.dropTableIfExists(TableName.SecretVersion);
+  await dropOnUpdateTrigger(knex, TableName.SecretVersion);
+}

backend/src/db/migrations/20231222092113_project-bot.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.ProjectBot))) {
+    await knex.schema.createTable(TableName.ProjectBot, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.boolean("isActive").defaultTo(false).notNullable();
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("publicKey").notNullable();
+      t.text("iv").notNullable();
+      t.text("tag").notNullable();
+      t.string("algorithm").notNullable();
+      t.string("keyEncoding").notNullable();
+      t.text("encryptedProjectKey");
+      t.text("encryptedProjectKeyNonce");
+      // one to one relationship
+      t.string("projectId").notNullable().unique();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.uuid("senderId");
+      t.foreign("senderId").references("id").inTable(TableName.Users).onDelete("SET NULL");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.ProjectBot);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ProjectBot);
+  await dropOnUpdateTrigger(knex, TableName.ProjectBot);
+}

backend/src/db/migrations/20231222172455_integration.ts

@@ -0,0 +1,71 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IntegrationAuth))) {
+    await knex.schema.createTable(TableName.IntegrationAuth, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("integration").notNullable();
+      t.string("teamId"); // vercel-specific
+      t.string("url"); // for self hosted
+      t.string("namespace"); // hashicorp specific
+      t.string("accountId"); // netlify
+      t.text("refreshCiphertext");
+      t.string("refreshIV");
+      t.string("refreshTag");
+      t.string("accessIdCiphertext");
+      t.string("accessIdIV");
+      t.string("accessIdTag");
+      t.text("accessCiphertext");
+      t.string("accessIV");
+      t.string("accessTag");
+      t.datetime("accessExpiresAt");
+      t.jsonb("metadata");
+      t.string("algorithm").notNullable();
+      t.string("keyEncoding").notNullable();
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IntegrationAuth);
+
+  if (!(await knex.schema.hasTable(TableName.Integration))) {
+    await knex.schema.createTable(TableName.Integration, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.boolean("isActive").notNullable();
+      t.string("url"); // self hosted
+      t.string("app"); // name of app in provider
+      t.string("appId");
+      t.string("targetEnvironment");
+      t.string("targetEnvironmentId");
+      t.string("targetService"); // railway - qovery specific
+      t.string("targetServiceId");
+      t.string("owner"); // github specific
+      t.string("path"); // aws parameter store / vercel preview branch
+      t.string("region"); // aws
+      t.string("scope"); // qovery specific scope
+      t.string("integration").notNullable();
+      t.jsonb("metadata");
+      t.uuid("integrationAuthId").notNullable();
+      t.foreign("integrationAuthId")
+        .references("id")
+        .inTable(TableName.IntegrationAuth)
+        .onDelete("CASCADE");
+      t.uuid("envId").notNullable();
+      t.string("secretPath").defaultTo("/").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Integration);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Integration);
+  await knex.schema.dropTableIfExists(TableName.IntegrationAuth);
+  await dropOnUpdateTrigger(knex, TableName.IntegrationAuth);
+  await dropOnUpdateTrigger(knex, TableName.Integration);
+}

backend/src/db/migrations/20231225072545_service-token.ts

@@ -0,0 +1,32 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.ServiceToken))) {
+    await knex.schema.createTable(TableName.ServiceToken, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.jsonb("scopes").notNullable();
+      t.specificType("permissions", "text[]").notNullable();
+      t.datetime("lastUsed");
+      t.datetime("expiresAt");
+      t.text("secretHash").notNullable();
+      t.text("encryptedKey");
+      t.text("iv");
+      t.text("tag");
+      t.timestamps(true, true, true);
+      // user is old one
+      t.string("createdBy").notNullable();
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.ServiceToken);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ServiceToken);
+  await dropOnUpdateTrigger(knex, TableName.ServiceToken);
+}

backend/src/db/migrations/20231225072552_webhook.ts

@@ -0,0 +1,32 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Webhook))) {
+    await knex.schema.createTable(TableName.Webhook, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("secretPath").notNullable().defaultTo("/");
+      t.string("url").notNullable();
+      t.string("lastStatus");
+      t.text("lastRunErrorMessage");
+      t.boolean("isDisabled").defaultTo(false).notNullable();
+      // webhook signature
+      t.text("encryptedSecretKey");
+      t.text("iv");
+      t.text("tag");
+      t.string("algorithm");
+      t.string("keyEncoding");
+      t.timestamps(true, true, true);
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Webhook);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Webhook);
+  await dropOnUpdateTrigger(knex, TableName.Webhook);
+}

backend/src/db/migrations/20231228074856_identity.ts

@@ -0,0 +1,21 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Identity))) {
+    await knex.schema.createTable(TableName.Identity, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("authMethod");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Identity);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.Identity);
+  await dropOnUpdateTrigger(knex, TableName.Identity);
+}

backend/src/db/migrations/20231228074908_identity-universal-auth.ts

@@ -0,0 +1,49 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IdentityUniversalAuth))) {
+    await knex.schema.createTable(TableName.IdentityUniversalAuth, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("clientId").notNullable();
+      t.bigInteger("accessTokenTTL").defaultTo(7200).notNullable();
+      t.bigInteger("accessTokenMaxTTL").defaultTo(7200).notNullable();
+      t.bigInteger("accessTokenNumUsesLimit").defaultTo(0).notNullable();
+      t.jsonb("clientSecretTrustedIps").notNullable();
+      t.jsonb("accessTokenTrustedIps").notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("identityId").notNullable().unique();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+    });
+  }
+  if (!(await knex.schema.hasTable(TableName.IdentityUaClientSecret))) {
+    await knex.schema.createTable(TableName.IdentityUaClientSecret, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.string("description").notNullable();
+      t.string("clientSecretPrefix").notNullable();
+      t.string("clientSecretHash").notNullable();
+      t.datetime("clientSecretLastUsedAt");
+      t.bigInteger("clientSecretNumUses").defaultTo(0).notNullable();
+      t.bigInteger("clientSecretNumUsesLimit").defaultTo(0).notNullable();
+      t.bigInteger("clientSecretTTL").defaultTo(0).notNullable();
+      t.boolean("isClientSecretRevoked").defaultTo(false).notNullable();
+      t.timestamps(true, true, true);
+      t.uuid("identityUAId").notNullable();
+      t.foreign("identityUAId")
+        .references("id")
+        .inTable(TableName.IdentityUniversalAuth)
+        .onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IdentityUniversalAuth);
+  await createOnUpdateTrigger(knex, TableName.IdentityUaClientSecret);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IdentityUaClientSecret);
+  await knex.schema.dropTableIfExists(TableName.IdentityUniversalAuth);
+  await dropOnUpdateTrigger(knex, TableName.IdentityUaClientSecret);
+  await dropOnUpdateTrigger(knex, TableName.IdentityUniversalAuth);
+}

backend/src/db/migrations/20231228075011_identity-access-token.ts

@@ -0,0 +1,34 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IdentityAccessToken))) {
+    await knex.schema.createTable(TableName.IdentityAccessToken, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.bigInteger("accessTokenTTL").defaultTo(2592000).notNullable(); // 30 days second
+      t.bigInteger("accessTokenMaxTTL").defaultTo(2592000).notNullable();
+      t.bigInteger("accessTokenNumUses").defaultTo(0).notNullable();
+      t.bigInteger("accessTokenNumUsesLimit").defaultTo(0).notNullable();
+      t.datetime("accessTokenLastUsedAt");
+      t.datetime("accessTokenLastRenewedAt");
+      t.boolean("isAccessTokenRevoked").defaultTo(false).notNullable();
+      t.string("identityUAClientSecretId");
+      t.foreign("identityUAClientSecretId")
+        .references("id")
+        .inTable(TableName.IdentityUaClientSecret)
+        .onDelete("CASCADE");
+        t.uuid("identityId").notNullable();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.IdentityAccessToken);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IdentityAccessToken);
+  await dropOnUpdateTrigger(knex, TableName.IdentityAccessToken);
+}

backend/src/db/migrations/20231228075023_identity-membership.ts

@@ -0,0 +1,44 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.IdentityOrgMembership))) {
+    await knex.schema.createTable(TableName.IdentityOrgMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.OrgRoles);
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+      t.uuid("identityId").notNullable();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IdentityOrgMembership);
+
+  if (!(await knex.schema.hasTable(TableName.IdentityProjectMembership))) {
+    await knex.schema.createTable(TableName.IdentityProjectMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("role").notNullable();
+      t.uuid("roleId");
+      t.foreign("roleId").references("id").inTable(TableName.ProjectRoles);
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.uuid("identityId").notNullable();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.IdentityProjectMembership);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.IdentityOrgMembership);
+  await knex.schema.dropTableIfExists(TableName.IdentityProjectMembership);
+
+  await dropOnUpdateTrigger(knex, TableName.IdentityProjectMembership);
+  await dropOnUpdateTrigger(knex, TableName.IdentityOrgMembership);
+}

backend/src/db/migrations/20240101054849_secret-approval-policy.ts

@@ -0,0 +1,45 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicy))) {
+    await knex.schema.createTable(TableName.SecretApprovalPolicy, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.string("secretPath");
+      t.integer("approvals").defaultTo(1).notNullable();
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicy);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicyApprover))) {
+    await knex.schema.createTable(TableName.SecretApprovalPolicyApprover, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("approverId").notNullable();
+      t.foreign("approverId")
+        .references("id")
+        .inTable(TableName.ProjectMembership)
+        .onDelete("CASCADE");
+      t.uuid("policyId").notNullable();
+      t.foreign("policyId")
+        .references("id")
+        .inTable(TableName.SecretApprovalPolicy)
+        .onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyApprover);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicyApprover);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicy);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicyApprover);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicy);
+}

backend/src/db/migrations/20240101104907_secret-approval-request.ts

@@ -0,0 +1,118 @@
+import { Knex } from "knex";
+
+import { SecretEncryptionAlgo, SecretKeyEncoding, TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequest))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequest, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("policyId").notNullable();
+      t.boolean("hasMerged").defaultTo(false).notNullable();
+      t.string("status").defaultTo("open").notNullable();
+      t.jsonb("conflicts");
+      t.foreign("policyId")
+        .references("id")
+        .inTable(TableName.SecretApprovalPolicy)
+        .onDelete("CASCADE");
+      t.string("slug").notNullable();
+      t.uuid("folderId").notNullable();
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+      t.uuid("statusChangeBy");
+      t.foreign("statusChangeBy")
+        .references("id")
+        .inTable(TableName.ProjectMembership)
+        .onDelete("SET NULL");
+      t.uuid("committerId").notNullable();
+      t.foreign("committerId")
+        .references("id")
+        .inTable(TableName.ProjectMembership)
+        .onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequest);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestReviewer))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequestReviewer, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("member").notNullable();
+      t.foreign("member").references("id").inTable(TableName.ProjectMembership).onDelete("CASCADE");
+      t.string("status").notNullable();
+      t.uuid("requestId").notNullable();
+      t.foreign("requestId")
+        .references("id")
+        .inTable(TableName.SecretApprovalRequest)
+        .onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestReviewer);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecret))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequestSecret, (t) => {
+      // everything related  to secret
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.integer("version").defaultTo(1);
+      t.text("secretBlindIndex");
+      t.text("secretKeyCiphertext").notNullable();
+      t.text("secretKeyIV").notNullable();
+      t.text("secretKeyTag").notNullable();
+      t.text("secretValueCiphertext").notNullable();
+      t.text("secretValueIV").notNullable(); // symmetric encryption
+      t.text("secretValueTag").notNullable();
+      t.text("secretCommentCiphertext");
+      t.text("secretCommentIV");
+      t.text("secretCommentTag");
+      t.string("secretReminderNote");
+      t.integer("secretReminderRepeatDays");
+      t.boolean("skipMultilineEncoding").defaultTo(false);
+      t.string("algorithm").notNullable().defaultTo(SecretEncryptionAlgo.AES_256_GCM);
+      t.string("keyEncoding").notNullable().defaultTo(SecretKeyEncoding.UTF8);
+      t.jsonb("metadata");
+      t.timestamps(true, true, true);
+      // commit details
+      t.uuid("requestId").notNullable();
+      t.foreign("requestId")
+        .references("id")
+        .inTable(TableName.SecretApprovalRequest)
+        .onDelete("CASCADE");
+      t.string("op").notNullable();
+      t.uuid("secretId");
+      t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("SET NULL");
+      t.uuid("secretVersion");
+      t.foreign("secretVersion")
+        .references("id")
+        .inTable(TableName.SecretVersion)
+        .onDelete("SET NULL");
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecret);
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecretTag))) {
+    await knex.schema.createTable(TableName.SecretApprovalRequestSecretTag, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("secretId").notNullable();
+      t.foreign("secretId")
+        .references("id")
+        .inTable(TableName.SecretApprovalRequestSecret)
+        .onDelete("CASCADE");
+      t.uuid("tagId").notNullable();
+      t.foreign("tagId").references("id").inTable(TableName.SecretTag).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecretTag);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecretTag);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecret);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestReviewer);
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequest);
+
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecretTag);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecret);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestReviewer);
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequest);
+}

backend/src/db/migrations/20240102152111_secret-rotation.ts

@@ -0,0 +1,47 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SecretRotation))) {
+    await knex.schema.createTable(TableName.SecretRotation, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("provider").notNullable();
+      t.string("secretPath").notNullable();
+      t.integer("interval").notNullable();
+      t.datetime("lastRotatedAt");
+      t.string("status");
+      t.text("statusMessage");
+      t.text("encryptedData");
+      t.text("encryptedDataIV");
+      t.text("encryptedDataTag");
+      t.string("algorithm");
+      t.string("keyEncoding");
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.SecretRotation);
+
+  if (!(await knex.schema.hasTable(TableName.SecretRotationOutput))) {
+    await knex.schema.createTable(TableName.SecretRotationOutput, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("key").notNullable();
+      t.uuid("secretId").notNullable();
+      t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("CASCADE");
+      t.uuid("rotationId").notNullable();
+      t.foreign("rotationId")
+        .references("id")
+        .inTable(TableName.SecretRotation)
+        .onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretRotationOutput);
+  await knex.schema.dropTableIfExists(TableName.SecretRotation);
+  await dropOnUpdateTrigger(knex, TableName.SecretRotation);
+}

backend/src/db/migrations/20240104140641_secret-snapshot.ts

@@ -0,0 +1,61 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.Snapshot))) {
+    await knex.schema.createTable(TableName.Snapshot, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      // this is not a relation kept like that
+      // this ensure snapshot are not lost when folder gets deleted and rolled back
+      t.uuid("folderId").notNullable();
+      t.uuid("parentFolderId");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.Snapshot);
+
+  if (!(await knex.schema.hasTable(TableName.SnapshotSecret))) {
+    await knex.schema.createTable(TableName.SnapshotSecret, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      // not a relation kept like that to keep it when rolled back
+      t.uuid("secretVersionId").notNullable();
+      t.foreign("secretVersionId")
+        .references("id")
+        .inTable(TableName.SecretVersion)
+        .onDelete("CASCADE");
+      t.uuid("snapshotId").notNullable();
+      t.foreign("snapshotId").references("id").inTable(TableName.Snapshot).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  if (!(await knex.schema.hasTable(TableName.SnapshotFolder))) {
+    await knex.schema.createTable(TableName.SnapshotFolder, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("envId").notNullable();
+      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      // not a relation kept like that to keep it when rolled back
+      t.uuid("folderVersionId").notNullable();
+      t.foreign("folderVersionId")
+        .references("id")
+        .inTable(TableName.SecretFolderVersion)
+        .onDelete("CASCADE");
+      t.uuid("snapshotId").notNullable();
+      t.foreign("snapshotId").references("id").inTable(TableName.Snapshot).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SnapshotSecret);
+  await knex.schema.dropTableIfExists(TableName.SnapshotFolder);
+  await knex.schema.dropTableIfExists(TableName.Snapshot);
+  await dropOnUpdateTrigger(knex, TableName.Snapshot);
+}

backend/src/db/migrations/20240107153439_saml-config.ts

@@ -0,0 +1,33 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.SamlConfig))) {
+    await knex.schema.createTable(TableName.SamlConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("authProvider").notNullable();
+      t.boolean("isActive").notNullable();
+      t.string("encryptedEntryPoint");
+      t.string("entryPointIV");
+      t.string("entryPointTag");
+      t.string("encryptedIssuer");
+      t.string("issuerTag");
+      t.string("issuerIV");
+      t.text("encryptedCert");
+      t.string("certIV");
+      t.string("certTag");
+      t.timestamps(true, true, true);
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.SamlConfig);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SamlConfig);
+  await dropOnUpdateTrigger(knex, TableName.SamlConfig);
+}

backend/src/db/migrations/20240107163155_org-bot.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.OrgBot))) {
+    await knex.schema.createTable(TableName.OrgBot, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("name").notNullable();
+      t.text("publicKey").notNullable();
+      t.text("encryptedSymmetricKey").notNullable();
+      t.text("symmetricKeyIV").notNullable();
+      t.text("symmetricKeyTag").notNullable();
+      t.string("symmetricKeyAlgorithm").notNullable();
+      t.string("symmetricKeyKeyEncoding").notNullable();
+      t.text("encryptedPrivateKey").notNullable();
+      t.text("privateKeyIV").notNullable();
+      t.text("privateKeyTag").notNullable();
+      t.string("privateKeyAlgorithm").notNullable();
+      t.string("privateKeyKeyEncoding").notNullable();
+      // one to one relationship
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.OrgBot);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.OrgBot);
+  await dropOnUpdateTrigger(knex, TableName.OrgBot);
+}

backend/src/db/migrations/20240108134148_audit-log.ts

@@ -0,0 +1,29 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.AuditLog))) {
+    await knex.schema.createTable(TableName.AuditLog, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("actor").notNullable();
+      t.jsonb("actorMetadata").notNullable();
+      t.string("ipAddress");
+      t.string("eventType").notNullable();
+      t.jsonb("eventMetadata");
+      t.string("userAgent");
+      t.string("userAgentType");
+      t.datetime("expiresAt");
+      t.timestamps(true, true, true);
+      // no trigger needed as this collection is append only
+      t.uuid("orgId");
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.string("projectId");
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.AuditLog);
+}

backend/src/db/migrations/20240111051011_secret-scanning.ts

@@ -0,0 +1,79 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.GitAppInstallSession))) {
+    await knex.schema.createTable(TableName.GitAppInstallSession, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("sessionId").notNullable().unique();
+      t.uuid("userId");
+      // one to one relationship
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  createOnUpdateTrigger(knex, TableName.GitAppInstallSession);
+
+  if (!(await knex.schema.hasTable(TableName.GitAppOrg))) {
+    await knex.schema.createTable(TableName.GitAppOrg, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("installationId").notNullable().unique();
+      t.uuid("userId").notNullable();
+      // one to one relationship
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  createOnUpdateTrigger(knex, TableName.GitAppOrg);
+
+  if (!(await knex.schema.hasTable(TableName.SecretScanningGitRisk))) {
+    await knex.schema.createTable(TableName.SecretScanningGitRisk, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("description");
+      t.string("startLine");
+      t.string("endLine");
+      t.string("startColumn");
+      t.string("endColumn");
+      t.string("file");
+      t.string("symlinkFile");
+      t.string("commit");
+      t.string("entropy");
+      t.string("author");
+      t.string("email");
+      t.string("date");
+      t.text("message");
+      t.specificType("tags", "text[]");
+      t.string("ruleID");
+      t.string("fingerprint").unique();
+      t.string("fingerPrintWithoutCommitId");
+      t.boolean("isFalsePositive").defaultTo(false);
+      t.boolean("isResolved").defaultTo(false);
+      t.string("riskOwner");
+      t.string("installationId").notNullable();
+      t.string("repositoryId");
+      t.string("repositoryLink");
+      t.string("repositoryFullName");
+      t.string("pusherName");
+      t.string("pusherEmail");
+      t.string("status");
+      // one to one relationship
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  createOnUpdateTrigger(knex, TableName.SecretScanningGitRisk);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretScanningGitRisk);
+  await knex.schema.dropTableIfExists(TableName.GitAppOrg);
+  await knex.schema.dropTableIfExists(TableName.GitAppInstallSession);
+  await dropOnUpdateTrigger(knex, TableName.SecretScanningGitRisk);
+  await dropOnUpdateTrigger(knex, TableName.GitAppOrg);
+  await dropOnUpdateTrigger(knex, TableName.GitAppInstallSession);
+}

backend/src/db/migrations/20240113103743_trusted-ip.ts

@@ -0,0 +1,26 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.TrustedIps))) {
+    await knex.schema.createTable(TableName.TrustedIps, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("ipAddress").notNullable();
+      t.string("type").notNullable();
+      t.integer("prefix");
+      t.boolean("isActive").defaultTo(true);
+      t.string("comment");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+  await createOnUpdateTrigger(knex, TableName.TrustedIps);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.TrustedIps);
+  await dropOnUpdateTrigger(knex, TableName.TrustedIps);
+}