6d76558bc3
Full per-user data isolation across all tables: - Migration adds userId FK to hosts, host_groups, credentials, ssh_keys, connection_logs. Backfills existing data to admin@wraith.local. - All services scope queries by userId from JWT (req.user.sub). Users can only see/modify their own data. Cross-user access returns 403. - Two roles: admin (full access + user management) and user (own data only). - Admin endpoints: list/create/edit/delete users, reset password, reset TOTP. Protected by AdminGuard. Admins cannot delete themselves or remove own role. - JWT payload now includes role. Frontend auth store exposes isAdmin getter. - Seed script fixed: checks for admin@wraith.local specifically (not any user). Uses upsert, seeds with role=admin. Migration cleans up duplicate users. - Connection logs now attributed to the connecting user via WS auth. - Deleting a user CASCADEs to all their hosts, credentials, keys, and logs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
37 lines
2.3 KiB
SQL
37 lines
2.3 KiB
SQL
-- Delete duplicate admin users first (keep the one with lowest id)
|
|
DELETE FROM "users" WHERE "email" = 'admin@wraith.local' AND "id" != (SELECT MIN("id") FROM "users" WHERE "email" = 'admin@wraith.local');
|
|
|
|
-- Add role to users
|
|
ALTER TABLE "users" ADD COLUMN "role" TEXT NOT NULL DEFAULT 'user';
|
|
|
|
-- Backfill admin@wraith.local as admin
|
|
UPDATE "users" SET "role" = 'admin' WHERE "email" = 'admin@wraith.local';
|
|
|
|
-- Add user_id to all data tables
|
|
ALTER TABLE "hosts" ADD COLUMN "user_id" INTEGER;
|
|
ALTER TABLE "host_groups" ADD COLUMN "user_id" INTEGER;
|
|
ALTER TABLE "credentials" ADD COLUMN "user_id" INTEGER;
|
|
ALTER TABLE "ssh_keys" ADD COLUMN "user_id" INTEGER;
|
|
ALTER TABLE "connection_logs" ADD COLUMN "user_id" INTEGER;
|
|
|
|
-- Backfill existing data to the admin user
|
|
UPDATE "hosts" SET "user_id" = (SELECT "id" FROM "users" WHERE "email" = 'admin@wraith.local');
|
|
UPDATE "host_groups" SET "user_id" = (SELECT "id" FROM "users" WHERE "email" = 'admin@wraith.local');
|
|
UPDATE "credentials" SET "user_id" = (SELECT "id" FROM "users" WHERE "email" = 'admin@wraith.local');
|
|
UPDATE "ssh_keys" SET "user_id" = (SELECT "id" FROM "users" WHERE "email" = 'admin@wraith.local');
|
|
UPDATE "connection_logs" SET "user_id" = (SELECT "id" FROM "users" WHERE "email" = 'admin@wraith.local');
|
|
|
|
-- Make user_id NOT NULL after backfill
|
|
ALTER TABLE "hosts" ALTER COLUMN "user_id" SET NOT NULL;
|
|
ALTER TABLE "host_groups" ALTER COLUMN "user_id" SET NOT NULL;
|
|
ALTER TABLE "credentials" ALTER COLUMN "user_id" SET NOT NULL;
|
|
ALTER TABLE "ssh_keys" ALTER COLUMN "user_id" SET NOT NULL;
|
|
ALTER TABLE "connection_logs" ALTER COLUMN "user_id" SET NOT NULL;
|
|
|
|
-- Add foreign keys
|
|
ALTER TABLE "hosts" ADD CONSTRAINT "hosts_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;
|
|
ALTER TABLE "host_groups" ADD CONSTRAINT "host_groups_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;
|
|
ALTER TABLE "credentials" ADD CONSTRAINT "credentials_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;
|
|
ALTER TABLE "ssh_keys" ADD CONSTRAINT "ssh_keys_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;
|
|
ALTER TABLE "connection_logs" ADD CONSTRAINT "connection_logs_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;
|