rdev/internal/db/postgres.go
jordan d2de49a591 feat: Add API key authentication with auto-migrations
Implements API key authentication for all rdev endpoints:

## Database (internal/db)
- Auto-migrating postgres connection
- Embedded SQL migrations via go:embed
- api_keys table with scopes, expiration, project restrictions

## Auth Package (internal/auth)
- Key generation: rdev_sk_<prefix>_<random> format
- Scopes: projects:read, projects:execute, keys:read, keys:write, admin
- SHA-256 key hashing (secrets never stored)
- Expiration options: 30d, 60d, 90d, 1y, never
- Middleware skips /health, /ready, /docs, /openapi.json

## Key Management API
- GET /keys - List keys (keys:read)
- POST /keys - Create key (keys:write)
- GET /keys/{id} - Get key details (keys:read)
- DELETE /keys/{id} - Revoke key (keys:write)

## Environment Variables
- DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME
- RDEV_ADMIN_KEY - Super admin key for bootstrapping

Version bumped to 0.5.0.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-24 21:26:26 -07:00

173 lines
3.8 KiB
Go

// Package db provides database connectivity and migrations.
package db
import (
"context"
"database/sql"
"embed"
"fmt"
"log/slog"
"sort"
"strings"
"time"
_ "github.com/lib/pq"
)
//go:embed migrations/*.sql
var migrationsFS embed.FS
// Config holds database connection configuration.
type Config struct {
Host string
Port int
User string
Password string
Database string
SSLMode string
}
// DefaultConfig returns config from environment defaults.
func DefaultConfig() Config {
return Config{
Host: "postgres.databases.svc",
Port: 5432,
User: "appuser",
Password: "",
Database: "rdev",
SSLMode: "disable",
}
}
// DSN returns the connection string.
func (c Config) DSN() string {
return fmt.Sprintf(
"host=%s port=%d user=%s password=%s dbname=%s sslmode=%s",
c.Host, c.Port, c.User, c.Password, c.Database, c.SSLMode,
)
}
// DB wraps the sql.DB with additional functionality.
type DB struct {
*sql.DB
logger *slog.Logger
}
// New creates a new database connection and runs migrations.
func New(cfg Config, logger *slog.Logger) (*DB, error) {
db, err := sql.Open("postgres", cfg.DSN())
if err != nil {
return nil, fmt.Errorf("open db: %w", err)
}
// Configure connection pool
db.SetMaxOpenConns(10)
db.SetMaxIdleConns(5)
db.SetConnMaxLifetime(5 * time.Minute)
// Verify connection
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
if err := db.PingContext(ctx); err != nil {
return nil, fmt.Errorf("ping db: %w", err)
}
wrapped := &DB{DB: db, logger: logger}
// Run migrations
if err := wrapped.migrate(); err != nil {
return nil, fmt.Errorf("migrate: %w", err)
}
return wrapped, nil
}
// migrate runs all pending migrations.
func (db *DB) migrate() error {
// Create migrations table if not exists
_, err := db.Exec(`
CREATE TABLE IF NOT EXISTS schema_migrations (
version VARCHAR(255) PRIMARY KEY,
applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
)
`)
if err != nil {
return fmt.Errorf("create migrations table: %w", err)
}
// Get applied migrations
applied := make(map[string]bool)
rows, err := db.Query("SELECT version FROM schema_migrations")
if err != nil {
return fmt.Errorf("query migrations: %w", err)
}
defer rows.Close()
for rows.Next() {
var version string
if err := rows.Scan(&version); err != nil {
return fmt.Errorf("scan version: %w", err)
}
applied[version] = true
}
// Read migration files
entries, err := migrationsFS.ReadDir("migrations")
if err != nil {
return fmt.Errorf("read migrations dir: %w", err)
}
// Sort by filename (version order)
var files []string
for _, e := range entries {
if !e.IsDir() && strings.HasSuffix(e.Name(), ".sql") {
files = append(files, e.Name())
}
}
sort.Strings(files)
// Apply pending migrations
for _, file := range files {
version := strings.TrimSuffix(file, ".sql")
if applied[version] {
continue
}
content, err := migrationsFS.ReadFile("migrations/" + file)
if err != nil {
return fmt.Errorf("read migration %s: %w", file, err)
}
db.logger.Info("applying migration", "version", version)
tx, err := db.Begin()
if err != nil {
return fmt.Errorf("begin tx: %w", err)
}
if _, err := tx.Exec(string(content)); err != nil {
tx.Rollback()
return fmt.Errorf("exec migration %s: %w", version, err)
}
if _, err := tx.Exec("INSERT INTO schema_migrations (version) VALUES ($1)", version); err != nil {
tx.Rollback()
return fmt.Errorf("record migration %s: %w", version, err)
}
if err := tx.Commit(); err != nil {
return fmt.Errorf("commit migration %s: %w", version, err)
}
db.logger.Info("applied migration", "version", version)
}
return nil
}
// Close closes the database connection.
func (db *DB) Close() error {
return db.DB.Close()
}