Merge branch 'main' into chore/claude-code-setup

Author: skwowet

backend/.env.dist.composed

@@ -11,6 +11,7 @@ CROWD_S3_HOST="s3"
 # Db settings
 CROWD_DB_READ_HOST="db"
 CROWD_DB_WRITE_HOST="db"
+INSIGHTS_DB_WRITE_HOST="db"
 
 # Product DB settings
 PRODUCT_DB_HOST=product

backend/.env.dist.local

@@ -38,6 +38,14 @@ CROWD_DB_USERNAME=postgres
 CROWD_DB_PASSWORD=example
 CROWD_DB_DATABASE=crowd-web
 
+INSIGHTS_DB_WRITE_HOST=localhost
+INSIGHTS_DB_USERNAME=postgres
+INSIGHTS_DB_PASSWORD=example
+INSIGHTS_DB_DATABASE=insights
+INSIGHTS_DB_PORT=5432
+INSIGHTS_DB_POOL_MAX=10
+INSIGHTS_DB_SSLMODE=disable
+
 # Product DB settings
 PRODUCT_DB_HOST=localhost
 PRODUCT_DB_PORT=5433

backend/src/api/public/index.ts

@@ -4,11 +4,14 @@ import { AUTH0_CONFIG } from '../../conf'
 
 import { errorHandler } from './middlewares/errorHandler'
 import { oauth2Middleware } from './middlewares/oauth2Middleware'
+import { staticApiKeyMiddleware } from './middlewares/staticApiKeyMiddleware'
 import { v1Router } from './v1'
+import { devStatsRouter } from './v1/dev-stats'
 
 export function publicRouter(): Router {
   const router = Router()
 
+  router.use('/v1/dev-stats', staticApiKeyMiddleware(), devStatsRouter())
   router.use('/v1', oauth2Middleware(AUTH0_CONFIG), v1Router())
   router.use(errorHandler)
 

backend/src/api/public/middlewares/staticApiKeyMiddleware.ts

@@ -0,0 +1,48 @@
+import crypto from 'crypto'
+import type { NextFunction, Request, RequestHandler, Response } from 'express'
+
+import { UnauthorizedError } from '@crowd/common'
+import { findApiKeyByHash, optionsQx, touchApiKeyLastUsed } from '@crowd/data-access-layer'
+
+export function staticApiKeyMiddleware(): RequestHandler {
+  return async (req: Request, _res: Response, next: NextFunction): Promise<void> => {
+    try {
+      const authHeader = req.headers.authorization
+
+      if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        next(new UnauthorizedError('Missing or invalid Authorization header'))
+        return
+      }
+
+      const providedKey = authHeader.slice('Bearer '.length)
+      const keyHash = crypto.createHash('sha256').update(providedKey).digest('hex')
+
+      const qx = optionsQx(req)
+      const apiKey = await findApiKeyByHash(qx, keyHash)
+
+      if (!apiKey) {
+        next(new UnauthorizedError('Invalid API key'))
+        return
+      }
+
+      if (apiKey.revokedAt) {
+        next(new UnauthorizedError('API key has been revoked'))
+        return
+      }
+
+      if (apiKey.expiresAt && apiKey.expiresAt < new Date()) {
+        next(new UnauthorizedError('API key has expired'))
+        return
+      }
+
+      // fire and forget — don't block the request
+      touchApiKeyLastUsed(qx, apiKey.id).catch(() => {})
+
+      req.actor = { id: apiKey.name, type: 'service', scopes: apiKey.scopes }
+
+      next()
+    } catch (err) {
+      next(err)
+    }
+  }
+}

backend/src/api/public/v1/dev-stats/index.ts

@@ -0,0 +1,19 @@
+import { Router } from 'express'
+
+import { createRateLimiter } from '@/api/apiRateLimiter'
+import { requireScopes } from '@/api/public/middlewares/requireScopes'
+import { SCOPES } from '@/security/scopes'
+
+const rateLimiter = createRateLimiter({ max: 60, windowMs: 60 * 1000 })
+
+export function devStatsRouter(): Router {
+  const router = Router()
+
+  router.use(rateLimiter)
+
+  router.post('/affiliations', requireScopes([SCOPES.READ_AFFILIATIONS]), (_req, res) => {
+    res.json({ status: 'ok' })
+  })
+
+  return router
+}

backend/src/api/public/v1/members/work-experiences/deleteMemberWorkExperience.ts

@@ -46,7 +46,6 @@ export async function deleteMemberWorkExperience(req: Request, res: Response): P
 
       await qx.tx(async (tx) => {
         await deleteMemberOrganizations(tx, memberId, [workExperienceId])
-
         const commonMemberService = new CommonMemberService(tx, req.temporal, req.log)
         await commonMemberService.startAffiliationRecalculation(memberId, [
           memberOrg.organizationId,

backend/src/database/migrations/U1773938832__add-api-keys-tale.sql

@@ -0,0 +1,13 @@
+CREATE TABLE "apiKeys" (
+  "id"          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  "name"        TEXT NOT NULL,
+  "keyHash"     TEXT NOT NULL UNIQUE,
+  "keyPrefix"   TEXT NOT NULL,
+  "scopes"      TEXT[] NOT NULL DEFAULT '{}',
+  "expiresAt"   TIMESTAMPTZ,
+  "lastUsedAt"  TIMESTAMPTZ,
+  "createdById" TEXT,
+  "revokedAt"   TIMESTAMPTZ,
+  "createdAt"   TIMESTAMPTZ NOT NULL DEFAULT now(),
+  "updatedAt"   TIMESTAMPTZ NOT NULL DEFAULT now()
+);

backend/src/database/migrations/V1773938832__add-api-keys-tale.sql

@@ -9,6 +9,7 @@ export const SCOPES = {
   WRITE_WORK_EXPERIENCES: 'write:work-experiences',
   READ_PROJECT_AFFILIATIONS: 'read:project-affiliations',
   WRITE_PROJECT_AFFILIATIONS: 'write:project-affiliations',
+  READ_AFFILIATIONS: 'read:affiliations',
 } as const
 
 export type Scope = (typeof SCOPES)[keyof typeof SCOPES]

backend/src/security/scopes.ts

@@ -22,6 +22,23 @@ COPY ./services/apps/git_integration/src/crowdgit/services/software_value/ ./
 # Build the binary
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-w -s" -o software-value ./
 
+# Go builder stage 2: build the vulnerability-scanner binary
+FROM golang:1.25-alpine AS go-vuln-builder
+
+WORKDIR /go/src/vulnerability-scanner
+
+# Copy module files first for dependency caching
+COPY ./services/apps/git_integration/src/crowdgit/services/vulnerability_scanner/go.mod ./
+COPY ./services/apps/git_integration/src/crowdgit/services/vulnerability_scanner/go.sum ./
+
+# Copy source code
+COPY ./services/apps/git_integration/src/crowdgit/services/vulnerability_scanner/ ./
+
+# Download dependencies and build, using cache mounts to avoid re-downloading on every build
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go mod download && CGO_ENABLED=0 GOOS=linux go build -ldflags "-w -s" -o vulnerability-scanner ./
+
 # Builder stage: install build dependencies, uv, and dependencies
 FROM base AS builder
 
@@ -84,13 +101,17 @@ COPY --from=builder /usr/crowd/app /usr/crowd/app
 COPY --from=go-builder /go/src/software-value/software-value /usr/local/bin/software-value
 COPY --from=go-builder /go/bin/scc /usr/local/bin/scc
 
+# Copy vulnerability-scanner binary from go-vuln-builder stage
+COPY --from=go-vuln-builder /go/src/vulnerability-scanner/vulnerability-scanner /usr/local/bin/vulnerability-scanner
+
 # Add virtual environment bin to PATH
 ENV PATH="/usr/crowd/app/.venv/bin:$PATH"
 
 # Make runner script and binaries executable
 RUN chmod +x ./src/runner.sh \
     && chmod +x /usr/local/bin/software-value \
-    && chmod +x /usr/local/bin/scc
+    && chmod +x /usr/local/bin/scc \
+    && chmod +x /usr/local/bin/vulnerability-scanner
 
 EXPOSE 8085