feat: management apis for apps, envs, access

.gitignore

@@ -167,4 +167,8 @@ yarn-error.log*
 next-env.d.ts
 
 # phase
-*.phase.json
+*.phase.json
+
+# graphql_schema --out artifact — regenerated locally; only the
+# frontend/apollo/schema.graphql copy is tracked.
+backend/schema.graphql

backend/api/emails.py

@@ -98,10 +98,18 @@ def send_login_email(request, email, full_name, provider):
     )
 
 
+def _get_invite_sender_name(invite):
+    if invite.invited_by:
+        return get_org_member_name(invite.invited_by)
+    if invite.invited_by_service_account:
+        return invite.invited_by_service_account.name
+    return invite.organisation.name
+
+
 def send_invite_email(invite):
     organisation = invite.organisation.name
 
-    invited_by_name = get_org_member_name(invite.invited_by)
+    invited_by_name = _get_invite_sender_name(invite)
 
     invite_code = encode_string_to_base64(str(invite.id))
 
@@ -131,7 +139,7 @@ def send_user_joined_email(invite, new_member):
 
     owner_name = get_org_member_name(owner)
 
-    invited_by_name = get_org_member_name(invite.invited_by)
+    invited_by_name = _get_invite_sender_name(invite)
 
     if owner_name == invited_by_name:
         invited_by_name = "you"

backend/api/migrations/0118_auditevent.py

@@ -0,0 +1,39 @@
+# Generated by Django 4.2.28 on 2026-03-13 11:18
+
+from django.db import migrations, models
+import django.db.models.deletion
+import django.utils.timezone
+import uuid
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0117_alter_environmentsync_service_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='AuditEvent',
+            fields=[
+                ('id', models.TextField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('event_type', models.CharField(choices=[('C', 'Create'), ('R', 'Read'), ('U', 'Update'), ('D', 'Delete'), ('A', 'Access')], max_length=1)),
+                ('resource_type', models.CharField(choices=[('app', 'App'), ('env', 'Environment'), ('role', 'Role'), ('sa', 'ServiceAccount'), ('member', 'OrganisationMember'), ('policy', 'NetworkAccessPolicy'), ('pat', 'UserToken'), ('sa_token', 'ServiceAccountToken'), ('svc_token', 'ServiceToken')], max_length=10)),
+                ('resource_id', models.TextField()),
+                ('actor_type', models.CharField(choices=[('user', 'User'), ('sa', 'ServiceAccount')], max_length=10)),
+                ('actor_id', models.TextField()),
+                ('actor_metadata', models.JSONField(default=dict)),
+                ('resource_metadata', models.JSONField(default=dict)),
+                ('old_values', models.JSONField(blank=True, null=True)),
+                ('new_values', models.JSONField(blank=True, null=True)),
+                ('description', models.TextField(blank=True, default='')),
+                ('ip_address', models.GenericIPAddressField(blank=True, null=True)),
+                ('user_agent', models.TextField(blank=True, default='')),
+                ('timestamp', models.DateTimeField(default=django.utils.timezone.now)),
+                ('organisation', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='audit_events', to='api.organisation')),
+            ],
+            options={
+                'indexes': [models.Index(fields=['resource_type', 'resource_id', '-timestamp'], name='audit_resource_history_idx'), models.Index(fields=['organisation', '-timestamp'], name='audit_org_activity_idx'), models.Index(fields=['actor_type', 'actor_id', '-timestamp'], name='audit_actor_activity_idx')],
+            },
+        ),
+    ]

backend/api/migrations/0119_auditevent_invite_resource_type.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.29 on 2026-03-17 14:46
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0118_auditevent'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='auditevent',
+            name='resource_type',
+            field=models.CharField(choices=[('app', 'App'), ('env', 'Environment'), ('role', 'Role'), ('sa', 'ServiceAccount'), ('member', 'OrganisationMember'), ('policy', 'NetworkAccessPolicy'), ('pat', 'UserToken'), ('sa_token', 'ServiceAccountToken'), ('svc_token', 'ServiceToken'), ('invite', 'Invite')], max_length=10),
+        ),
+    ]

backend/api/migrations/0120_invite_sa_inviter.py

@@ -0,0 +1,24 @@
+# Generated by Django 4.2.29 on 2026-03-18 08:56
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0119_auditevent_invite_resource_type'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='organisationmemberinvite',
+            name='invited_by',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='api.organisationmember'),
+        ),
+        migrations.AddField(
+            model_name='organisationmemberinvite',
+            name='invited_by_service_account',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='api.serviceaccount'),
+        ),
+    ]

backend/api/migrations/0123_merge_20260509_1024.py

@@ -0,0 +1,14 @@
+# Generated by Django 4.2.29 on 2026-05-09 10:24
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0120_invite_sa_inviter'),
+        ('api', '0122_sso_audit_fks_set_null'),
+    ]
+
+    operations = [
+    ]

backend/api/migrations/0127_merge_20260518_0815.py

@@ -0,0 +1,14 @@
+# Generated by Django 4.2.30 on 2026-05-18 08:15
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0123_merge_20260509_1024'),
+        ('api', '0126_populate_team_owner'),
+    ]
+
+    operations = [
+    ]

backend/api/migrations/0128_add_team_audit_resource_and_sa_token_last_used.py

@@ -0,0 +1,23 @@
+# Generated by Django 4.2.30 on 2026-05-18 10:23
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0127_merge_20260518_0815'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='serviceaccounttoken',
+            name='last_used_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AlterField(
+            model_name='auditevent',
+            name='resource_type',
+            field=models.CharField(choices=[('app', 'App'), ('env', 'Environment'), ('role', 'Role'), ('sa', 'ServiceAccount'), ('member', 'OrganisationMember'), ('policy', 'NetworkAccessPolicy'), ('pat', 'UserToken'), ('sa_token', 'ServiceAccountToken'), ('svc_token', 'ServiceToken'), ('invite', 'Invite'), ('team', 'Team')], max_length=10),
+        ),
+    ]

backend/api/migrations/0129_wipe_orphan_envkeys_from_deleted_sas.py

@@ -0,0 +1,38 @@
+"""Backfill: EnvironmentKey rows for service accounts that were soft-deleted
+before the SA delete cascade also wiped EnvironmentKeys still had live
+wrapped_seed / wrapped_salt material. Soft-delete those rows and clear
+the wrapping fields so a DB-compromise on backup can't recover the
+deleted principal's env access.
+"""
+from django.db import migrations
+from django.utils import timezone
+
+
+def wipe_orphan_envkeys(apps, schema_editor):
+    EnvironmentKey = apps.get_model("api", "EnvironmentKey")
+    orphans = EnvironmentKey.objects.filter(
+        service_account__deleted_at__isnull=False,
+        deleted_at__isnull=True,
+    )
+    orphans.update(
+        deleted_at=timezone.now(),
+        wrapped_seed="",
+        wrapped_salt="",
+        identity_key="",
+    )
+
+
+def noop_reverse(apps, schema_editor):
+    # Irreversible — we've zeroed the wrapping material on purpose.
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("api", "0128_add_team_audit_resource_and_sa_token_last_used"),
+    ]
+
+    operations = [
+        migrations.RunPython(wipe_orphan_envkeys, noop_reverse),
+    ]

backend/api/models.py

@@ -357,13 +357,26 @@ class ServiceAccount(models.Model):
 
     def delete(self, *args, **kwargs):
         """
-        Soft delete the object by setting the 'deleted_at' field.
+        Soft delete the SA, its tokens, and its EnvironmentKey rows
+        (wiping wrapping material so an attacker with DB access can't
+        recover env seeds belonging to a deleted principal).
         """
-        self.deleted_at = timezone.now()
+        now = timezone.now()
+        self.deleted_at = now
         self.save()
 
-        # Soft-delete related tokens
-        self.serviceaccounttoken_set.update(deleted_at=timezone.now())
+        self.serviceaccounttoken_set.filter(deleted_at__isnull=True).update(
+            deleted_at=now
+        )
+
+        EnvironmentKey.objects.filter(
+            service_account=self, deleted_at__isnull=True
+        ).update(
+            deleted_at=now,
+            wrapped_seed="",
+            wrapped_salt="",
+            identity_key="",
+        )
 
 
 class ServiceAccountHandler(models.Model):
@@ -398,7 +411,12 @@ class OrganisationMemberInvite(models.Model):
         null=True,
         blank=True,
     )
-    invited_by = models.ForeignKey(OrganisationMember, on_delete=models.CASCADE)
+    invited_by = models.ForeignKey(
+        OrganisationMember, on_delete=models.SET_NULL, null=True, blank=True
+    )
+    invited_by_service_account = models.ForeignKey(
+        "ServiceAccount", on_delete=models.SET_NULL, null=True, blank=True
+    )
     invitee_email = models.EmailField()
     valid = models.BooleanField(default=True)
     created_at = models.DateTimeField(auto_now_add=True, blank=True, null=True)
@@ -638,6 +656,11 @@ class ServiceAccountToken(models.Model):
     updated_at = models.DateTimeField(auto_now=True)
     deleted_at = models.DateTimeField(blank=True, null=True)
     expires_at = models.DateTimeField(null=True)
+    # Bumped on every successful authentication via the REST/management API.
+    # The legacy `last_used` resolver fell back to SecretEvent history, which
+    # only fires for E2EE secret operations and misses management-API usage
+    # entirely. This direct field makes "Last used" accurate across both.
+    last_used_at = models.DateTimeField(blank=True, null=True)
 
     def clean(self):
         # Ensure only one of created_by or created_by_service_account is set
@@ -1010,6 +1033,98 @@ class Meta:
     user_agent = models.TextField(null=True, blank=True)
 
 
+class AuditEvent(models.Model):
+    """
+    Generic audit log for organisation-level events (Apps, Environments, Roles,
+    Service Accounts, Members, Tokens, Network Policies).
+    SecretEvent remains separate for encrypted-value logging.
+    """
+
+    CREATE = "C"
+    READ = "R"
+    UPDATE = "U"
+    DELETE = "D"
+    ACCESS = "A"
+    EVENT_TYPES = [
+        (CREATE, "Create"),
+        (READ, "Read"),
+        (UPDATE, "Update"),
+        (DELETE, "Delete"),
+        (ACCESS, "Access"),
+    ]
+
+    APP = "app"
+    ENVIRONMENT = "env"
+    ROLE = "role"
+    SERVICE_ACCOUNT = "sa"
+    ORG_MEMBER = "member"
+    NETWORK_POLICY = "policy"
+    USER_TOKEN = "pat"
+    SA_TOKEN = "sa_token"
+    SERVICE_TOKEN = "svc_token"
+    INVITE = "invite"
+    TEAM = "team"
+    RESOURCE_TYPES = [
+        (APP, "App"),
+        (ENVIRONMENT, "Environment"),
+        (ROLE, "Role"),
+        (SERVICE_ACCOUNT, "ServiceAccount"),
+        (ORG_MEMBER, "OrganisationMember"),
+        (NETWORK_POLICY, "NetworkAccessPolicy"),
+        (USER_TOKEN, "UserToken"),
+        (SA_TOKEN, "ServiceAccountToken"),
+        (SERVICE_TOKEN, "ServiceToken"),
+        (INVITE, "Invite"),
+        (TEAM, "Team"),
+    ]
+
+    class Meta:
+        indexes = [
+            models.Index(
+                fields=["resource_type", "resource_id", "-timestamp"],
+                name="audit_resource_history_idx",
+            ),
+            models.Index(
+                fields=["organisation", "-timestamp"],
+                name="audit_org_activity_idx",
+            ),
+            models.Index(
+                fields=["actor_type", "actor_id", "-timestamp"],
+                name="audit_actor_activity_idx",
+            ),
+        ]
+
+    id = models.TextField(default=uuid4, primary_key=True, editable=False)
+    organisation = models.ForeignKey(
+        Organisation, on_delete=models.CASCADE, related_name="audit_events"
+    )
+
+    # What happened
+    event_type = models.CharField(max_length=1, choices=EVENT_TYPES)
+    resource_type = models.CharField(max_length=10, choices=RESOURCE_TYPES)
+    resource_id = models.TextField()
+
+    # Who did it (no ForeignKey — survives entity deletion)
+    actor_type = models.CharField(
+        max_length=10,
+        choices=[("user", "User"), ("sa", "ServiceAccount")],
+    )
+    actor_id = models.TextField()
+    actor_metadata = models.JSONField(default=dict)
+
+    # What changed
+    resource_metadata = models.JSONField(default=dict)
+    old_values = models.JSONField(null=True, blank=True)
+    new_values = models.JSONField(null=True, blank=True)
+    description = models.TextField(blank=True, default="")
+
+    # Request metadata
+    ip_address = models.GenericIPAddressField(null=True, blank=True)
+    user_agent = models.TextField(blank=True, default="")
+
+    timestamp = models.DateTimeField(default=timezone.now)
+
+
 class Identity(models.Model):
     """
     Third-party identity configuration.