Files
ServerKit/backend
Juan DenisandClaude Opus 4.8 58e80b2e18 feat(databases): track managed databases as first-class resources
Persist the databases ServerKit provisions (and let you adopt existing ones) so
backups, connection strings, and the UI have durable state -- beside, not
replacing, the live-introspection explorer. Not a DBaaS (no pooling/replicas).

- ManagedDatabase model (engine/name/host/port/origin/owner; admin secret
  Fernet-encrypted, unique per engine+host+name) + migration 044.
- managed_database_service: record_provisioned (additive on the create routes),
  adopt (idempotent), build_connection_uri (real URI, masked by default),
  sync_state (drift detection), delete (optional drop), protect.
- Backup FK fix (the headline): a managed-DB BackupPolicy uses
  target_id = managed_databases.id plus a `managed` marker, and _resolve_target
  resolves the descriptor (incl. decrypted secret) from the row. Legacy
  JSON-descriptor policies keep resolving unchanged (backward compatible).
- API under /api/v1/databases/managed (list/create/get+sync/delete?drop=/adopt/
  connection-uri/protect); the connection-uri reveal is admin-only and audited.
- Frontend: a "Managed" panel on the Database Explorer (connection-string
  reveal/copy, one-click Protect, Untrack/Drop).
- Tests: provisioning persists a row, adopt idempotent, connection URI per
  engine + masking, sync_state drift, protect resolves via the real FK, legacy
  policy still resolves, API masking/admin-gating/audited reveal.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 09:44:48 -04:00
..