Implement provider vault data model and API

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/db/src/migrations/0082_company_secret_provider_configs.sql

@@ -0,0 +1,51 @@
+CREATE TABLE IF NOT EXISTS "company_secret_provider_configs" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"provider" text NOT NULL,
+	"display_name" text NOT NULL,
+	"status" text DEFAULT 'ready' NOT NULL,
+	"is_default" boolean DEFAULT false NOT NULL,
+	"config" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"health_status" text,
+	"health_checked_at" timestamp with time zone,
+	"health_message" text,
+	"health_details" jsonb,
+	"disabled_at" timestamp with time zone,
+	"created_by_agent_id" uuid,
+	"created_by_user_id" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'company_secret_provider_configs_company_id_companies_id_fk') THEN
+		ALTER TABLE "company_secret_provider_configs" ADD CONSTRAINT "company_secret_provider_configs_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'company_secret_provider_configs_created_by_agent_id_agents_id_fk') THEN
+		ALTER TABLE "company_secret_provider_configs" ADD CONSTRAINT "company_secret_provider_configs_created_by_agent_id_agents_id_fk" FOREIGN KEY ("created_by_agent_id") REFERENCES "public"."agents"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+UPDATE "company_secrets"
+SET "provider_config_id" = NULL
+WHERE "provider_config_id" IS NOT NULL
+	AND "provider_config_id" !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$';
+--> statement-breakpoint
+ALTER TABLE "company_secrets" ALTER COLUMN "provider_config_id" TYPE uuid USING "provider_config_id"::uuid;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'company_secrets_provider_config_id_company_secret_provider_configs_id_fk') THEN
+		ALTER TABLE "company_secrets" ADD CONSTRAINT "company_secrets_provider_config_id_company_secret_provider_configs_id_fk" FOREIGN KEY ("provider_config_id") REFERENCES "public"."company_secret_provider_configs"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secret_provider_configs_company_idx" ON "company_secret_provider_configs" USING btree ("company_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secret_provider_configs_company_provider_idx" ON "company_secret_provider_configs" USING btree ("company_id","provider");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "company_secret_provider_configs_default_uq" ON "company_secret_provider_configs" USING btree ("company_id","provider") WHERE "is_default" = true;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secrets_provider_config_idx" ON "company_secrets" USING btree ("provider_config_id");

packages/db/src/migrations/meta/_journal.json

@@ -582,6 +582,13 @@
       "when": 1777239150329,
       "tag": "0082_dry_vision",
       "breakpoints": true
+    },
+    {
+      "idx": 82,
+      "version": "7",
+      "when": 1778074536410,
+      "tag": "0082_company_secret_provider_configs",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/company_secret_provider_configs.ts

@@ -0,0 +1,33 @@
+import { sql } from "drizzle-orm";
+import { pgTable, uuid, text, timestamp, jsonb, index, uniqueIndex, boolean } from "drizzle-orm/pg-core";
+import { companies } from "./companies.js";
+import { agents } from "./agents.js";
+
+export const companySecretProviderConfigs = pgTable(
+  "company_secret_provider_configs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    companyId: uuid("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+    provider: text("provider").notNull(),
+    displayName: text("display_name").notNull(),
+    status: text("status").notNull().default("ready"),
+    isDefault: boolean("is_default").notNull().default(false),
+    config: jsonb("config").$type<Record<string, unknown>>().notNull().default({}),
+    healthStatus: text("health_status"),
+    healthCheckedAt: timestamp("health_checked_at", { withTimezone: true }),
+    healthMessage: text("health_message"),
+    healthDetails: jsonb("health_details").$type<Record<string, unknown>>(),
+    disabledAt: timestamp("disabled_at", { withTimezone: true }),
+    createdByAgentId: uuid("created_by_agent_id").references(() => agents.id, { onDelete: "set null" }),
+    createdByUserId: text("created_by_user_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    companyIdx: index("company_secret_provider_configs_company_idx").on(table.companyId),
+    companyProviderIdx: index("company_secret_provider_configs_company_provider_idx").on(table.companyId, table.provider),
+    companyDefaultProviderUq: uniqueIndex("company_secret_provider_configs_default_uq")
+      .on(table.companyId, table.provider)
+      .where(sql`${table.isDefault} = true`),
+  }),
+);

packages/db/src/schema/company_secrets.ts

@@ -1,6 +1,7 @@
 import { pgTable, uuid, text, timestamp, integer, jsonb, index, uniqueIndex } from "drizzle-orm/pg-core";
 import { companies } from "./companies.js";
 import { agents } from "./agents.js";
+import { companySecretProviderConfigs } from "./company_secret_provider_configs.js";
 
 export const companySecrets = pgTable(
   "company_secrets",
@@ -13,7 +14,7 @@ export const companySecrets = pgTable(
     status: text("status").notNull().default("active"),
     managedMode: text("managed_mode").notNull().default("paperclip_managed"),
     externalRef: text("external_ref"),
-    providerConfigId: text("provider_config_id"),
+    providerConfigId: uuid("provider_config_id").references(() => companySecretProviderConfigs.id, { onDelete: "set null" }),
     providerMetadata: jsonb("provider_metadata").$type<Record<string, unknown>>(),
     latestVersion: integer("latest_version").notNull().default(1),
     description: text("description"),
@@ -28,6 +29,7 @@ export const companySecrets = pgTable(
   (table) => ({
     companyIdx: index("company_secrets_company_idx").on(table.companyId),
     companyProviderIdx: index("company_secrets_company_provider_idx").on(table.companyId, table.provider),
+    providerConfigIdx: index("company_secrets_provider_config_idx").on(table.providerConfigId),
     companyNameUq: uniqueIndex("company_secrets_company_name_uq").on(table.companyId, table.name),
     companyKeyUq: uniqueIndex("company_secrets_company_key_uq").on(table.companyId, table.key),
   }),

packages/db/src/schema/index.ts

@@ -59,6 +59,7 @@ export { financeEvents } from "./finance_events.js";
 export { approvals } from "./approvals.js";
 export { approvalComments } from "./approval_comments.js";
 export { activityLog } from "./activity_log.js";
+export { companySecretProviderConfigs } from "./company_secret_provider_configs.js";
 export { companySecrets } from "./company_secrets.js";
 export { companySecretVersions } from "./company_secret_versions.js";
 export { companySecretBindings } from "./company_secret_bindings.js";