Updated plan and login flow - #222
Merged
Merged
Conversation
Add migration 0016 introducing org_profiles, org_entitlements, and rebuilt org_members with seat tiers. Orgs now carry plan, billing_status, and verification_status instead of kind/verified/enrollment_secret. Implement CreateOrgForUser, SetOrgPlan, AssignSeat, RevokeSeat, and plan entitlement seeding (basic/starter/pro/business/enterprise). Expose entitlements, profile, and seat management APIs. Node registration is temporarily disabled pending Stage 2 registration tokens.
Introduce migration 0017 for org_nodes, org_node_services, node_registration_tokens, and sentinel_licenses. Re-enable node registration via scoped registration tokens (with enrollment_secret legacy alias). Add org node/service APIs and Sentinel license store.
Add ProvisionIncludedPlanResources with Pro (managed Shield node + VPN + AdGuard service) and Business (3 managed Sentinel nodes, licenses, VPN + firewall services) flows. Wire SetOrgPlanAndProvision into admin plan updates. Add managed-node env vars to config and .env.example.
Add migration 0018 for firewall_rules and expose the remaining plan APIs: public org profiles, member invite, service patch/delete, node REST heartbeat, and generic firewall lifecycle + Sentinel rule management. Update OpenAPI with new org, firewall, public, and heartbeat endpoints.
- Validate seat tier against org plan on AssignSeat - Enforce Shield instance quota org-wide in service validation - Make Business Sentinel reprovision idempotent when already attached - List invited members alongside active members - Audit-log new org/firewall mutation routes Update GATEWAY.md, ws-protocol.md, and OpenAPI for the org plan model, registration tokens, and migrations 0016–0018. Add a deferred-work table for items that need erebrus node integration.
Send Resend invite emails when inviting org members by wallet or email. Email-only invites persist in org_invites until the invitee verifies their email; wallet invites activate on login. Canonicalize peer_id as the external node_id across discovery, PASETO tokens, WS hub, and REST heartbeats while keeping internal UUID FKs. WS heartbeats now sync org_nodes.last_seen_at.
Nodes register with deployment_profile and auto-attach Shield/Sentinel services. Firewall sync/restart/reset-credentials dispatch WS commands with rule payloads. Hello and heartbeat service maps update org_node_services status in the gateway.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.