initial

sql/migrations/007_remote_access.sql

@@ -0,0 +1,56 @@
+-- Remote access control plane (WireGuard v1, reverse SSH reserved).
+-- MariaDB / production: mysql -u root -p androidcast_crashes < sql/migrations/007_remote_access.sql
+
+CREATE TABLE IF NOT EXISTS remote_access_devices (
+    id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    device_id VARCHAR(128) NOT NULL,
+    company_id INT UNSIGNED NOT NULL DEFAULT 1,
+    whitelisted TINYINT(1) NOT NULL DEFAULT 0,
+    opt_in_mode ENUM('none','wireguard','rssh') NOT NULL DEFAULT 'none',
+    last_random VARCHAR(96) NULL,
+    app_version VARCHAR(64) NULL,
+    last_seen_at TIMESTAMP NULL,
+    notes TEXT NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    UNIQUE KEY uq_ra_device (device_id),
+    KEY idx_ra_device_company (company_id),
+    KEY idx_ra_device_whitelist (whitelisted, opt_in_mode)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS remote_access_sessions (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    session_id VARCHAR(36) NOT NULL,
+    device_id VARCHAR(128) NOT NULL,
+    company_id INT UNSIGNED NOT NULL DEFAULT 1,
+    operator_user_id INT UNSIGNED NULL,
+    status ENUM('pending','active','inactive','closed','closed_timeout') NOT NULL DEFAULT 'pending',
+    tunnel ENUM('wireguard','ssh_reverse') NOT NULL DEFAULT 'wireguard',
+    endpoint VARCHAR(255) NULL,
+    wg_client_private_key VARCHAR(64) NULL,
+    wg_client_address VARCHAR(64) NULL,
+    wg_server_public_key VARCHAR(64) NULL,
+    wg_peer_allowed_ips VARCHAR(255) NULL,
+    expires_at INT UNSIGNED NULL,
+    last_activity_at TIMESTAMP NULL,
+    close_reason VARCHAR(255) NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    closed_at TIMESTAMP NULL,
+    UNIQUE KEY uq_ra_session (session_id),
+    KEY idx_ra_sess_device (device_id, status),
+    KEY idx_ra_sess_status (status, last_activity_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS remote_access_events (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    session_id VARCHAR(36) NULL,
+    device_id VARCHAR(128) NOT NULL,
+    actor_user_id INT UNSIGNED NULL,
+    action VARCHAR(64) NOT NULL,
+    reason VARCHAR(255) NULL,
+    meta_json LONGTEXT NULL,
+    client_ip VARCHAR(64) NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    KEY idx_ra_evt_device (device_id, created_at),
+    KEY idx_ra_evt_session (session_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

sql/migrations/007_remote_access.sqlite.sql

@@ -0,0 +1,50 @@
+-- SQLite dev mirror for remote access tables.
+
+CREATE TABLE IF NOT EXISTS remote_access_devices (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    device_id TEXT NOT NULL UNIQUE,
+    company_id INTEGER NOT NULL DEFAULT 1,
+    whitelisted INTEGER NOT NULL DEFAULT 0,
+    opt_in_mode TEXT NOT NULL DEFAULT 'none',
+    last_random TEXT NULL,
+    app_version TEXT NULL,
+    last_seen_at TEXT NULL,
+    notes TEXT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS remote_access_sessions (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    session_id TEXT NOT NULL UNIQUE,
+    device_id TEXT NOT NULL,
+    company_id INTEGER NOT NULL DEFAULT 1,
+    operator_user_id INTEGER NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    tunnel TEXT NOT NULL DEFAULT 'wireguard',
+    endpoint TEXT NULL,
+    wg_client_private_key TEXT NULL,
+    wg_client_address TEXT NULL,
+    wg_server_public_key TEXT NULL,
+    wg_peer_allowed_ips TEXT NULL,
+    expires_at INTEGER NULL,
+    last_activity_at TEXT NULL,
+    close_reason TEXT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    closed_at TEXT NULL
+);
+
+CREATE TABLE IF NOT EXISTS remote_access_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    session_id TEXT NULL,
+    device_id TEXT NOT NULL,
+    actor_user_id INTEGER NULL,
+    action TEXT NOT NULL,
+    reason TEXT NULL,
+    meta_json TEXT NULL,
+    client_ip TEXT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_ra_evt_device ON remote_access_events(device_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_ra_sess_device ON remote_access_sessions(device_id, status);

sql/migrations/009_rssh_sessions.sql

@@ -0,0 +1,8 @@
+-- RSSH session credentials (MariaDB). Idempotent ALTERs.
+ALTER TABLE remote_access_sessions
+    ADD COLUMN IF NOT EXISTS rssh_bastion_host VARCHAR(255) NULL,
+    ADD COLUMN IF NOT EXISTS rssh_bastion_port INT UNSIGNED NULL,
+    ADD COLUMN IF NOT EXISTS rssh_username VARCHAR(64) NULL,
+    ADD COLUMN IF NOT EXISTS rssh_secret VARCHAR(128) NULL,
+    ADD COLUMN IF NOT EXISTS rssh_remote_port INT UNSIGNED NULL,
+    ADD COLUMN IF NOT EXISTS rssh_local_port INT UNSIGNED NULL DEFAULT 8022;

sql/migrations/009_rssh_sessions.sqlite.sql

@@ -0,0 +1 @@
+-- RSSH columns for SQLite (applied via Database::ensureSchema).