feat(api): Postgres persistence for registries + scans (owner-scoped, fail-closed)

- schema migration 001 (registries, scans; owner_sub = introspected subject)
- pg pool + services; scan ownership enforced in SQL (INSERT ... SELECT WHERE owner_sub)
- real handlers: 201/400/404/500, owner-scoped GET/POST, listScans registryId filter
- graceful shutdown closes pool; 7 new persistence tests (21/21)

apps/api/src/db/pool.ts

@@ -0,0 +1,22 @@
+import { Pool } from "pg";
+
+let pool: Pool | null = null;
+
+export function getPool(): Pool {
+  if (!pool) {
+    pool = new Pool({
+      connectionString: process.env.DATABASE_URL,
+      max: 10,
+      idleTimeoutMillis: 30_000,
+      connectionTimeoutMillis: 5_000,
+    });
+  }
+  return pool;
+}
+
+export async function closePool(): Promise<void> {
+  if (pool) {
+    await pool.end();
+    pool = null;
+  }
+}

apps/api/src/index.ts

@@ -1,6 +1,13 @@
-import Fastify from "fastify";
+import Fastify, { type FastifyReply, type FastifyRequest } from "fastify";
 import { envSchema } from "@siax/c0py-config";
 import { createIntrospector } from "./auth/introspection.js";
+import { getPool, closePool } from "./db/pool.js";
+import {
+  listRegistries,
+  createRegistry,
+  getRegistry,
+} from "./services/registries.js";
+import { createScan, listScans, getScan } from "./services/scans.js";
 
 async function main() {
   const env = envSchema.parse(process.env);
@@ -51,40 +58,115 @@ async function main() {
     }
   });
 
-  server.get("/", async () => ({
-    name: "c0py",
-    version: "0.1.0",
-    status: "running",
-  }));
+  const requireSub = (request: FastifyRequest): string => {
+    const user = (request as unknown as { user?: { sub?: string } }).user;
+    if (!user?.sub) {
+      throw Object.assign(new Error("missing subject"), { statusCode: 401 });
+    }
+    return user.sub;
+  };
 
-  // Registry endpoints
-  server.get("/v1/c0py/registries", async () => {
-    return { registries: [] };
+  const dbError = (reply: FastifyReply, err: unknown) => {
+    reply.log.error(err, "database error");
+    return reply.code(500).send({ error: "Internal Server Error" });
+  };
+
+  // Registry endpoints (owner-scoped by introspected subject)
+  server.get("/v1/c0py/registries", async (request, reply) => {
+    try {
+      return { registries: await listRegistries(getPool(), requireSub(request)) };
+    } catch (err) {
+      return dbError(reply, err);
+    }
   });
 
-  server.post("/v1/c0py/registries", async (request) => {
+  server.post("/v1/c0py/registries", async (request, reply) => {
     const body = (request.body as Record<string, unknown>) ?? {};
-    return { created: body };
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    const url = typeof body.url === "string" ? body.url.trim() : "";
+    if (!name || !url) {
+      await reply.code(400).send({ error: "name and url are required" });
+      return;
+    }
+    try {
+      const registry = await createRegistry(getPool(), requireSub(request), {
+        name,
+        url,
+        config: body.config,
+      });
+      await reply.code(201).send({ registry });
+    } catch (err) {
+      return dbError(reply, err);
+    }
   });
 
-  server.get("/v1/c0py/registries/:id", async (request) => {
+  server.get("/v1/c0py/registries/:id", async (request, reply) => {
     const { id } = request.params as Record<string, string>;
-    return { id };
+    try {
+      const registry = await getRegistry(getPool(), requireSub(request), id);
+      if (!registry) {
+        await reply.code(404).send({ error: "Not Found" });
+        return;
+      }
+      return { registry };
+    } catch (err) {
+      return dbError(reply, err);
+    }
   });
 
-  // Scan endpoints
-  server.post("/v1/c0py/scans", async (request) => {
+  // Scan endpoints (owner-scoped, registry ownership enforced in SQL)
+  server.post("/v1/c0py/scans", async (request, reply) => {
     const body = (request.body as Record<string, unknown>) ?? {};
-    return { scanId: "scan-" + Date.now(), created: body };
+    const registryId = typeof body.registryId === "string" ? body.registryId.trim() : "";
+    if (!registryId) {
+      await reply.code(400).send({ error: "registryId is required" });
+      return;
+    }
+    try {
+      const scan = await createScan(getPool(), requireSub(request), registryId);
+      if (!scan) {
+        await reply.code(404).send({ error: "Not Found" });
+        return;
+      }
+      await reply.code(201).send({ scan });
+    } catch (err) {
+      return dbError(reply, err);
+    }
   });
 
-  server.get("/v1/c0py/scans/:id", async (request) => {
+  server.get("/v1/c0py/scans", async (request, reply) => {
+    const query = request.query as Record<string, string | undefined>;
+    try {
+      return { scans: await listScans(getPool(), requireSub(request), query.registryId) };
+    } catch (err) {
+      return dbError(reply, err);
+    }
+  });
+
+  server.get("/v1/c0py/scans/:id", async (request, reply) => {
     const { id } = request.params as Record<string, string>;
-    return { id };
+    try {
+      const scan = await getScan(getPool(), requireSub(request), id);
+      if (!scan) {
+        await reply.code(404).send({ error: "Not Found" });
+        return;
+      }
+      return { scan };
+    } catch (err) {
+      return dbError(reply, err);
+    }
   });
 
   await server.listen({ port: env.PORT, host: "0.0.0.0" });
   console.log(`c0py API listening on port ${env.PORT}`);
+
+  for (const signal of ["SIGTERM", "SIGINT"] as const) {
+    process.on(signal, async () => {
+      await server.close();
+      await closePool();
+      process.exit(0);
+    });
+  }
 }
 
 main().catch((err) => {

apps/api/src/services/registries.ts

@@ -0,0 +1,56 @@
+export interface RegistryRow {
+  id: string;
+  owner_sub: string;
+  name: string;
+  url: string;
+  config: unknown;
+  created_at: Date;
+}
+
+export interface PoolLike {
+  query(text: string, values?: unknown[]): Promise<{ rows: Record<string, unknown>[] }>;
+}
+
+function toRegistry(row: Record<string, unknown>): {
+  id: string;
+  name: string;
+  url: string;
+  config: unknown;
+  createdAt: string;
+} {
+  return {
+    id: String(row.id),
+    name: String(row.name),
+    url: String(row.url),
+    config: row.config,
+    createdAt: new Date(row.created_at as string).toISOString(),
+  };
+}
+
+export async function listRegistries(db: PoolLike, ownerSub: string) {
+  const res = await db.query(
+    "SELECT id, owner_sub, name, url, config, created_at FROM registries WHERE owner_sub = $1 ORDER BY created_at DESC",
+    [ownerSub],
+  );
+  return res.rows.map(toRegistry);
+}
+
+export async function createRegistry(
+  db: PoolLike,
+  ownerSub: string,
+  input: { name: string; url: string; config?: unknown },
+) {
+  const res = await db.query(
+    "INSERT INTO registries (owner_sub, name, url, config) VALUES ($1, $2, $3, $4::jsonb) RETURNING id, owner_sub, name, url, config, created_at",
+    [ownerSub, input.name, input.url, JSON.stringify(input.config ?? {})],
+  );
+  return toRegistry(res.rows[0]);
+}
+
+export async function getRegistry(db: PoolLike, ownerSub: string, id: string) {
+  const res = await db.query(
+    "SELECT id, owner_sub, name, url, config, created_at FROM registries WHERE owner_sub = $1 AND id = $2",
+    [ownerSub, id],
+  );
+  return res.rows[0] ? toRegistry(res.rows[0]) : null;
+}

apps/api/src/services/scans.ts

@@ -0,0 +1,70 @@
+export interface ScanRow {
+  id: string;
+  registry_id: string;
+  owner_sub: string;
+  status: string;
+  result: unknown;
+  created_at: Date;
+  updated_at: Date;
+}
+
+export interface PoolLike {
+  query(text: string, values?: unknown[]): Promise<{ rows: Record<string, unknown>[] }>;
+}
+
+function toScan(row: Record<string, unknown>): {
+  id: string;
+  registryId: string;
+  status: string;
+  result: unknown;
+  createdAt: string;
+  updatedAt: string;
+} {
+  return {
+    id: String(row.id),
+    registryId: String(row.registry_id),
+    status: String(row.status),
+    result: row.result,
+    createdAt: new Date(row.created_at as string).toISOString(),
+    updatedAt: new Date(row.updated_at as string).toISOString(),
+  };
+}
+
+export async function createScan(
+  db: PoolLike,
+  ownerSub: string,
+  registryId: string,
+): Promise<ReturnType<typeof toScan> | null> {
+  // Ownership check happens in SQL: the scan may only reference a registry
+  // owned by the same subject. Inserting otherwise returns no rows (fail-closed).
+  const res = await db.query(
+    `INSERT INTO scans (registry_id, owner_sub, status)
+     SELECT id, $1, 'pending' FROM registries WHERE id = $2 AND owner_sub = $1
+     RETURNING id, registry_id, owner_sub, status, result, created_at, updated_at`,
+    [ownerSub, registryId],
+  );
+  return res.rows[0] ? toScan(res.rows[0]) : null;
+}
+
+export async function listScans(db: PoolLike, ownerSub: string, registryId?: string) {
+  if (registryId !== undefined) {
+    const res = await db.query(
+      "SELECT id, registry_id, owner_sub, status, result, created_at, updated_at FROM scans WHERE owner_sub = $1 AND registry_id = $2 ORDER BY created_at DESC",
+      [ownerSub, registryId],
+    );
+    return res.rows.map(toScan);
+  }
+  const res = await db.query(
+    "SELECT id, registry_id, owner_sub, status, result, created_at, updated_at FROM scans WHERE owner_sub = $1 ORDER BY created_at DESC",
+    [ownerSub],
+  );
+  return res.rows.map(toScan);
+}
+
+export async function getScan(db: PoolLike, ownerSub: string, id: string) {
+  const res = await db.query(
+    "SELECT id, registry_id, owner_sub, status, result, created_at, updated_at FROM scans WHERE owner_sub = $1 AND id = $2",
+    [ownerSub, id],
+  );
+  return res.rows[0] ? toScan(res.rows[0]) : null;
+}