Bootstrap: PostgreSQL cloud ERD MVP

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+name: ci
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+        with:
+          python-version: "3.10"
+
+      - name: Install backend deps
+        working-directory: backend
+        run: |
+          python -m pip install -U pip
+          python -m pip install -e ".[dev]"
+
+      - name: Typecheck (mypy)
+        working-directory: backend
+        run: mypy app
+
+      - name: Tests (pytest)
+        working-directory: backend
+        run: pytest -q
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Node
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install
+        working-directory: frontend
+        run: npm ci
+
+      - name: Typecheck
+        working-directory: frontend
+        run: npm run typecheck
+
+      - name: Build
+        working-directory: frontend
+        run: npm run build

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: codeql
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "0 2 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript", "python"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0

.github/workflows/dependency-review.yml

@@ -0,0 +1,16 @@
+name: dependency-review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Dependency Review
+        uses: actions/dependency-review-action@ce3cf9537a52e8119d91fd484ab5b8a807627bf8 # v4.6.0

.github/workflows/scorecard.yml

@@ -0,0 +1,36 @@
+name: scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 1 * * 6"
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    permissions:
+      contents: read
+      security-events: write
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -22,3 +22,7 @@ __pycache__/
 node_modules/
 dist/
 .vite/
+
+# opencode tooling artifacts
+registered_agents.json
+task_agent_mapping.json

README.md

@@ -13,6 +13,19 @@ PostgreSQL 전문 클라우드 ERD(협업/공유) 소프트웨어의 **실행 
 - **ERD UI**: React Flow(MIT)로 PK/FK를 그래픽으로 렌더링
 - **Forward engineering(포워드)**: MVP 단계에서는 “스냅샷 기반 DDL(export)” 중심 (diff/변경 SQL 생성은 로드맵)
 
+  - SQL export: `GET /api/snapshots/{snapshot_uuid}/export.sql`
+
+## 공유(동료에게 링크 공유)
+
+프로젝트 오너는 공유 링크를 생성할 수 있습니다.
+
+```bash
+curl -X POST "http://localhost:8000/api/projects/<project_uuid>/share-links" \
+  -H "X-Dev-User: alice"
+```
+
+반환된 `url_path`로 동료가 최신 스냅샷 목록/스냅샷 JSON/DDL export를 조회할 수 있습니다.
+
 ## 인덱스 타입 지원 원칙
 
 PostgreSQL은 `CREATE INDEX ... USING <method>`의 `<method>`가 기본(btree/hash/gist/gin/spgist/brin)뿐 아니라 **확장(extension)으로 추가된 access method**도 될 수 있습니다.
@@ -40,6 +53,17 @@ docker compose up -d --build
 - Frontend: http://localhost:5173
 - Backend: http://localhost:8000 (health: /healthz)
 
+## 실행(프로덕션 스타일, Docker)
+
+프론트는 정적 빌드 + nginx로 서빙하며, `/api/*`는 백엔드로 프록시합니다.
+
+```bash
+cp .env.example .env
+docker compose -f compose.prod.yaml up -d --build
+```
+
+- Frontend: http://localhost:8080
+
 ## 개발(비-Docker)
 
 ### Backend

backend/alembic/versions/0002_auth_share.py

@@ -0,0 +1,141 @@
+"""auth + share links + foreign keys
+
+Revision ID: 0002_auth_share
+Revises: 0001_init
+Create Date: 2026-01-31
+
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0002_auth_share"
+down_revision = "0001_init"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Add FK constraints (MVP: best-effort for fresh DB)
+    op.create_foreign_key(
+        "fk_project_space__created_by_user",
+        "project_space",
+        "user_account",
+        ["created_by_user_uuid"],
+        ["user_account_uuid"],
+    )
+    op.create_foreign_key(
+        "fk_project_member__project_space",
+        "project_member",
+        "project_space",
+        ["project_space_uuid"],
+        ["project_space_uuid"],
+        ondelete="CASCADE",
+    )
+    op.create_foreign_key(
+        "fk_project_member__user_account",
+        "project_member",
+        "user_account",
+        ["user_account_uuid"],
+        ["user_account_uuid"],
+        ondelete="CASCADE",
+    )
+    op.create_foreign_key(
+        "fk_db_connection__project_space",
+        "db_connection",
+        "project_space",
+        ["project_space_uuid"],
+        ["project_space_uuid"],
+        ondelete="CASCADE",
+    )
+    op.create_foreign_key(
+        "fk_schema_snapshot__project_space",
+        "schema_snapshot",
+        "project_space",
+        ["project_space_uuid"],
+        ["project_space_uuid"],
+        ondelete="CASCADE",
+    )
+    op.create_foreign_key(
+        "fk_schema_snapshot__db_connection",
+        "schema_snapshot",
+        "db_connection",
+        ["db_connection_uuid"],
+        ["db_connection_uuid"],
+        ondelete="CASCADE",
+    )
+    op.create_foreign_key(
+        "fk_schema_snapshot_data__schema_snapshot",
+        "schema_snapshot_data",
+        "schema_snapshot",
+        ["schema_snapshot_uuid"],
+        ["schema_snapshot_uuid"],
+        ondelete="CASCADE",
+    )
+
+    # Share links
+    op.create_table(
+        "share_link",
+        sa.Column("share_link_uuid", sa.Uuid(), primary_key=True, nullable=False),
+        sa.Column("project_space_uuid", sa.Uuid(), nullable=False),
+        sa.Column("created_by_user_uuid", sa.Uuid(), nullable=False),
+        sa.Column("permission_kind", sa.Text(), nullable=False),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+    )
+    op.create_index(
+        "ix_share_link__project_space_uuid",
+        "share_link",
+        ["project_space_uuid"],
+    )
+    op.create_foreign_key(
+        "fk_share_link__project_space",
+        "share_link",
+        "project_space",
+        ["project_space_uuid"],
+        ["project_space_uuid"],
+        ondelete="CASCADE",
+    )
+    op.create_foreign_key(
+        "fk_share_link__created_by_user",
+        "share_link",
+        "user_account",
+        ["created_by_user_uuid"],
+        ["user_account_uuid"],
+        ondelete="CASCADE",
+    )
+
+
+def downgrade() -> None:
+    op.drop_constraint(
+        "fk_share_link__created_by_user", "share_link", type_="foreignkey"
+    )
+    op.drop_constraint("fk_share_link__project_space", "share_link", type_="foreignkey")
+    op.drop_index("ix_share_link__project_space_uuid", table_name="share_link")
+    op.drop_table("share_link")
+
+    op.drop_constraint(
+        "fk_schema_snapshot_data__schema_snapshot",
+        "schema_snapshot_data",
+        type_="foreignkey",
+    )
+    op.drop_constraint(
+        "fk_schema_snapshot__db_connection", "schema_snapshot", type_="foreignkey"
+    )
+    op.drop_constraint(
+        "fk_schema_snapshot__project_space", "schema_snapshot", type_="foreignkey"
+    )
+    op.drop_constraint(
+        "fk_db_connection__project_space", "db_connection", type_="foreignkey"
+    )
+    op.drop_constraint(
+        "fk_project_member__user_account", "project_member", type_="foreignkey"
+    )
+    op.drop_constraint(
+        "fk_project_member__project_space", "project_member", type_="foreignkey"
+    )
+    op.drop_constraint(
+        "fk_project_space__created_by_user", "project_space", type_="foreignkey"
+    )

backend/app/api/connections.py

@@ -7,8 +7,10 @@
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import CurrentUser, get_current_user
 from app.db import get_session
 from app.models import DbConnection
+from app.permissions import require_project_member
 from app.schemas import ConnectionCreateIn, ConnectionOut
 from app.security import encrypt_text
 from app.sanitize import sanitize_for_storage
@@ -19,8 +21,11 @@
 
 @router.get("/by-project/{project_space_uuid}", response_model=list[ConnectionOut])
 async def list_connections(
-    project_space_uuid: uuid.UUID, session: AsyncSession = Depends(get_session)
+    project_space_uuid: uuid.UUID,
+    user: CurrentUser = Depends(get_current_user),
+    session: AsyncSession = Depends(get_session),
 ) -> list[ConnectionOut]:
+    await require_project_member(session, project_space_uuid, user.user_account_uuid)
     rows = await session.execute(
         select(DbConnection)
         .where(DbConnection.project_space_uuid == project_space_uuid)
@@ -37,8 +42,10 @@ async def list_connections(
 async def create_connection(
     project_space_uuid: uuid.UUID,
     body: ConnectionCreateIn,
+    user: CurrentUser = Depends(get_current_user),
     session: AsyncSession = Depends(get_session),
 ) -> ConnectionOut:
+    await require_project_member(session, project_space_uuid, user.user_account_uuid)
     encrypted = encrypt_text(str(sanitize_for_storage(body.dsn)))
     c = DbConnection(
         db_connection_uuid=uuid.uuid4(),