Feat/use cvmanager schema

[dmccoystephenson]

New Base Branch

The wydot-deployment-2026 branch was created using the 2.0.1 release tag as a base. The following changes were made using the previous changes in the wydot-deployment branch as a reference.

Changes

(TBD)

[Copilot]

Pull request overview

This pull request migrates the PostgreSQL database from using the default public schema to a dedicated cvmanager schema. The changes are systematic and comprehensive, updating all SQL queries, database scripts, test files, and documentation across the entire codebase.

Key Changes

• All SQL table references updated from public.<table> to cvmanager.<table>
• Database creation scripts updated to create the cvmanager schema at initialization
• Test expectations updated to match the new schema naming
• Keycloak custom user provider updated to use the new schema
• Documentation updated to reflect the schema change

Reviewed changes

Copilot reviewed 85 out of 85 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
services/common/snmp/update_pg/*.py	Updated SNMP-related PostgreSQL queries to use cvmanager schema
services/common/email_util.py	Updated email notification queries to use cvmanager schema
services/common/auth_tools.py	Updated authentication and authorization queries to use cvmanager schema
services/api/src/*.py	Updated all API service queries to use cvmanager schema
services/api/tests/**/*.py	Updated test expectations to match cvmanager schema
services/addons/images/**/*.py	Updated addon service queries to use cvmanager schema
services/addons/tests/**/*.py	Updated addon test expectations to match cvmanager schema
resources/sql_scripts/update_scripts/*.sql	Updated migration scripts to use cvmanager schema
resources/sql_scripts/*.sql	Updated schema creation and sample data scripts to create and use cvmanager schema
resources/kubernetes/cv-manager-postgres.yaml	Updated Kubernetes deployment config to use cvmanager schema
resources/keycloak/custom-user-provider/**/*.java	Updated Keycloak custom provider to query cvmanager schema
resources/keycloak/**/*.md	Updated documentation to reference cvmanager schema

The changes appear to be consistent and comprehensive across the codebase. The migration follows a clear pattern of replacing public. with cvmanager. in all SQL queries and creating the schema during database initialization.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The rsu_credentials.password and snmp_credentials.password/encrypt_password columns store device and SNMP authentication secrets in cleartext, so anyone with read access to the database (including via SQL injection in other parts of the system or compromised DB credentials) can recover live RSU access credentials and SNMP encryption passphrases. This enables attackers to take over RSUs, change configuration, and intercept or tamper with management traffic. These secrets should be protected at rest, for example by storing only hashed/derived forms where possible or using an external secret store or strong application/database-level encryption for these columns.

[Copilot]

The iss_keys.token column stores SCMS/ISS tokens in cleartext, meaning a database compromise or unintended query exposure would immediately leak live authentication tokens that can be reused by an attacker. With these tokens, an attacker could impersonate authorized components, potentially issuing fraudulent commands or accessing protected services. These tokens should never be stored in plaintext; instead, store only derived/hashed representations where feasible or encrypt the column with strong key management so that tokens are unusable if the database is compromised.

Suggested change

	token character varying(128) COLLATE pg_catalog.default NOT NULL
	token_hash bytea NOT NULL

[Copilot]

The new encrypt_password column on cvmanager.snmp_credentials stores the SNMP encryption passphrase as a plain varchar, so any compromise of the database or over-privileged account can directly reveal this sensitive key. With this value an attacker can decrypt or forge SNMPv3 traffic to managed RSUs, undermining the confidentiality and integrity of management operations. This secret should be protected at rest, for example by using an external secret store or strong, well-managed encryption instead of storing the raw passphrase in plaintext.

Suggested change

	ALTER TABLE cvmanager.snmp_credentials
	ADD COLUMN encrypt_password character varying(128) COLLATE pg_catalog.default;
	CREATE EXTENSION IF NOT EXISTS pgcrypto;
	ALTER TABLE cvmanager.snmp_credentials
	ADD COLUMN encrypt_password bytea;
	COMMENT ON COLUMN cvmanager.snmp_credentials.encrypt_password IS
	'Stores the SNMPv3 encryption passphrase encrypted (e.g. via pgcrypto); do not store plaintext values.';