Set the chart's placeholder version to 0.12.0

Cosmetic, as in 041e159 and 989425e. `make helm-package` passes --version
and --app-version from the tag, so neither field decides anything about
what release.yaml publishes.

Done anyway because a tree heading for v0.12.0 that still says 0.11.1
tells a reader something false. appVersion keeps the v, per
APPVERSION_PREFIX in .release.conf.

.gitea/workflows/ci.yaml

@@ -45,6 +45,29 @@ jobs:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build
         - gobin-cache:/go/bin
+
+    # The suite needs a real Postgres -- there is no in-memory Postgres the way there was
+    # an in-memory SQLite, so each test gets its own schema on a shared server instead.
+    # The job and the service share the dind bridge, so the service is reachable by its
+    # name rather than on localhost.
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: terdut
+          POSTGRES_PASSWORD: terdut
+          POSTGRES_DB: terdut_test
+        options: >-
+          --health-cmd "pg_isready -U terdut -d terdut_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+
+    env:
+      # `make test` fails without this rather than skipping, so a green job here means
+      # the tests actually ran against a database.
+      TERDUT_TEST_DSN: postgres://terdut:terdut@postgres:5432/terdut_test?sslmode=disable
+
     steps:
       - name: Checkout
         env:

.gitea/workflows/release.yaml

@@ -35,6 +35,27 @@ jobs:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build
         - gobin-cache:/go/bin
+
+    # The same database ci.yaml's test job gets, for the same reason: `make test` needs a
+    # real Postgres and fails without TERDUT_TEST_DSN rather than skipping. This job is
+    # the gate every publishing job below hangs off, so it has to be able to run the
+    # suite -- v0.11.0 was tagged with the service here missing and published nothing.
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: terdut
+          POSTGRES_PASSWORD: terdut
+          POSTGRES_DB: terdut_test
+        options: >-
+          --health-cmd "pg_isready -U terdut -d terdut_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+
+    env:
+      TERDUT_TEST_DSN: postgres://terdut:terdut@postgres:5432/terdut_test?sslmode=disable
+
     steps:
       - name: Checkout
         env:

CLAUDE.md

@@ -22,10 +22,16 @@ Two things about this repo specifically:
   `Ryuvia/charts` to this version. Added 2026-09-02; every release up to and including
   v0.9.3 was published with no CVE check at all.
 - **The wrapper chart has two `tag:` lines** — the app image and the python backup sidecar —
-  so `chart-bump` needs `--image "$IMAGE"` to know which one moves.
+  so `chart-bump` needs `--image "$IMAGE"` to know which one moves. That sidecar backs up
+  SQLite; the Postgres move (#2) retires it in favour of a `postgresql` CR with a k8up
+  `pg_dump` annotation, after which only the app image's tag is left.
 
 ## Checks
 
+The tests need a Postgres: `make test-db` starts one and prints the DSN, `make test-db-stop`
+removes it, and `TERDUT_TEST_DSN` is how both the Makefile and `ci.yaml`'s service container
+point the suite at it. Without it the suite fails rather than skipping, on purpose.
+
 `make fmt lint test helm-lint` **is** what the pipeline runs — `ci.yaml` and `release.yaml`
 call these targets rather than restating them, the way riksdata and rd-web do. A green gate
 here and a green pipeline are the same code, not two descriptions of it. `test` adds `-race`,

Makefile

@@ -25,12 +25,45 @@ help: ## Show this help
 #
 # These three mirror .gitea/workflows/ci.yaml step for step, so a green `make fmt
 # lint test` here means the same thing CI means. The one deliberate difference is
-# -race below.
+# -race below. Both need a Postgres to test against; see test-db.
+
+# The suite needs a Postgres, because the server does: there is no in-memory
+# Postgres the way there was an in-memory SQLite. TERDUT_TEST_DSN says where, and
+# the tests fail rather than skip without it — a suite that quietly tests nothing
+# is worse than one that does not run. `make test-db` starts a local one;
+# ci.yaml runs the same thing as a service container.
+TEST_DB_CONTAINER ?= terdut-test-db
+TEST_DB_PORT      ?= 5433
+TEST_DB_IMAGE     ?= docker.io/library/postgres:17-alpine
+export TERDUT_TEST_DSN ?= postgres://terdut:terdut@localhost:$(TEST_DB_PORT)/terdut_test?sslmode=disable
 
 .PHONY: test
-test: ## Run the test suite
+test: ## Run the test suite (needs TERDUT_TEST_DSN; see test-db)
 	go test -race ./...
 
+# podman, with docker as the fallback: this is a dev convenience, not part of the
+# pipeline, where the database arrives as a service container instead.
+.PHONY: test-db
+test-db: ## Start a local Postgres for the tests
+	@runtime=$$(command -v podman || command -v docker); \
+	if [ -z "$$runtime" ]; then echo "need podman or docker"; exit 1; fi; \
+	$$runtime run -d --rm --name $(TEST_DB_CONTAINER) \
+		-e POSTGRES_USER=terdut -e POSTGRES_PASSWORD=terdut -e POSTGRES_DB=terdut_test \
+		-p $(TEST_DB_PORT):5432 $(TEST_DB_IMAGE) >/dev/null; \
+	printf 'waiting for postgres'; \
+	for i in $$(seq 1 60); do \
+		if $$runtime exec $(TEST_DB_CONTAINER) pg_isready -U terdut -d terdut_test >/dev/null 2>&1; then \
+			echo " ready: $(TERDUT_TEST_DSN)"; exit 0; \
+		fi; \
+		printf '.'; sleep 1; \
+	done; \
+	echo " timed out"; exit 1
+
+.PHONY: test-db-stop
+test-db-stop: ## Stop the local test Postgres
+	@runtime=$$(command -v podman || command -v docker); \
+	$$runtime rm -f $(TEST_DB_CONTAINER) >/dev/null 2>&1 || true
+
 # CI runs a bare `go test ./...`. This is stricter on purpose: the sweeper, the
 # notifier goroutine and the deadman sweep all touch the same single-connection
 # database, and a race there would surface as a flaky production incident rather
@@ -54,16 +87,23 @@ fmt: ## Report unformatted files
 		echo "gofmt needed:"; echo "$$unformatted"; gofmt -d .; exit 1; \
 	fi
 
+# database.dsn has no default and the deployment `required`s it: the chart
+# provisions no database and cannot guess where it is, so a render without it is
+# meant to fail. Setting it here keeps the lint honest about what a working
+# install needs.
+HELM_LINT_SET = --set image.tag=v0.0.0 \
+	--set 'database.dsn=postgres://terdut@terdut-postgres:5432/terdut?sslmode=require'
+
 .PHONY: helm-lint
 helm-lint: ## Lint and render the chart
-	helm lint $(HELM_CHART) --set image.tag=v0.0.0
+	helm lint $(HELM_CHART) $(HELM_LINT_SET)
 	helm template terdut-server $(HELM_CHART) --namespace terdut-server \
-		--set image.tag=v0.0.0 >/dev/null
+		$(HELM_LINT_SET) >/dev/null
 	@# networking.listener defaults to "", which attaches the route to every
 	@# matching listener including plaintext HTTP. Production sets it, so the
 	@# default render proves nothing about the path that actually ships.
 	helm template terdut-server $(HELM_CHART) --namespace terdut-server \
-		--set image.tag=v0.0.0 --set networking.listener=https-terdut >/dev/null
+		$(HELM_LINT_SET) --set networking.listener=https-terdut >/dev/null
 
 ## --- release ---
 

README.md

@@ -9,7 +9,7 @@ Incident management server for teams using Prometheus Alertmanager.
 - Alert and incident statistics, including MTTA and MTTR
 - Web UI for phones and desktops, served by the same binary
 - REST API with per-user API key authentication
-- Single binary, SQLite storage — trivial to self-host
+- Single binary plus a Postgres — straightforward to self-host
 
 ---
 
@@ -89,11 +89,14 @@ the web UI (`/incidents/{id}`).
 
 ```bash
 docker build -t terdut-server .
-docker run -p 8080:8080 -v $(pwd)/data:/data \
-  -e TERDUT_DB_PATH=/data/terdut.db \
+docker run -p 8080:8080 \
+  -e TERDUT_DB_DSN='postgres://terdut:secret@host.docker.internal:5432/terdut?sslmode=disable' \
   terdut-server
 ```
 
+The server creates its own schema on startup and needs a reachable Postgres; it stores nothing on
+disk, so there is no volume to mount.
+
 ### Kubernetes
 
 A Helm chart is published from this repository as an OCI artifact, versioned in lockstep
@@ -116,24 +119,37 @@ than an `Ingress`. TLS is terminated at the gateway, so the server itself never
 | `networking.listener` | `""` | Gateway listener (`sectionName`) to bind to. Empty attaches to every matching listener, **including plaintext HTTP** — set it to the HTTPS listener's name to serve TLS only |
 | `networking.servicePort` | `8080` | Port the route forwards to; keep in sync with `service.port` |
 | `bootstrap.enabled` | `true` | Runs a post-install hook that creates the first user and stores its API key in the `<release>-admin-key` Secret. Already-bootstrapped servers are left alone |
-| `backupSidecar.enabled` | `true` | Adds an idle `python` sidecar and the [k8up](https://k8up.io/) annotations that dump the database through it |
+| `database.dsn` | `""` | **Required.** Postgres DSN, with no password in it. The chart provisions no database |
+| `database.passwordSecret.name` | `""` | Secret supplying `PGPASSWORD`. With the Zalando postgres operator, the Secret it generates for the role |
+| `database.passwordSecret.key` | `password` | Key within that Secret |
 
 The API key travels in an `Authorization: Bearer` header, so set `networking.listener` whenever the
 hostname is reachable outside a trusted network.
 
+#### The database
+
+The chart provisions no database: it takes a DSN and expects a Postgres that already exists. In this
+cluster the wrapper chart declares an `acid.zalan.do/v1 postgresql` CR; anywhere else, any reachable
+Postgres 14+ will do.
+
+The DSN carries no password. pgx falls back to libpq's environment variables for whatever the DSN
+leaves out, so the password arrives as `PGPASSWORD` from a Secret and never appears in values, in
+the rendered manifest or in `kubectl describe pod`. With the postgres operator that Secret is the
+one it generates for the role, so a rebuild mints a new password with nothing to keep in sync —
+the same wiring miniflux uses.
+
+The server migrates its own schema on startup, so a new database only has to exist and be writable.
+
 #### Backups
 
-The server image is `FROM scratch` — the binary and nothing else — so there is no interpreter to
-run a database dump in, and the database runs in WAL mode, where a file-level copy of the volume is
-not crash-consistent. The chart therefore ships an idle `python:*-alpine` sidecar that shares the
-data volume, and points k8up's `backupcommand` at it with `k8up.io/backupcommand-container`. Without
-that annotation k8up execs into `.spec.containers[0]` and the dump fails.
+Postgres is backed up where it runs, not from here. The database pod carries a
+[k8up](https://k8up.io/) `k8up.io/backupcommand` annotation that streams a `pg_dump`, the same way
+gitea and immich do in this cluster.
 
-The dump is buffered and sanity-checked before its first byte reaches stdout, because k8up streams
-stdout straight into Restic: a dump that dies partway is otherwise stored as a silently truncated
-snapshot that k8up still reports as successful.
-
-Set `backupSidecar.enabled=false` if you back the volume up some other way.
+This used to be the app's problem: the SQLite database lived on a PVC beside the server, the image
+is `FROM scratch` with no interpreter to dump it, and WAL mode makes a file-level copy of the volume
+non-crash-consistent — so the chart shipped an idle `python:*-alpine` sidecar purely to give k8up
+somewhere to exec. The sidecar, the PVC and the `backupSidecar` values are all gone.
 
 ---
 
@@ -142,10 +158,10 @@ Set `backupSidecar.enabled=false` if you back the volume up some other way.
 | Variable | Default | Description |
 |---|---|---|
 | `TERDUT_ADDR` | `:8080` | TCP address to listen on |
-| `TERDUT_DB_PATH` | `terdut.db` | Path to the SQLite database file |
+| `TERDUT_DB_DSN` | — | **Required.** Postgres connection string, e.g. `postgres://terdut:secret@localhost:5432/terdut?sslmode=require` |
 | `TERDUT_ARCHIVE_AFTER` | `168h` (7d) | How long a resolved alert or incident stays in the default list before being auto-archived |
 | `TERDUT_STALE_AFTER` | `6h` | How long a firing alert may go without a refreshing webhook before it is treated as resolved — **must exceed your Alertmanager `repeat_interval`** |
-| `TERDUT_DEADMAN_MATCHERS` | `alertname=Watchdog` | Which alerts are [dead man's switches](#dead-mans-switch). `;` separates matchers, `,` the label conditions within one, `=` is exact equality. Every matcher must name an `alertname` |
+| `TERDUT_DEADMAN_MATCHERS` | `alertname=Watchdog` | The **default** matchers a team starts with — switches are per team now, and this seeds teams that have no configuration of their own. `;` separates matchers, `,` the label conditions within one, `=` is exact equality. Every matcher must name an `alertname` |
 | `TERDUT_DEADMAN_TIMEOUT` | `15m` | How long a heartbeat may go unheard before its switch is declared dead — **must be shorter than the `repeat_interval` of the route carrying it**. `0` disables dead man's switch handling |
 | `TERDUT_DEADMAN_SEVERITY` | `critical` | Severity a dead man's switch incident opens at |
 | `TERDUT_NTFY_URL` | — | ntfy server to publish push notifications to. Empty disables notifications entirely |
@@ -362,11 +378,23 @@ kube-prometheus-stack already ships the alert for this. `Watchdog` is
 nothing unless something downstream notices it stop. That is what
 `TERDUT_DEADMAN_MATCHERS` defaults to.
 
+**Switches belong to a team**, which decides which of its own alerts are
+heartbeats and how long a silence has to last. An owner sets them through
+`PUT /api/teams/{teamID}/deadman`; a missed heartbeat opens an incident in the
+team whose integration received it.
+
+The environment variables are the starting point, not the setting: at startup
+every team **without** a configuration of its own is given one from them, and an
+owner's later edit is never overwritten by a redeploy. A team created after
+that starts watching nothing until its owner says otherwise — inheriting an
+install-wide heartbeat would page a new team about a source it has never heard
+of.
+
 A matcher is a set of exact label conditions, one of which must be the
-`alertname`:
+`alertname`, in the same format the environment variable uses:
 
 ```
-TERDUT_DEADMAN_MATCHERS="alertname=Watchdog,cluster=prod; alertname=EdgeHeartbeat"
+alertname=Watchdog,cluster=prod; alertname=EdgeHeartbeat
 ```
 
 **The unit of monitoring is the fingerprint, not the alert name.** Two clusters
@@ -429,6 +457,30 @@ Authorization: Bearer <api-key>
 or the web UI's session cookie. A request that carries an `Authorization` header
 is judged on that header alone.
 
+Two kinds of user exist. An **administrator** manages accounts: creating and
+deleting users, setting anybody's password, minting keys for anybody, and
+granting the flag itself. Everybody else works incidents — acknowledging,
+assigning, snoozing, resolving, noting — and manages their own account and
+nobody else's. An API key carries exactly the rights of the user it belongs to.
+
+The first user, from `/api/bootstrap`, is an administrator. Users created
+afterwards are not, until an administrator says so. An install always keeps at
+least one: the last administrator can be neither deleted nor demoted, and
+nobody can delete or demote themselves.
+
+Endpoints that require the flag answer `403` with
+`{"error":"administrator access required"}`.
+
+**Teams** are the unit of tenancy, and are a separate axis from the administrator
+flag. A team owns its incidents, alerts, schedule and integrations, and a user
+sees exactly the teams they belong to — an administrator is not implicitly in
+every team, because administration is about accounts, not about reading other
+people's incidents. Within a team an **owner** configures it (schedule,
+integrations, membership) and a **member** works its incidents.
+
+Anything belonging to a team you are not in answers `404`, not `403`: whether an
+incident exists is itself something only its team should learn.
+
 | Method | Path | Description |
 |---|---|---|
 | `POST` | `/api/login` | `{"username","password"}` → sets the session cookie, returns `{user, has_password}`. `429` after too many failures |
@@ -439,20 +491,52 @@ is judged on that header alone.
 
 | Method | Path | Description |
 |---|---|---|
-| `POST` | `/api/bootstrap` | Create first user + API key `{"username","email","password"?}` (only works on empty DB) |
-| `GET` | `/api/users` | List users |
-| `POST` | `/api/users` | Create user `{"username","email"}` |
-| `DELETE` | `/api/users/{id}` | Delete user (cascades to keys) |
-| `PUT` | `/api/users/{id}/notify` | Set push notification target `{"ntfy_topic"}` — empty string clears it |
-| `PUT` | `/api/users/{id}/password` | Set web UI password `{"password","current_password"}`. `current_password` is required only when changing your own existing password. Ends the user's other sessions |
-| `POST` | `/api/users/{id}/api-keys` | Issue API key `{"name"}` — key shown once |
-| `DELETE` | `/api/users/{id}/api-keys/{keyID}` | Revoke API key |
+**admin** marks an endpoint that requires the administrator flag; **self or
+admin** marks one you may use on your own account and an administrator may use
+on anybody's.
+
+| Method | Path | Who | Description |
+|---|---|---|---|
+| `POST` | `/api/bootstrap` | — | Create first user + API key `{"username","email","password"?}` (only works on empty DB). The user is an administrator |
+| `GET` | `/api/users` | any | List users. Open to everybody: the queue's assignment control and the schedule both have to name people |
+| `POST` | `/api/users` | **admin** | Create user `{"username","email"}`. Not an administrator |
+| `DELETE` | `/api/users/{id}` | **admin** | Delete user (cascades to keys). `409` for yourself or the last administrator |
+| `PUT` | `/api/users/{id}/admin` | **admin** | Grant or revoke the administrator flag `{"is_admin"}`. `409` for yourself or the last administrator |
+| `PUT` | `/api/users/{id}/notify` | self or admin | Set push notification target `{"ntfy_topic"}` — empty string clears it |
+| `PUT` | `/api/users/{id}/password` | self or admin | Set web UI password `{"password","current_password"}`. `current_password` is required only when changing your own existing password. Ends the user's other sessions |
+| `POST` | `/api/users/{id}/api-keys` | self or admin | Issue API key `{"name"}` — key shown once |
+| `DELETE` | `/api/users/{id}/api-keys/{keyID}` | self or admin | Revoke API key |
 
 ### Alert ingestion
 
+Alerts arrive on a team's integration key. The key is both the credential and the
+routing: it says that the sender may post, and which team the alerts belong to.
+Create one with `POST /api/teams/{teamID}/integrations`, which returns the key
+and the full URL once and stores only a SHA-256 hash.
+
 | Method | Path | Description |
 |---|---|---|
-| `POST` | `/api/alertmanager/webhook` | Alertmanager v4 webhook receiver (no auth) |
+| `POST` | `/api/integrations/{key}/alertmanager` | Alertmanager v4 webhook receiver for the key's team. `401` for an unknown key |
+| `POST` | `/api/alertmanager/webhook` | **Deprecated, unauthenticated.** The pre-teams receiver, kept for one release so an upgrade does not stop delivering while the Alertmanager config is edited. Routes everything to the oldest team |
+
+The deprecated path is why anything that can reach the port can still open an
+incident. Move senders to a key and it goes away.
+
+### Teams
+
+| Method | Path | Who | Description |
+|---|---|---|---|
+| `GET` | `/api/teams` | any | The caller's own teams, each with their role |
+| `POST` | `/api/teams` | any | Create a team `{"name"}`; the creator becomes its first owner |
+| `DELETE` | `/api/teams/{teamID}` | **owner** | Delete a team and everything under it. `409` while it has open incidents |
+| `GET` | `/api/teams/{teamID}/members` | member | Who is in the team |
+| `POST` | `/api/teams/{teamID}/members` | **owner** | Add a member, or change their role `{"user_id","role"}` |
+| `DELETE` | `/api/teams/{teamID}/members/{userID}` | **owner** | Remove a member. `409` for the last owner |
+| `GET` | `/api/teams/{teamID}/integrations` | member | List integrations. Never returns keys |
+| `POST` | `/api/teams/{teamID}/integrations` | **owner** | Mint an integration `{"name","kind"}` — key and URL shown once |
+| `DELETE` | `/api/teams/{teamID}/integrations/{integrationID}` | **owner** | Revoke an integration |
+| `GET` | `/api/teams/{teamID}/deadman` | member | The team's [dead man's switch](#dead-mans-switch) configuration `{matchers, timeout_seconds, severity}` |
+| `PUT` | `/api/teams/{teamID}/deadman` | **owner** | Replace it. `400` when no matcher names an `alertname`, because a switch that silently watches nothing is the failure this feature exists to prevent |
 
 ### Notifications
 
@@ -639,13 +723,23 @@ unknown" rather than being rejected.
 
 | Method | Path | Description |
 |---|---|---|
-| `POST` | `/api/schedule` | Assign user to dates `{"user_id", "dates":["YYYY-MM-DD",...], "replace"}` — all-or-nothing |
-| `GET` | `/api/schedule` | List entries. Filters: `?from=YYYY-MM-DD`, `?to=YYYY-MM-DD` |
-| `GET` | `/api/schedule/current` | Today's on-call user (UTC), 404 if none |
-| `DELETE` | `/api/schedule/{id}` | Remove schedule entry |
+Each team keeps its own rota, so two teams can have two different people on call
+on the same day. The person taking a shift has to be in the team — paging
+somebody who cannot open the incident is worse than paging nobody.
+
+| Method | Path | Who | Description |
+|---|---|---|---|
+| `POST` | `/api/teams/{teamID}/schedule` | **owner** | Assign user to dates `{"user_id", "dates":["YYYY-MM-DD",...], "replace"}` — all-or-nothing |
+| `GET` | `/api/teams/{teamID}/schedule` | member | List entries. Filters: `?from=YYYY-MM-DD`, `?to=YYYY-MM-DD` |
+| `DELETE` | `/api/teams/{teamID}/schedule/{id}` | **owner** | Remove schedule entry |
+| `GET` | `/api/schedule/current` | any | Who is on call today (UTC) in **every** team the caller is in — one entry per team, `[]` when nobody anywhere |
 
 ### Statistics
 
+Every figure counts the caller's own teams only: a report that counted other
+teams' incidents would leak their volume, and their alert names through the
+top-alerts list, and would not be a number about the reader's work anyway.
+
 All stat endpoints accept optional `?from=YYYY-MM-DD` and `?to=YYYY-MM-DD`, and exclude archived rows to match the default list views. Alert stats filter on `received_at`; incident stats filter on `triggered_at`.
 
 | Method | Path | Description |
@@ -662,6 +756,85 @@ averages over incidents that have actually been acknowledged or resolved, and ar
 
 ---
 
+## Upgrading to teams
+
+Everything that existed before teams moves into one team called **Default**, and
+every existing user becomes an owner of it. The upgrade is a no-op for the
+people using it: the same queue, the same schedule, the same incidents, with a
+name on them.
+
+What changes, and will need attention:
+
+- **Alert ingestion moved.** `POST /api/alertmanager/webhook` still works but is
+  deprecated and unauthenticated, and routes everything to the oldest team. Mint
+  a key with `POST /api/teams/{teamID}/integrations` and point Alertmanager at
+  the URL it returns. The old path goes away in a later release.
+- **The schedule endpoints moved** under `/api/teams/{teamID}/schedule`, and
+  editing the rota is now an owner's job. `GET /api/schedule/current` stayed
+  where it was but now returns an **array** — one entry per team with somebody
+  on call — instead of a single object or a 404. This is a breaking API change
+  for anything that reads it, terdut-tui included.
+- **Uniqueness is per team now.** Two teams can legitimately see the same alert
+  fingerprint, the same Alertmanager groupKey, and put somebody on call on the
+  same date.
+
+**Dead man's switches moved too.** `TERDUT_DEADMAN_MATCHERS`, `_TIMEOUT` and
+`_SEVERITY` are no longer the setting; they are the default each existing team
+is seeded with at startup, after which an owner edits them per team through
+`PUT /api/teams/{teamID}/deadman` and a redeploy never overwrites that.
+
+Nothing else about an incident changes, and incidents never move between teams:
+an alert belongs to whichever team's key it arrived on.
+
+## Upgrading to roles
+
+Before this release every authenticated caller could create and delete users,
+set anybody's password and mint anybody's API keys. That is now the
+administrator flag, and the migration **makes every existing user an
+administrator** — they already held those powers, so nobody's access changes on
+upgrade and demotion is a deliberate act afterwards. Promoting only the first
+user would have silently stripped the rest, and could leave an install whose
+only administrator is an account nobody has a password for.
+
+Users created after the upgrade are not administrators. Hand the flag out with:
+
+```bash
+curl -X PUT https://terdut.example.com/api/users/7/admin \
+  -H "Authorization: Bearer $TERDUT_API_KEY" \
+  -H 'Content-Type: application/json' \
+  -d '{"is_admin": true}'
+```
+
+Nothing in the API changed shape, so terdut-tui needs no new version — but a
+non-administrator now gets `403` where a `200` used to come back.
+
+## Upgrading from SQLite
+
+Versions up to v0.10.2 stored everything in a SQLite file. From the Postgres release onwards
+the server needs `TERDUT_DB_DSN` and keeps nothing on disk.
+
+The cutover is ordered — the server must not be running while the copy happens:
+
+```bash
+# 1. Stop the old server, keeping its database file.
+# 2. Create an empty Postgres database, then let the new binary build the schema:
+TERDUT_DB_DSN='postgres://terdut:secret@localhost:5432/terdut?sslmode=disable' ./terdut &
+#    ...watch for "listening on", then stop it again.
+# 3. Copy the data across:
+go run -tags migrate ./scripts/sqlite-to-postgres.go \
+    -sqlite /data/terdut.db \
+    -dsn 'postgres://terdut:secret@localhost:5432/terdut?sslmode=disable'
+# 4. Start the new server for good.
+```
+
+The copy preserves every id, so incidents keep their numbers and the timeline, alert
+membership, outbox and ack tokens all still point where they did. It refuses a target that
+already has rows, so a second run cannot double-insert. On Kubernetes, step 3 runs as a Job
+with the same image against the PVC before it is removed.
+
+The script is deliberately temporary: it is the only thing left that needs the SQLite driver,
+and both should be deleted once the installs that need them have migrated.
+
 ## Upgrading to incidents
 
 The incidents release moves the workflow off alerts, which is a **breaking API
@@ -712,15 +885,23 @@ There is no migration and no schema change. An existing open incident from a
 ## Development
 
 ```bash
-go test ./...        # run all tests
+make test-db         # start a local Postgres for the tests (podman or docker)
+make test            # run all tests
 go build ./...       # compile all packages
-go run ./cmd/terdut  # run locally
+go run ./cmd/terdut  # run locally (needs TERDUT_DB_DSN)
 ```
 
+The tests need a real Postgres, because the server does — there is no in-memory Postgres the
+way there was an in-memory SQLite. `TERDUT_TEST_DSN` says where it is, `make test-db` starts
+one on port 5433 and prints the DSN, and `make test-db-stop` removes it. Each test gets its
+own schema on that server, so tests cannot see each other's rows. An unset `TERDUT_TEST_DSN`
+fails the suite rather than skipping it: a run that quietly tests nothing is worse than one
+that does not run.
+
 `make fmt lint test helm-lint` is the gate. It mirrors `.gitea/workflows/ci.yaml` step for
 step, so a green run here means a green pipeline — with one deliberate exception: `make test`
 adds `-race`, which CI does not. The sweeper, the notifier goroutine and the dead man's switch
-sweep all touch the same single database connection, and a race between them would surface as
+sweep all run concurrently against the same database, and a race between them would surface as
 a flaky incident in production rather than as a red build.
 
 The web UI lives in `internal/web/static/` as plain HTML, CSS and ES modules,
@@ -776,7 +957,9 @@ Two things the release process needs to know about this repo:
   do not bump the wrapper chart to that version — it cannot unpublish anything. The image is
   `FROM scratch`, so trivy sees exactly one target, the Go binary and its module graph.
 - **The wrapper chart's `values.yaml` has two `tag:` lines** — the app image and the python
-  backup sidecar — so `chart-bump` is given `--image` to say which one moves.
+  backup sidecar — so `chart-bump` is given `--image` to say which one moves. The sidecar is
+  on its way out with SQLite: once the wrapper chart drops it and declares a `postgresql` CR
+  instead, there is one `tag:` line again, and `--image` becomes belt and braces.
 
 The wrapper chart must have **its own `version:` bumped in the same commit**. Flux reconciles
 with `reconcileStrategy: ChartVersion`, so a chart whose version did not change produces no

charts/terdut-server/Chart.yaml

@@ -15,5 +15,5 @@ type: application
 # appVersion and image.tag in values.yaml no longer agree, and that is not an oversight:
 # image.tag stays "latest", which is what a local install actually pulls. appVersion is
 # metadata and drives nothing.
-version: 0.10.2
-appVersion: "v0.10.2"
+version: 0.12.0
+appVersion: "v0.12.0"

charts/terdut-server/templates/deployment.yaml

@@ -10,50 +10,15 @@ spec:
   selector:
     matchLabels:
       {{- include "terdut-server.selectorLabels" . | nindent 6 }}
-  # The data PVC is ReadWriteOnce, so a RollingUpdate deadlocks: the new pod
-  # cannot attach the volume until the old one releases it, and the old one is
-  # not torn down until the new one is ready.
+  # Recreate, not RollingUpdate, even though the PVC that forced it is gone: the
+  # sweeper and the notifier are unsynchronised singletons, and two replicas
+  # overlapping during a rollout would both page for the same incident.
   strategy:
     type: Recreate
   template:
     metadata:
       labels:
         {{- include "terdut-server.selectorLabels" . | nindent 8 }}
-      {{- if .Values.backupSidecar.enabled }}
-      annotations:
-        # Dumps the whole database: incidents, alerts, users, API key hashes,
-        # the schedule and the notification outbox.
-        #
-        # Runs in the `backup` sidecar, NOT in the app container: the server
-        # image is FROM scratch and has no interpreter at all. k8up execs into
-        # .spec.containers[0] unless told otherwise, hence the explicit
-        # k8up.io/backupcommand-container.
-        #
-        # Buffered and sanity-checked before the first byte reaches stdout: k8up
-        # streams stdout straight into restic, so a dump that dies partway is
-        # stored as a silently-truncated snapshot that k8up still reports as
-        # Succeeded. The check counts users rather than incidents -- incidents
-        # are swept and archived, so an empty incidents table is a legitimate
-        # state, whereas a database with no users never is.
-        #
-        # The connection is read-only but the mount is not: the database runs in
-        # WAL mode, and opening it mode=ro still needs write access to the -shm
-        # wal-index.
-        #
-        # chr(10), not '\n': k8up parses this annotation with go-shellquote.
-        k8up.io/backupcommand-container: backup
-        k8up.io/backupcommand: >-
-          python3 -c "import sqlite3, sys;
-          con = sqlite3.connect('file:/data/terdut.db?mode=ro', uri=True);
-          con.execute('BEGIN');
-          users = con.execute('SELECT count(*) FROM users').fetchone()[0];
-          out = chr(10).join(con.iterdump()) + chr(10);
-          (users > 0 and out.rstrip().endswith('COMMIT;'))
-          or sys.exit('terdut: db dump failed sanity checks');
-          sys.stdout.write(out)"
-        k8up.io/file-extension: ".sql"
-        k8up.io/backup: "true"
-      {{- end }}
     spec:
       enableServiceLinks: false
       containers:
@@ -67,8 +32,18 @@ spec:
           env:
             - name: TERDUT_ADDR
               value: ":{{ .Values.service.port }}"
-            - name: TERDUT_DB_PATH
-              value: "/data/terdut.db"
+            - name: TERDUT_DB_DSN
+              value: {{ required "database.dsn is required" .Values.database.dsn | quote }}
+            {{- if .Values.database.passwordSecret.name }}
+            # The password reaches pgx through libpq's environment variable
+            # rather than through the DSN, so it stays out of the rendered
+            # manifest. pgx fills in from PG* whatever the DSN leaves out.
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.database.passwordSecret.name }}
+                  key: {{ .Values.database.passwordSecret.key }}
+            {{- end }}
             - name: TERDUT_STALE_AFTER
               value: "{{ .Values.sweeper.staleAfter }}"
             - name: TERDUT_ARCHIVE_AFTER
@@ -96,9 +71,6 @@ spec:
                   key: {{ .Values.notify.tokenSecret.key }}
             {{- end }}
             {{- end }}
-          volumeMounts:
-            - name: data
-              mountPath: /data
           livenessProbe:
             httpGet:
               path: /healthz
@@ -110,25 +82,4 @@ spec:
               port: http
             initialDelaySeconds: 5
 
-        {{- if .Values.backupSidecar.enabled }}
-        # Idle sidecar. It exists only so k8up has a container with a sqlite3
-        # module to exec the backupcommand in. Mounted read-write on purpose:
-        # see the note on the backupcommand annotation above.
-        - name: backup
-          image: "{{ .Values.backupSidecar.image.repository }}:{{ .Values.backupSidecar.image.tag }}"
-          imagePullPolicy: {{ .Values.backupSidecar.image.pullPolicy }}
-          command: ["sleep", "infinity"]
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              memory: "16Mi"
-              cpu: "10m"
-            limits:
-              memory: "64Mi"
-        {{- end }}
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: {{ .Release.Name }}-data
+

charts/terdut-server/templates/pvc.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ .Release.Name }}-data
-  namespace: {{ .Release.Namespace }}
-spec:
-  storageClassName: {{ .Values.storage.storageClass | quote }}
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: {{ .Values.storage.size }}

charts/terdut-server/values.yaml

@@ -11,9 +11,28 @@ image:
   tag: "latest"
   pullPolicy: IfNotPresent
 
-storage:
-  size: 1Gi
-  storageClass: synology-iscsi
+# Postgres connection. The chart provisions no database; it expects one to exist.
+database:
+  # Required. A DSN with no password in it:
+  #   postgres://terdut@terdut-postgres:5432/terdut?sslmode=require
+  #
+  # The password is deliberately a separate setting. pgx falls back to libpq's
+  # environment variables for anything the DSN omits, so PGPASSWORD supplies it
+  # without the credential appearing in values, in the rendered manifest, or in
+  # `kubectl describe pod`.
+  dsn: ""
+  # Where PGPASSWORD comes from. With the Zalando postgres operator this is the
+  # Secret it generates for the role — `<user>.<cluster>.credentials.postgresql.acid.zalan.do`,
+  # whose keys are `username` and `password` — so a from-scratch rebuild mints a
+  # new password and the server picks it up with nothing to keep in sync.
+  #
+  # Read at process start only: rotating the password needs a pod restart.
+  #
+  # Leave name empty only if the DSN carries its own password, which puts it in
+  # the manifest.
+  passwordSecret:
+    name: ""
+    key: password
 
 service:
   type: ClusterIP
@@ -88,17 +107,10 @@ notify:
     name: ""
     key: token
 
-# The server image is FROM scratch — just the binary, with no shell, no sqlite3
-# and no python — so a k8up backupcommand cannot run in the app container. This
-# idle sidecar shares the data volume and is selected with
-# k8up.io/backupcommand-container. Only the stdlib sqlite3 module is used, so any
-# python image works.
-backupSidecar:
-  enabled: true
-  image:
-    repository: python
-    tag: "3.13-alpine"
-    pullPolicy: IfNotPresent
+# Backups are no longer this chart's business. The SQLite database lived on a PVC
+# beside the app, so it needed a sidecar with a sqlite3 module for k8up to exec a
+# dump in; Postgres is backed up where it runs, through a k8up.io/backupcommand
+# pg_dump annotation on the database pod itself.
 
 bootstrap:
   enabled: true

cmd/terdut/main.go

@@ -18,7 +18,7 @@ var version = "dev"
 func main() {
 	cfg := config.Load()
 
-	database, err := db.Open(cfg.DBPath)
+	database, err := db.Open(cfg.DSN)
 	if err != nil {
 		log.Fatalf("open db: %v", err)
 	}
@@ -36,9 +36,16 @@ func main() {
 		RepeatEvery:   cfg.NotifyRepeat,
 	}
 
+	// Dead man's switches live per team now. The environment variables are the
+	// defaults a team starts from: every team without a configuration of its
+	// own gets one from them here, and an owner's later edit is never
+	// overwritten by a redeploy.
 	deadman := api.ParseDeadmanConfig(cfg.DeadmanMatchers, cfg.DeadmanTimeout, cfg.DeadmanSeverity)
+	if err := api.SeedDeadmanConfigs(context.Background(), database, deadman); err != nil {
+		log.Fatalf("seed dead man's switch defaults: %v", err)
+	}
 
-	router := api.NewRouter(database, notify, deadman)
+	router := api.NewRouter(database, notify)
 
 	srv := &http.Server{
 		Addr:         cfg.Addr,
@@ -51,7 +58,7 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	go api.StartArchiver(ctx, database, cfg.ArchiveAfter, cfg.StaleAfter, deadman, notify)
+	go api.StartArchiver(ctx, database, cfg.ArchiveAfter, cfg.StaleAfter, notify)
 	go api.StartNotifier(ctx, database, notify)
 
 	go func() {

go.mod

@@ -4,6 +4,8 @@ go 1.25.9
 
 require (
 	github.com/go-chi/chi/v5 v5.2.5
+	github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6
+	github.com/jackc/pgx/v5 v5.11.0
 	golang.org/x/crypto v0.55.0
 	modernc.org/sqlite v1.50.1
 )
@@ -11,10 +13,15 @@ require (
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -1,3 +1,6 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
@@ -8,23 +11,46 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 h1:D/V0gu4zQ3cL2WKeVNVM4r2gLxGGf6McLwgXzRTo2RQ=
+github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.11.0 h1:IzBBtyK9AHqf98cctWFifYSci2hgQR/cd56wB4p+ogg=
+github.com/jackc/pgx/v5 v5.11.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
 golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
 modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
 modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=

internal/api/admin_test.go

@@ -0,0 +1,264 @@
+package api_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"testing"
+)
+
+// The bootstrap user is an administrator; everybody it creates afterwards is
+// not. These tests are about the line between them.
+
+// id64 spells an id into a path segment.
+func id64(n int64) string { return strconv.FormatInt(n, 10) }
+
+// member creates an ordinary user and an API key for it, and returns a caller
+// that authenticates as them. Minting the key goes through the admin's own
+// credentials, which is how a real install hands one out.
+func member(t *testing.T, s *ts, username string) (id int64, call func(method, path string, body any) *http.Response) {
+	t.Helper()
+
+	resp := s.req(t, http.MethodPost, "/api/users",
+		map[string]string{"username": username, "email": username + "@test.com"})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create %s: %d", username, resp.StatusCode)
+	}
+	var user struct {
+		ID      int64 `json:"id"`
+		IsAdmin bool  `json:"is_admin"`
+	}
+	decode(t, resp, &user)
+	if user.IsAdmin {
+		t.Fatalf("a created user must not be an administrator")
+	}
+
+	// Into the default team as a plain member: being in a team is what lets
+	// somebody work its incidents, and is separate from administering accounts.
+	resp = s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/members",
+		map[string]any{"user_id": user.ID, "role": "member"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("add %s to the team: %d", username, resp.StatusCode)
+	}
+
+	resp = s.req(t, http.MethodPost, "/api/users/"+id64(user.ID)+"/api-keys",
+		map[string]string{"name": "test"})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("mint key for %s: %d", username, resp.StatusCode)
+	}
+	var key struct {
+		Key string `json:"key"`
+	}
+	decode(t, resp, &key)
+
+	return user.ID, func(method, path string, body any) *http.Response {
+		t.Helper()
+		var r io.Reader
+		if body != nil {
+			data, _ := json.Marshal(body)
+			r = bytes.NewReader(data)
+		}
+		req, _ := http.NewRequest(method, s.URL+path, r)
+		req.Header.Set("Authorization", "Bearer "+key.Key)
+		if body != nil {
+			req.Header.Set("Content-Type", "application/json")
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatalf("%s %s: %v", method, path, err)
+		}
+		return resp
+	}
+}
+
+// The whole point of the release: a user who is not an administrator cannot
+// manage other people's accounts. Every one of these was open to any
+// authenticated caller before.
+func TestAdmin_MemberIsRefusedAdministration(t *testing.T) {
+	s := newTS(t)
+	memberID, call := member(t, s, "member")
+
+	cases := []struct {
+		name   string
+		method string
+		path   string
+		body   any
+	}{
+		{"create a user", http.MethodPost, "/api/users",
+			map[string]string{"username": "sneaky", "email": "sneaky@test.com"}},
+		{"delete the admin", http.MethodDelete, "/api/users/1", nil},
+		{"grant themselves admin", http.MethodPut, "/api/users/" + id64(memberID) + "/admin",
+			map[string]bool{"is_admin": true}},
+		{"set the admin's password", http.MethodPut, "/api/users/1/password",
+			map[string]string{"password": "hunter2-hunter2"}},
+		{"mint a key for the admin", http.MethodPost, "/api/users/1/api-keys",
+			map[string]string{"name": "borrowed"}},
+		{"retarget the admin's notifications", http.MethodPut, "/api/users/1/notify",
+			map[string]string{"ntfy_topic": "attacker-topic"}},
+	}
+
+	for _, c := range cases {
+		resp := call(c.method, c.path, c.body)
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusForbidden {
+			t.Errorf("%s: expected 403, got %d", c.name, resp.StatusCode)
+		}
+	}
+}
+
+// Being refused other people's accounts must not cost a user their own.
+func TestAdmin_MemberKeepsTheirOwnAccount(t *testing.T) {
+	s := newTS(t)
+	memberID, call := member(t, s, "member")
+	self := "/api/users/" + id64(memberID)
+
+	resp := call(http.MethodPut, self+"/notify", map[string]string{"ntfy_topic": "terdut-member"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("own notify target: %d", resp.StatusCode)
+	}
+
+	resp = call(http.MethodPut, self+"/password", map[string]string{"password": "correct-horse-battery"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		t.Errorf("own password: %d", resp.StatusCode)
+	}
+
+	// An API key carries exactly the rights of its owner, so minting your own
+	// is no more than signing in again.
+	resp = call(http.MethodPost, self+"/api-keys", map[string]string{"name": "laptop"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Errorf("own API key: %d", resp.StatusCode)
+	}
+
+	// And the queue still has to be able to name people.
+	resp = call(http.MethodGet, "/api/users", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("list users: %d", resp.StatusCode)
+	}
+}
+
+// Incident work is everybody's job; none of it is administration.
+func TestAdmin_MemberCanWorkIncidents(t *testing.T) {
+	s := newTS(t)
+	_, call := member(t, s, "responder")
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-admin", "DiskFull", "firing", "2026-09-20T10:00:00Z", zeroTime, nil),
+	})
+
+	for _, c := range []struct {
+		name   string
+		method string
+		path   string
+	}{
+		{"list", http.MethodGet, "/api/incidents"},
+		{"acknowledge", http.MethodPost, "/api/incidents/1/acknowledge"},
+		{"resolve", http.MethodPost, "/api/incidents/1/resolve"},
+	} {
+		resp := call(c.method, c.path, nil)
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			t.Errorf("%s: expected 200, got %d", c.name, resp.StatusCode)
+		}
+	}
+}
+
+// An install must never be left with nobody who can administer it.
+func TestAdmin_LastAdministratorIsProtected(t *testing.T) {
+	s := newTS(t)
+
+	resp := s.req(t, http.MethodPut, "/api/users/1/admin", map[string]bool{"is_admin": false})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusConflict {
+		t.Errorf("self-demotion: expected 409, got %d", resp.StatusCode)
+	}
+
+	resp = s.req(t, http.MethodDelete, "/api/users/1", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusConflict {
+		t.Errorf("deleting yourself: expected 409, got %d", resp.StatusCode)
+	}
+
+	// With a second administrator the first may stand down, but not while they
+	// are the only one — which is the same rule from the other side.
+	otherID, _ := member(t, s, "second")
+	resp = s.req(t, http.MethodPut, "/api/users/"+id64(otherID)+"/admin", map[string]bool{"is_admin": true})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("granting admin: %d", resp.StatusCode)
+	}
+
+	resp = s.req(t, http.MethodDelete, "/api/users/"+id64(otherID), nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Errorf("deleting the second admin: expected 204, got %d", resp.StatusCode)
+	}
+}
+
+// A promoted user gets the powers with the flag, and loses them with it.
+func TestAdmin_GrantAndRevokeChangeWhatIsAllowed(t *testing.T) {
+	s := newTS(t)
+	memberID, call := member(t, s, "promotee")
+	admin := "/api/users/" + id64(memberID) + "/admin"
+
+	resp := call(http.MethodPost, "/api/users", map[string]string{"username": "a", "email": "a@test.com"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("before the grant: %d", resp.StatusCode)
+	}
+
+	resp = s.req(t, http.MethodPut, admin, map[string]bool{"is_admin": true})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("grant: %d", resp.StatusCode)
+	}
+
+	resp = call(http.MethodPost, "/api/users", map[string]string{"username": "b", "email": "b@test.com"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Errorf("after the grant: expected 201, got %d", resp.StatusCode)
+	}
+
+	resp = s.req(t, http.MethodPut, admin, map[string]bool{"is_admin": false})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("revoke: %d", resp.StatusCode)
+	}
+
+	resp = call(http.MethodPost, "/api/users", map[string]string{"username": "c", "email": "c@test.com"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Errorf("after the revoke: expected 403, got %d", resp.StatusCode)
+	}
+}
+
+// The flag has to reach the client, or the web UI cannot decide what to show.
+func TestAdmin_MeReportsTheFlag(t *testing.T) {
+	s := newTS(t)
+
+	var me struct {
+		User struct {
+			IsAdmin bool `json:"is_admin"`
+		} `json:"user"`
+	}
+	decode(t, s.req(t, http.MethodGet, "/api/me", nil), &me)
+	if !me.User.IsAdmin {
+		t.Error("the bootstrap user should be an administrator")
+	}
+
+	_, call := member(t, s, "plain")
+	var theirs struct {
+		User struct {
+			IsAdmin bool `json:"is_admin"`
+		} `json:"user"`
+	}
+	decode(t, call(http.MethodGet, "/api/me", nil), &theirs)
+	if theirs.User.IsAdmin {
+		t.Error("a created user should not be an administrator")
+	}
+}

internal/api/alertmanager.go

@@ -4,9 +4,12 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"log"
 	"net/http"
 	"time"
+
+	"github.com/go-chi/chi/v5"
 )
 
 // Values for alerts.resolution_source, recording why an alert left the firing
@@ -70,8 +73,49 @@ type ingested struct {
 	deadman bool
 }
 
-func handleAlertmanagerWebhook(db *sql.DB, notify NotifyConfig, deadman DeadmanConfig) http.HandlerFunc {
+// handleIntegrationWebhook receives alerts on a team's own integration key.
+// The key in the path is both the credential and the routing: it says who may
+// post, and which team the alerts belong to.
+func handleIntegrationWebhook(db *sql.DB, notify NotifyConfig) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, err := teamIDForKey(r.Context(), db, chi.URLParam(r, "key"))
+		if err != nil {
+			if errors.Is(err, errUnknownIntegration) {
+				// 401 and not 404: the path is real, the key is not, and a
+				// sender misconfigured this way should say so in its own logs
+				// rather than believe it is delivering.
+				respond(w, http.StatusUnauthorized, errResp("unknown integration key"))
+				return
+			}
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		receiveWebhook(w, r, db, notify, teamID)
+	}
+}
+
+// handleLegacyWebhook is the pre-teams unauthenticated endpoint, kept for one
+// release so an upgrade does not silently stop delivering while somebody edits
+// the Alertmanager config. It routes to the oldest team, which on an upgraded
+// install is the Default team everything was moved into.
+//
+// It is deprecated and unauthenticated — anything that can reach the port can
+// open an incident. Move senders to an integration key and this goes away.
+func handleLegacyWebhook(db *sql.DB, notify NotifyConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, err := defaultTeamID(r.Context(), db)
+		if err != nil {
+			log.Printf("legacy webhook: no team to route to: %v", err)
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		log.Printf("legacy webhook: unauthenticated payload routed to team %d; "+
+			"move this sender to an integration key", teamID)
+		receiveWebhook(w, r, db, notify, teamID)
+	}
+}
+
+func receiveWebhook(w http.ResponseWriter, r *http.Request, db *sql.DB, notify NotifyConfig, teamID int64) {
 	var payload amPayload
 	if err := decodeJSON(r, &payload); err != nil {
 		respond(w, http.StatusBadRequest, errResp("invalid payload"))
@@ -81,25 +125,32 @@ func handleAlertmanagerWebhook(db *sql.DB, notify NotifyConfig, deadman DeadmanC
 	// Alertmanager retries anything that is not 2xx, and a retry of a payload
 	// we failed to store is more useful than an error it cannot act on — so
 	// failures are logged, not surfaced.
-		if err := ingest(r.Context(), db, notify, deadman, payload); err != nil {
-			log.Printf("webhook ingest (group %q): %v", payload.GroupKey, err)
+	if err := ingest(r.Context(), db, notify, teamID, payload); err != nil {
+		log.Printf("webhook ingest (team %d, group %q): %v", teamID, payload.GroupKey, err)
 	}
 
 	w.WriteHeader(http.StatusOK)
 }
-}
 
 // ingest stores a payload's alerts and reconciles the incident for its group.
 // The whole payload is one transaction: an incident that opened but whose alerts
 // failed to link would be a work item nobody could act on.
-func ingest(ctx context.Context, db *sql.DB, notify NotifyConfig, deadman DeadmanConfig, payload amPayload) error {
+func ingest(ctx context.Context, db *sql.DB, notify NotifyConfig, teamID int64, payload amPayload) error {
 	tx, err := db.BeginTx(ctx, nil)
 	if err != nil {
 		return err
 	}
 	defer tx.Rollback() //nolint:errcheck
 
-	accepted, err := upsertAlerts(ctx, tx, deadman, payload.Alerts)
+	// Which arriving alerts are heartbeats is the team's own answer, read
+	// inside the transaction so an owner editing it mid-payload cannot split
+	// one webhook across two interpretations.
+	deadman, err := deadmanConfigForTeam(ctx, tx, teamID)
+	if err != nil {
+		return err
+	}
+
+	accepted, err := upsertAlerts(ctx, tx, deadman, teamID, payload.Alerts)
 	if err != nil {
 		return err
 	}
@@ -108,7 +159,7 @@ func ingest(ctx context.Context, db *sql.DB, notify NotifyConfig, deadman Deadma
 	// resolution cascade are recomputed once per incident at the end.
 	touched := map[int64]bool{}
 
-	incidentID, err := incidentForGroup(ctx, tx, notify, payload, accepted)
+	incidentID, err := incidentForGroup(ctx, tx, notify, teamID, payload, accepted)
 	if err != nil {
 		return err
 	}
@@ -156,7 +207,7 @@ func ingest(ctx context.Context, db *sql.DB, notify NotifyConfig, deadman Deadma
 
 // upsertAlerts stores each alert of a payload and reports what changed. Payloads
 // the ordering guard rejected are left out entirely.
-func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, alerts []amAlert) ([]ingested, error) {
+func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, teamID int64, alerts []amAlert) ([]ingested, error) {
 	now := time.Now().Unix()
 	accepted := make([]ingested, 0, len(alerts))
 
@@ -171,7 +222,8 @@ func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, alerts
 		var prevStartsAt int64
 		existed := true
 		switch err := tx.QueryRowContext(ctx,
-			"SELECT status, starts_at FROM alerts WHERE fingerprint = ?", a.Fingerprint,
+			"SELECT status, starts_at FROM alerts WHERE team_id = $1 AND fingerprint = $2",
+			teamID, a.Fingerprint,
 		).Scan(&prevStatus, &prevStartsAt); {
 		case err == sql.ErrNoRows:
 			existed = false
@@ -210,10 +262,10 @@ func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, alerts
 		// undone by a stale retry.
 		if _, err := tx.ExecContext(ctx, `
 			INSERT INTO alerts
-				(fingerprint, name, status, labels, annotations, starts_at, ends_at,
+				(team_id, fingerprint, name, status, labels, annotations, starts_at, ends_at,
 				 generator_url, received_at, resolution_source)
-			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-			ON CONFLICT(fingerprint) DO UPDATE SET
+			VALUES ($1, $2, $3, $4, $5::jsonb, $6::jsonb, $7, $8, $9, $10, $11)
+			ON CONFLICT (team_id, fingerprint) DO UPDATE SET
 				status            = excluded.status,
 				labels            = excluded.labels,
 				annotations       = excluded.annotations,
@@ -233,7 +285,7 @@ func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, alerts
 			   OR (excluded.starts_at = alerts.starts_at
 			       AND (alerts.resolution_source = '`+resolutionDeadman+`'
 			            OR NOT (alerts.status = 'resolved' AND excluded.status = 'firing')))`,
-			a.Fingerprint, name, a.Status,
+			teamID, a.Fingerprint, name, a.Status,
 			string(labelsJSON), string(annotationsJSON),
 			a.StartsAt.Unix(), endsAtUnix,
 			a.GeneratorURL, now, resolutionSource,
@@ -245,7 +297,8 @@ func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, alerts
 		var curStatus string
 		var curStartsAt int64
 		if err := tx.QueryRowContext(ctx,
-			"SELECT id, status, starts_at FROM alerts WHERE fingerprint = ?", a.Fingerprint,
+			"SELECT id, status, starts_at FROM alerts WHERE team_id = $1 AND fingerprint = $2",
+			teamID, a.Fingerprint,
 		).Scan(&id, &curStatus, &curStartsAt); err != nil {
 			return nil, err
 		}
@@ -284,7 +337,7 @@ func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, alerts
 // Heartbeats do not count as anything here. A group of nothing but dead man's
 // switch alerts opens no incident at all, and a mixed group gets an incident for
 // its real alerts only.
-func incidentForGroup(ctx context.Context, tx *sql.Tx, notify NotifyConfig, payload amPayload, accepted []ingested) (int64, error) {
+func incidentForGroup(ctx context.Context, tx *sql.Tx, notify NotifyConfig, teamID int64, payload amPayload, accepted []ingested) (int64, error) {
 	var firstName string
 	anyFiring, anyNew := false, false
 	for _, a := range accepted {
@@ -315,7 +368,8 @@ func incidentForGroup(ctx context.Context, tx *sql.Tx, notify NotifyConfig, payl
 
 	var id int64
 	switch err := tx.QueryRowContext(ctx,
-		"SELECT id FROM incidents WHERE group_key = ? AND resolved_at IS NULL", groupKey,
+		"SELECT id FROM incidents WHERE team_id = $1 AND group_key = $2 AND resolved_at IS NULL",
+		teamID, groupKey,
 	).Scan(&id); {
 	case err == nil:
 		return id, nil
@@ -326,7 +380,7 @@ func incidentForGroup(ctx context.Context, tx *sql.Tx, notify NotifyConfig, payl
 	if !anyNew {
 		return 0, nil
 	}
-	return openIncident(ctx, tx, notify, groupKey,
+	return openIncident(ctx, tx, notify, teamID, groupKey,
 		incidentTitle(payload.GroupLabels, firstName), payload.GroupLabels, nil)
 }
 
@@ -338,8 +392,8 @@ func incidentForGroup(ctx context.Context, tx *sql.Tx, notify NotifyConfig, payl
 // its own. Hence the querier rather than a *sql.Tx. A nil severity leaves the
 // column for refreshSeverity to fill from the member alerts; the sweeper passes
 // one because its incidents have no members to derive it from.
-func openIncident(ctx context.Context, q querier, notify NotifyConfig, groupKey, title string, groupLabels map[string]string, severity *string) (int64, error) {
-	onCall, err := currentOnCall(ctx, q)
+func openIncident(ctx context.Context, q querier, notify NotifyConfig, teamID int64, groupKey, title string, groupLabels map[string]string, severity *string) (int64, error) {
+	onCall, err := currentOnCall(ctx, q, teamID)
 	if err != nil {
 		return 0, err
 	}
@@ -349,15 +403,13 @@ func openIncident(ctx context.Context, q querier, notify NotifyConfig, groupKey,
 		labelsJSON = []byte("{}")
 	}
 
-	res, err := q.ExecContext(ctx, `
-		INSERT INTO incidents (group_key, title, group_labels, status, severity, triggered_at, assigned_to)
-		VALUES (?, ?, ?, 'triggered', ?, ?, ?)`,
-		groupKey, title, string(labelsJSON), severity,
-		time.Now().Unix(), onCall)
-	if err != nil {
-		return 0, err
-	}
-	id, err := res.LastInsertId()
+	var id int64
+	err = q.QueryRowContext(ctx, `
+		INSERT INTO incidents (team_id, group_key, title, group_labels, status, severity, triggered_at, assigned_to)
+		VALUES ($1, $2, $3, $4::jsonb, 'triggered', $5, $6, $7)
+		RETURNING id`,
+		teamID, groupKey, title, string(labelsJSON), severity,
+		time.Now().Unix(), onCall).Scan(&id)
 	if err != nil {
 		return 0, err
 	}
@@ -385,8 +437,9 @@ func openIncident(ctx context.Context, q querier, notify NotifyConfig, groupKey,
 // first time. Re-sends of an already-linked alert are silent.
 func linkAlert(ctx context.Context, tx *sql.Tx, incidentID, alertID int64) error {
 	res, err := tx.ExecContext(ctx, `
-		INSERT OR IGNORE INTO incident_alerts (incident_id, alert_id, added_at)
-		VALUES (?, ?, ?)`, incidentID, alertID, time.Now().Unix())
+		INSERT INTO incident_alerts (incident_id, alert_id, added_at)
+		VALUES ($1, $2, $3)
+		ON CONFLICT (incident_id, alert_id) DO NOTHING`, incidentID, alertID, time.Now().Unix())
 	if err != nil {
 		return err
 	}

internal/api/alerts.go

@@ -19,7 +19,7 @@ import (
 // incident_alerts rather than as a column here, because one alert row is reused
 // across occurrences and belongs to a different incident each time.
 const alertSelectFrom = `
-	SELECT a.id, a.fingerprint, a.name, a.status,
+	SELECT a.id, a.team_id, t.name, a.fingerprint, a.name, a.status,
 	       a.labels, a.annotations,
 	       a.starts_at, a.ends_at, a.generator_url, a.received_at,
 	       (SELECT ia.incident_id
@@ -29,22 +29,28 @@ const alertSelectFrom = `
 	         ORDER BY i.triggered_at DESC, i.id DESC
 	         LIMIT 1),
 	       a.resolution_source, a.archived_at
-	FROM   alerts a`
+	FROM   alerts a
+	JOIN   teams t ON t.id = a.team_id`
 
 func handleListAlerts(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		q := r.URL.Query()
 
 		where := []string{}
-		args := []any{}
+		args := &sqlArgs{}
+
+		where = append(where, "a.team_id = ANY("+args.add(callerTeamIDs(r.Context()))+")")
+		if team := q.Get("team_id"); team != "" {
+			if n, err := strconv.ParseInt(team, 10, 64); err == nil {
+				where = append(where, "a.team_id = "+args.add(n))
+			}
+		}
 
 		if status := q.Get("status"); status != "" {
-			where = append(where, "a.status = ?")
-			args = append(args, status)
+			where = append(where, "a.status = "+args.add(status))
 		}
 		if name := q.Get("name"); name != "" {
-			where = append(where, "a.name = ?")
-			args = append(args, name)
+			where = append(where, "a.name = "+args.add(name))
 		}
 		if archived := q.Get("archived"); archived == "true" {
 			where = append(where, "a.archived_at IS NOT NULL")
@@ -53,21 +59,18 @@ func handleListAlerts(db *sql.DB) http.HandlerFunc {
 		}
 		if incidentID := q.Get("incident_id"); incidentID != "" {
 			if n, err := strconv.ParseInt(incidentID, 10, 64); err == nil {
-				where = append(where, "a.id IN (SELECT alert_id FROM incident_alerts WHERE incident_id = ?)")
-				args = append(args, n)
+				where = append(where, "a.id IN (SELECT alert_id FROM incident_alerts WHERE incident_id = "+args.add(n)+")")
 			}
 		}
 
 		if from := q.Get("from"); from != "" {
 			if t, err := time.Parse("2006-01-02", from); err == nil {
-				where = append(where, "a.received_at >= ?")
-				args = append(args, t.UTC().Unix())
+				where = append(where, "a.received_at >= "+args.add(t.UTC().Unix()))
 			}
 		}
 		if to := q.Get("to"); to != "" {
 			if t, err := time.Parse("2006-01-02", to); err == nil {
-				where = append(where, "a.received_at < ?")
-				args = append(args, t.UTC().AddDate(0, 0, 1).Unix())
+				where = append(where, "a.received_at < "+args.add(t.UTC().AddDate(0, 0, 1).Unix()))
 			}
 		}
 
@@ -82,11 +85,10 @@ func handleListAlerts(db *sql.DB) http.HandlerFunc {
 		if len(where) > 0 {
 			clause = strings.Join(where, " AND ")
 		}
-		args = append(args, limit)
 
 		rows, err := db.QueryContext(r.Context(),
-			fmt.Sprintf("%s WHERE %s ORDER BY a.received_at DESC LIMIT ?", alertSelectFrom, clause),
-			args...)
+			fmt.Sprintf("%s WHERE %s ORDER BY a.received_at DESC LIMIT %s", alertSelectFrom, clause, args.add(limit)),
+			args.all()...)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -113,7 +115,7 @@ func handleGetAlert(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
 			return
 		}
-		a, err := fetchAlert(r.Context(), db, id)
+		a, err := fetchAlert(r.Context(), db, id, callerTeamIDs(r.Context()))
 		if err == sql.ErrNoRows {
 			respond(w, http.StatusNotFound, errResp("alert not found"))
 			return
@@ -127,8 +129,9 @@ func handleGetAlert(db *sql.DB) http.HandlerFunc {
 }
 
 // fetchAlert loads a single alert by ID using the shared query.
-func fetchAlert(ctx context.Context, db *sql.DB, id int64) (models.Alert, error) {
-	return scanAlert(db.QueryRowContext(ctx, alertSelectFrom+" WHERE a.id = ?", id))
+func fetchAlert(ctx context.Context, db *sql.DB, id int64, teamIDs []int64) (models.Alert, error) {
+	return scanAlert(db.QueryRowContext(ctx,
+		alertSelectFrom+" WHERE a.id = $1 AND a.team_id = ANY($2)", id, teamIDs))
 }
 
 // scanner is satisfied by both *sql.Row and *sql.Rows.
@@ -143,7 +146,7 @@ func scanAlert(s scanner) (models.Alert, error) {
 	var endsAtUnix, archivedAtUnix *int64
 
 	if err := s.Scan(
-		&a.ID, &a.Fingerprint, &a.Name, &a.Status,
+		&a.ID, &a.TeamID, &a.TeamName, &a.Fingerprint, &a.Name, &a.Status,
 		&labelsJSON, &annotationsJSON,
 		&startsAtUnix, &endsAtUnix,
 		&a.GeneratorURL, &receivedAtUnix,

internal/api/api_test.go

@@ -9,11 +9,12 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"sort"
+	"strings"
 	"testing"
 	"time"
 
 	"git.ryuvia.com/niklas/terdut-server/internal/api"
-	"git.ryuvia.com/niklas/terdut-server/internal/db"
 )
 
 // ts wraps httptest.Server with a pre-bootstrapped API key. db is exposed so
@@ -26,7 +27,7 @@ type ts struct {
 	deadman api.DeadmanConfig
 }
 
-// newTS builds a server over a fresh in-memory database. Notifications are off
+// newTS builds a server over a fresh database. Notifications are off
 // unless a NotifyConfig is passed, so tests that predate them are unaffected.
 // Dead man's switches are off too — see newDeadmanTS.
 func newTS(t *testing.T, notify ...api.NotifyConfig) *ts {
@@ -38,7 +39,7 @@ func newTS(t *testing.T, notify ...api.NotifyConfig) *ts {
 	return newDeadmanTS(t, api.DeadmanConfig{}, cfg)
 }
 
-// newDeadmanTS is newTS with dead man's switch handling configured.
+// newDeadmanTS is newTS with the default team's dead man's switches configured.
 func newDeadmanTS(t *testing.T, deadman api.DeadmanConfig, notify ...api.NotifyConfig) *ts {
 	t.Helper()
 	var cfg api.NotifyConfig
@@ -46,15 +47,9 @@ func newDeadmanTS(t *testing.T, deadman api.DeadmanConfig, notify ...api.NotifyC
 		cfg = notify[0]
 	}
 
-	database, err := db.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	if err := db.Migrate(database); err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-	srv := httptest.NewServer(api.NewRouter(database, cfg, deadman))
-	t.Cleanup(func() { srv.Close(); database.Close() })
+	database := newTestDB(t)
+	srv := httptest.NewServer(api.NewRouter(database, cfg))
+	t.Cleanup(srv.Close)
 
 	body, _ := json.Marshal(map[string]string{"username": "admin", "email": "admin@test.com"})
 	resp, err := http.Post(srv.URL+"/api/bootstrap", "application/json", bytes.NewReader(body))
@@ -69,7 +64,38 @@ func newDeadmanTS(t *testing.T, deadman api.DeadmanConfig, notify ...api.NotifyC
 	json.NewDecoder(resp.Body).Decode(&result)
 	key := result["api_key"].(map[string]any)["key"].(string)
 
-	return &ts{Server: srv, key: key, db: database, notify: cfg, deadman: deadman}
+	s := &ts{Server: srv, key: key, db: database, notify: cfg, deadman: deadman}
+
+	// Dead man's switches belong to a team now, so a test that wants them
+	// configures the default team the way an owner would.
+	if deadman.Timeout > 0 {
+		setTeamDeadman(t, s, deadman)
+	}
+	return s
+}
+
+// setTeamDeadman configures the default team's switches over the API, rendering
+// the matchers back into the string form the endpoint takes.
+func setTeamDeadman(t *testing.T, s *ts, cfg api.DeadmanConfig) {
+	t.Helper()
+	matchers := make([]string, 0, len(cfg.Matchers))
+	for _, m := range cfg.Matchers {
+		parts := []string{"alertname=" + m.Name}
+		for k, v := range m.Labels {
+			parts = append(parts, k+"="+v)
+		}
+		sort.Strings(parts[1:])
+		matchers = append(matchers, strings.Join(parts, ","))
+	}
+	resp := s.req(t, http.MethodPut, "/api/teams/"+defaultTeam+"/deadman", map[string]any{
+		"matchers":        strings.Join(matchers, "; "),
+		"timeout_seconds": int64(cfg.Timeout.Seconds()),
+		"severity":        cfg.Severity,
+	})
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("configure the team's dead man's switches: %d", resp.StatusCode)
+	}
 }
 
 // exec runs a statement against the test database.
@@ -84,7 +110,7 @@ func (s *ts) exec(t *testing.T, query string, args ...any) {
 func (s *ts) alertRow(t *testing.T, fingerprint string) (status string, source *string, archivedAt *int64) {
 	t.Helper()
 	err := s.db.QueryRow(
-		"SELECT status, resolution_source, archived_at FROM alerts WHERE fingerprint = ?",
+		"SELECT status, resolution_source, archived_at FROM alerts WHERE fingerprint = $1",
 		fingerprint).Scan(&status, &source, &archivedAt)
 	if err != nil {
 		t.Fatalf("read alert %s: %v", fingerprint, err)
@@ -96,7 +122,7 @@ func (s *ts) alertRow(t *testing.T, fingerprint string) (status string, source *
 func (s *ts) alertTimes(t *testing.T, fingerprint string) (startsAt, receivedAt int64) {
 	t.Helper()
 	err := s.db.QueryRow(
-		"SELECT starts_at, received_at FROM alerts WHERE fingerprint = ?",
+		"SELECT starts_at, received_at FROM alerts WHERE fingerprint = $1",
 		fingerprint).Scan(&startsAt, &receivedAt)
 	if err != nil {
 		t.Fatalf("read alert times %s: %v", fingerprint, err)
@@ -109,7 +135,7 @@ func (s *ts) alertEndsAt(t *testing.T, fingerprint string) *int64 {
 	t.Helper()
 	var endsAt *int64
 	if err := s.db.QueryRow(
-		"SELECT ends_at FROM alerts WHERE fingerprint = ?", fingerprint).Scan(&endsAt); err != nil {
+		"SELECT ends_at FROM alerts WHERE fingerprint = $1", fingerprint).Scan(&endsAt); err != nil {
 		t.Fatalf("read ends_at %s: %v", fingerprint, err)
 	}
 	return endsAt
@@ -283,14 +309,14 @@ func TestAlertUpsert_DifferentFingerprintsStored(t *testing.T) {
 func TestSchedule_ConflictOnSameDate(t *testing.T) {
 	s := newTS(t)
 
-	first := s.req(t, http.MethodPost, "/api/schedule",
+	first := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-01"}})
 	if first.StatusCode != http.StatusCreated {
 		t.Fatalf("first assignment returned %d", first.StatusCode)
 	}
 	first.Body.Close()
 
-	second := s.req(t, http.MethodPost, "/api/schedule",
+	second := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-01"}})
 	if second.StatusCode != http.StatusConflict {
 		t.Errorf("expected 409 on duplicate date, got %d", second.StatusCode)
@@ -302,11 +328,11 @@ func TestSchedule_MultiDateRollbackOnConflict(t *testing.T) {
 	s := newTS(t)
 
 	// Claim 2026-06-10 first.
-	s.req(t, http.MethodPost, "/api/schedule",
+	s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-10"}}).Body.Close()
 
 	// Try to assign two dates in one request where the second conflicts.
-	resp := s.req(t, http.MethodPost, "/api/schedule",
+	resp := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-09", "2026-06-10"}})
 	if resp.StatusCode != http.StatusConflict {
 		t.Fatalf("expected 409, got %d", resp.StatusCode)
@@ -314,7 +340,7 @@ func TestSchedule_MultiDateRollbackOnConflict(t *testing.T) {
 	resp.Body.Close()
 
 	// 2026-06-09 must NOT have been committed (transaction rolled back).
-	listResp := s.req(t, http.MethodGet, "/api/schedule?from=2026-06-09&to=2026-06-09", nil)
+	listResp := s.req(t, http.MethodGet, "/api/teams/"+defaultTeam+"/schedule?from=2026-06-09&to=2026-06-09", nil)
 	var entries []any
 	decode(t, listResp, &entries)
 	if len(entries) != 0 {
@@ -328,21 +354,35 @@ func TestSchedule_MultiDateRollbackOnConflict(t *testing.T) {
 
 // addUser creates a second person to hand a shift to. The bootstrap user is
 // admin, id 1.
+// addUser creates a user and puts them in the default team, because a user who
+// is in no team can be paged by nobody and take no shift — which is the rule
+// these tests exercise around, not the one they are testing.
 func addUser(t *testing.T, s *ts, username string) {
 	t.Helper()
 	resp := s.req(t, http.MethodPost, "/api/users",
 		map[string]any{"username": username, "email": username + "@test.com"})
-	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusCreated {
+		resp.Body.Close()
 		t.Fatalf("create user returned %d", resp.StatusCode)
 	}
+	var user struct {
+		ID int64 `json:"id"`
+	}
+	decode(t, resp, &user)
+
+	member := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/members",
+		map[string]any{"user_id": user.ID, "role": "member"})
+	defer member.Body.Close()
+	if member.StatusCode != http.StatusNoContent {
+		t.Fatalf("add %s to the team returned %d", username, member.StatusCode)
+	}
 }
 
 // scheduleHolder reports who is on call for one date, or "" for nobody.
 func scheduleHolder(t *testing.T, s *ts, date string) string {
 	t.Helper()
 	var entries []map[string]any
-	decode(t, s.req(t, http.MethodGet, "/api/schedule?from="+date+"&to="+date, nil), &entries)
+	decode(t, s.req(t, http.MethodGet, "/api/teams/"+defaultTeam+"/schedule?from="+date+"&to="+date, nil), &entries)
 	if len(entries) == 0 {
 		return ""
 	}
@@ -354,10 +394,10 @@ func TestSchedule_ReplaceTakesAnAssignedDate(t *testing.T) {
 	s := newTS(t)
 	addUser(t, s, "alex")
 
-	s.req(t, http.MethodPost, "/api/schedule",
+	s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-01"}}).Body.Close()
 
-	resp := s.req(t, http.MethodPost, "/api/schedule",
+	resp := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 2, "dates": []string{"2026-06-01"}, "replace": true})
 	if resp.StatusCode != http.StatusCreated {
 		t.Fatalf("expected replace to succeed, got %d", resp.StatusCode)
@@ -371,7 +411,7 @@ func TestSchedule_ReplaceTakesAnAssignedDate(t *testing.T) {
 	// One row, not two: two entries for a date would mean two people believing
 	// they are on call for it.
 	var entries []map[string]any
-	decode(t, s.req(t, http.MethodGet, "/api/schedule?from=2026-06-01&to=2026-06-01", nil), &entries)
+	decode(t, s.req(t, http.MethodGet, "/api/teams/"+defaultTeam+"/schedule?from=2026-06-01&to=2026-06-01", nil), &entries)
 	if len(entries) != 1 {
 		t.Errorf("expected exactly one entry for the date, got %d", len(entries))
 	}
@@ -383,11 +423,11 @@ func TestSchedule_ReplaceMixedWeek(t *testing.T) {
 	s := newTS(t)
 	addUser(t, s, "alex")
 
-	s.req(t, http.MethodPost, "/api/schedule",
+	s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-02", "2026-06-04"}}).Body.Close()
 
 	week := []string{"2026-06-01", "2026-06-02", "2026-06-03", "2026-06-04", "2026-06-05"}
-	resp := s.req(t, http.MethodPost, "/api/schedule",
+	resp := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 2, "dates": week, "replace": true})
 	if resp.StatusCode != http.StatusCreated {
 		t.Fatalf("expected the mixed week to succeed, got %d", resp.StatusCode)
@@ -406,10 +446,10 @@ func TestSchedule_ReplaceDefaultsOff(t *testing.T) {
 	s := newTS(t)
 	addUser(t, s, "alex")
 
-	s.req(t, http.MethodPost, "/api/schedule",
+	s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-01"}}).Body.Close()
 
-	resp := s.req(t, http.MethodPost, "/api/schedule",
+	resp := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 2, "dates": []string{"2026-06-01"}})
 	if resp.StatusCode != http.StatusConflict {
 		t.Fatalf("expected 409 without replace, got %d", resp.StatusCode)
@@ -427,7 +467,7 @@ func TestSchedule_ReplaceDefaultsOff(t *testing.T) {
 func TestSchedule_ReplaceCollapsesRepeatedDates(t *testing.T) {
 	s := newTS(t)
 
-	resp := s.req(t, http.MethodPost, "/api/schedule",
+	resp := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{"2026-06-01", "2026-06-01"}, "replace": true})
 	if resp.StatusCode != http.StatusCreated {
 		t.Fatalf("expected a repeated date to be accepted under replace, got %d", resp.StatusCode)
@@ -435,7 +475,7 @@ func TestSchedule_ReplaceCollapsesRepeatedDates(t *testing.T) {
 	resp.Body.Close()
 
 	var entries []map[string]any
-	decode(t, s.req(t, http.MethodGet, "/api/schedule?from=2026-06-01&to=2026-06-01", nil), &entries)
+	decode(t, s.req(t, http.MethodGet, "/api/teams/"+defaultTeam+"/schedule?from=2026-06-01&to=2026-06-01", nil), &entries)
 	if len(entries) != 1 {
 		t.Errorf("expected one entry for the repeated date, got %d", len(entries))
 	}
@@ -505,7 +545,7 @@ func TestArchive_AlertListFilter(t *testing.T) {
 	}
 
 	// 2. Let the sweeper archive it: ends_at is already well past archiveAfter.
-	api.Sweep(context.Background(), s.db, time.Hour, 6*time.Hour, s.deadman, s.notify)
+	api.Sweep(context.Background(), s.db, time.Hour, 6*time.Hour, s.notify)
 
 	// 3. Default list excludes it.
 	decode(t, s.req(t, http.MethodGet, "/api/alerts", nil), &alerts)
@@ -546,7 +586,7 @@ func postAlert(t *testing.T, s *ts, fingerprint, status, startsAt, endsAt string
 
 func sweep(t *testing.T, s *ts, staleAfter time.Duration) {
 	t.Helper()
-	api.Sweep(context.Background(), s.db, noArchive, staleAfter, s.deadman, s.notify)
+	api.Sweep(context.Background(), s.db, noArchive, staleAfter, s.notify)
 }
 
 // A firing alert Alertmanager stopped refreshing is resolved via the
@@ -556,7 +596,7 @@ func TestExpiry_StaleFiringAlert(t *testing.T) {
 	postAlert(t, s, "stale1", "firing", time.Now().Add(-24*time.Hour).Format(time.RFC3339), zeroTime)
 
 	// Age the last-seen timestamp past the staleness window.
-	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'stale1'",
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = 'stale1'",
 		time.Now().Add(-10*time.Hour).Unix())
 
 	sweep(t, s, 6*time.Hour)
@@ -653,10 +693,10 @@ func TestWebhook_RefireUnarchivesAndClearsSource(t *testing.T) {
 	postAlert(t, s, "refire1", "firing", time.Now().Add(-24*time.Hour).Format(time.RFC3339), zeroTime)
 
 	// Expire it, then archive it.
-	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'refire1'",
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = 'refire1'",
 		time.Now().Add(-10*time.Hour).Unix())
 	sweep(t, s, 6*time.Hour)
-	s.exec(t, "UPDATE alerts SET archived_at = unixepoch() WHERE fingerprint = 'refire1'")
+	s.exec(t, "UPDATE alerts SET archived_at = FLOOR(EXTRACT(EPOCH FROM now()))::bigint WHERE fingerprint = 'refire1'")
 
 	var alerts []map[string]any
 	decode(t, s.req(t, http.MethodGet, "/api/alerts", nil), &alerts)
@@ -714,7 +754,7 @@ func TestExpiry_EndsAtIsUpperBound(t *testing.T) {
 	// No watermark: expires on the received_at heartbeat, so the sweeper has
 	// nothing to go on but its own clock.
 	postAlert(t, s, "ub-none", "firing", time.Now().Add(-24*time.Hour).Format(time.RFC3339), zeroTime)
-	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'ub-none'",
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = 'ub-none'",
 		time.Now().Add(-10*time.Hour).Unix())
 
 	// Stale watermark: expires on the ends_at branch, and that reported time
@@ -768,7 +808,7 @@ func TestWebhook_ResendBumpsReceivedAt(t *testing.T) {
 	// received_at has one-second granularity, so back-date it to make the bump
 	// observable instead of sleeping out a second.
 	aged := time.Now().Add(-2 * time.Hour).Unix()
-	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'beat1'", aged)
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = 'beat1'", aged)
 
 	// Identical re-send: same fingerprint, same startsAt, still firing.
 	postAlert(t, s, "beat1", "firing", start, zeroTime)
@@ -796,7 +836,7 @@ func TestWebhook_DiscardedRetryLeavesReceivedAtAlone(t *testing.T) {
 	postAlert(t, s, "beat2", "resolved", start, time.Now().Format(time.RFC3339))
 
 	aged := time.Now().Add(-2 * time.Hour).Unix()
-	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'beat2'", aged)
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = 'beat2'", aged)
 
 	postAlert(t, s, "beat2", "firing", start, zeroTime) // stale retry, discarded
 

internal/api/archiver.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"log"
-	"strings"
+
 	"time"
 )
 
@@ -19,15 +19,15 @@ const (
 
 // StartArchiver runs the alert sweeper until ctx is cancelled, starting with an
 // immediate pass so a restart reconciles state right away.
-func StartArchiver(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration, deadman DeadmanConfig, notify NotifyConfig) {
+func StartArchiver(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration, notify NotifyConfig) {
 	ticker := time.NewTicker(sweepInterval)
 	defer ticker.Stop()
 
-	Sweep(ctx, db, archiveAfter, staleAfter, deadman, notify)
+	Sweep(ctx, db, archiveAfter, staleAfter, notify)
 	for {
 		select {
 		case <-ticker.C:
-			Sweep(ctx, db, archiveAfter, staleAfter, deadman, notify)
+			Sweep(ctx, db, archiveAfter, staleAfter, notify)
 		case <-ctx.Done():
 			return
 		}
@@ -44,8 +44,8 @@ func StartArchiver(ctx context.Context, db *sql.DB, archiveAfter, staleAfter tim
 // touch: a heartbeat answers to its own, much tighter, timeout, and the generic
 // staleness rules would otherwise resolve it as 'expiry' long before that.
 // Exported so tests can drive a pass without waiting on the ticker.
-func Sweep(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration, deadman DeadmanConfig, notify NotifyConfig) {
-	heartbeats := sweepDeadman(ctx, db, deadman, notify)
+func Sweep(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration, notify NotifyConfig) {
+	heartbeats := sweepDeadman(ctx, db, notify)
 	expireStale(ctx, db, staleAfter, heartbeats)
 	resolveSettledIncidents(ctx, db)
 	archiveResolved(ctx, db, archiveAfter)
@@ -91,17 +91,18 @@ func expireStale(ctx context.Context, db *sql.DB, staleAfter time.Duration, skip
 		return
 	}
 
-	args := make([]any, 0, len(ids)+1)
-	args = append(args, resolutionExpiry)
-	for _, id := range ids {
-		args = append(args, id)
+	args := &sqlArgs{}
+	source := args.add(resolutionExpiry)
+	idList := make([]any, len(ids))
+	for i, id := range ids {
+		idList[i] = id
 	}
 	if _, err := db.ExecContext(ctx, `
 		UPDATE alerts
 		   SET status            = 'resolved',
-		       resolution_source = ?,
-		       ends_at           = COALESCE(ends_at, unixepoch())
-		 WHERE id IN (`+placeholders(len(ids))+`)`, args...); err != nil {
+		       resolution_source = `+source+`,
+		       ends_at           = COALESCE(ends_at, `+nowEpoch+`)
+		 WHERE id IN (`+args.addList(idList)+`)`, args.all()...); err != nil {
 		log.Printf("sweeper: expire stale: %v", err)
 		return
 	}
@@ -124,14 +125,15 @@ func expireStale(ctx context.Context, db *sql.DB, staleAfter time.Duration, skip
 }
 
 // staleAlertIDs reads the ids in one go and closes the cursor before the caller
-// writes: the pool is limited to a single connection, so an open read would
-// block the update behind it.
+// writes. Under SQLite's single connection an open read would have blocked the
+// update outright; with a pool it is no longer a deadlock, but reading the set
+// first still keeps the write off a cursor the same transaction is walking.
 func staleAlertIDs(ctx context.Context, db *sql.DB, now time.Time, staleAfter time.Duration) ([]int64, error) {
 	rows, err := db.QueryContext(ctx, `
 		SELECT id FROM alerts
 		 WHERE status = 'firing'
 		   AND archived_at IS NULL
-		   AND ((ends_at IS NOT NULL AND ends_at < ?) OR received_at < ?)`,
+		   AND ((ends_at IS NOT NULL AND ends_at < $1) OR received_at < $2)`,
 		now.Add(-expiryGrace).Unix(), now.Add(-staleAfter).Unix())
 	if err != nil {
 		return nil, err
@@ -206,10 +208,10 @@ func settledIncidentIDs(ctx context.Context, db *sql.DB) ([]int64, error) {
 func archiveResolved(ctx context.Context, db *sql.DB, archiveAfter time.Duration) {
 	cutoff := time.Now().Add(-archiveAfter).Unix()
 	res, err := db.ExecContext(ctx,
-		`UPDATE alerts SET archived_at = unixepoch()
+		`UPDATE alerts SET archived_at = `+nowEpoch+`
 		 WHERE status = 'resolved'
 		   AND archived_at IS NULL
-		   AND COALESCE(ends_at, received_at) < ?`, cutoff)
+		   AND COALESCE(ends_at, received_at) < $1`, cutoff)
 	if err != nil {
 		log.Printf("archiver: %v", err)
 		return
@@ -223,10 +225,10 @@ func archiveResolved(ctx context.Context, db *sql.DB, archiveAfter time.Duration
 func archiveResolvedIncidents(ctx context.Context, db *sql.DB, archiveAfter time.Duration) {
 	cutoff := time.Now().Add(-archiveAfter).Unix()
 	res, err := db.ExecContext(ctx,
-		`UPDATE incidents SET archived_at = unixepoch()
+		`UPDATE incidents SET archived_at = `+nowEpoch+`
 		 WHERE resolved_at IS NOT NULL
 		   AND archived_at IS NULL
-		   AND resolved_at < ?`, cutoff)
+		   AND resolved_at < $1`, cutoff)
 	if err != nil {
 		log.Printf("archiver: incidents: %v", err)
 		return
@@ -235,8 +237,3 @@ func archiveResolvedIncidents(ctx context.Context, db *sql.DB, archiveAfter time
 		log.Printf("archiver: archived %d resolved incident(s)", n)
 	}
 }
-
-// placeholders builds "?, ?, …" for an IN clause of n values.
-func placeholders(n int) string {
-	return strings.TrimSuffix(strings.Repeat("?, ", n), ", ")
-}

internal/api/auth.go

@@ -163,7 +163,7 @@ func handleLogin(db *sql.DB, limiter *loginLimiter, publicURL string) http.Handl
 		var userID int64
 		var hash sql.NullString
 		err := db.QueryRowContext(r.Context(),
-			"SELECT id, password_hash FROM users WHERE username = ?", username,
+			"SELECT id, password_hash FROM users WHERE username = $1", username,
 		).Scan(&userID, &hash)
 		if err != nil && !errors.Is(err, sql.ErrNoRows) {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
@@ -190,7 +190,7 @@ func handleLogin(db *sql.DB, limiter *loginLimiter, publicURL string) http.Handl
 		now := time.Now()
 		if _, err := db.ExecContext(r.Context(), `
 			INSERT INTO sessions (token_hash, user_id, created_at, last_seen_at, expires_at, user_agent)
-			VALUES (?, ?, ?, ?, ?, ?)`,
+			VALUES ($1, $2, $3, $4, $5, $6)`,
 			tokenHash, userID, now.Unix(), now.Unix(), now.Add(sessionTTL).Unix(), r.UserAgent()); err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -225,7 +225,7 @@ func handleLogout(db *sql.DB, publicURL string) http.HandlerFunc {
 			return
 		}
 		if c, err := r.Cookie(sessionCookie); err == nil && c.Value != "" {
-			db.ExecContext(r.Context(), "DELETE FROM sessions WHERE token_hash = ?", hashToken(c.Value))
+			db.ExecContext(r.Context(), "DELETE FROM sessions WHERE token_hash = $1", hashToken(c.Value))
 		}
 		http.SetCookie(w, &http.Cookie{
 			Name:     sessionCookie,
@@ -257,7 +257,7 @@ func handleMe(db *sql.DB) http.HandlerFunc {
 		}
 		var hash sql.NullString
 		db.QueryRowContext(r.Context(),
-			"SELECT password_hash FROM users WHERE id = ?", caller.ID).Scan(&hash)
+			"SELECT password_hash FROM users WHERE id = $1", caller.ID).Scan(&hash)
 		respond(w, http.StatusOK, meResponse{User: user, HasPassword: hash.Valid})
 	}
 }
@@ -266,8 +266,9 @@ func handleMe(db *sql.DB) http.HandlerFunc {
 //
 // Changing your own password takes the current one, when there is one, so an
 // unattended signed-in browser cannot be used to take the account over. Setting
-// somebody else's is how an admin gives a user their first password, and like
-// the other user endpoints it is open to any authenticated caller.
+// somebody else's is how an admin gives a user their first password, and is
+// restricted to administrators: it hands over an account outright, without
+// knowing the password it replaces.
 //
 // Every other session of the target is ended: a password change is what you
 // do when you think someone else is signed in.
@@ -278,6 +279,9 @@ func handleSetPassword(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusBadRequest, errResp("invalid user id"))
 			return
 		}
+		if !requireSelfOrAdmin(w, r, id) {
+			return
+		}
 		var req struct {
 			Password        string `json:"password"`
 			CurrentPassword string `json:"current_password"`
@@ -293,7 +297,7 @@ func handleSetPassword(db *sql.DB) http.HandlerFunc {
 
 		var existing sql.NullString
 		err = db.QueryRowContext(r.Context(),
-			"SELECT password_hash FROM users WHERE id = ?", id).Scan(&existing)
+			"SELECT password_hash FROM users WHERE id = $1", id).Scan(&existing)
 		if errors.Is(err, sql.ErrNoRows) {
 			respond(w, http.StatusNotFound, errResp("user not found"))
 			return
@@ -324,13 +328,13 @@ func handleSetPassword(db *sql.DB) http.HandlerFunc {
 		defer tx.Rollback()
 
 		if _, err := tx.ExecContext(r.Context(),
-			"UPDATE users SET password_hash = ? WHERE id = ?", hash, id); err != nil {
+			"UPDATE users SET password_hash = $1 WHERE id = $2", hash, id); err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
 		keep, _ := sessionFromContext(r.Context()) // zero when changed with an API key
 		if _, err := tx.ExecContext(r.Context(),
-			"DELETE FROM sessions WHERE user_id = ? AND id != ?", id, keep); err != nil {
+			"DELETE FROM sessions WHERE user_id = $1 AND id != $2", id, keep); err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
@@ -345,7 +349,7 @@ func handleSetPassword(db *sql.DB) http.HandlerFunc {
 // purgeSessions deletes sessions that have expired, from the sweeper.
 func purgeSessions(ctx context.Context, db *sql.DB) {
 	res, err := db.ExecContext(ctx,
-		"DELETE FROM sessions WHERE expires_at < ?", time.Now().Unix())
+		"DELETE FROM sessions WHERE expires_at < $1", time.Now().Unix())
 	if err != nil {
 		log.Printf("sweeper: purge sessions: %v", err)
 		return

internal/api/auth_test.go

@@ -11,7 +11,6 @@ import (
 	"testing"
 
 	"git.ryuvia.com/niklas/terdut-server/internal/api"
-	"git.ryuvia.com/niklas/terdut-server/internal/db"
 )
 
 const adminPassword = "correct horse battery"
@@ -249,7 +248,7 @@ func TestSession_ExpiredIsRejected(t *testing.T) {
 	if code := status(t, b.do(t, http.MethodGet, "/api/me", nil)); code != http.StatusUnauthorized {
 		t.Errorf("expired session: %d", code)
 	}
-	api.Sweep(t.Context(), s.db, 0, 0, api.DeadmanConfig{}, api.NotifyConfig{})
+	api.Sweep(t.Context(), s.db, 0, 0, api.NotifyConfig{})
 	var n int
 	s.db.QueryRow("SELECT COUNT(*) FROM sessions").Scan(&n)
 	if n != 0 {
@@ -301,15 +300,9 @@ func TestSetPassword_EndsOtherSessionsButNotThisOne(t *testing.T) {
 }
 
 func TestBootstrap_WithPassword(t *testing.T) {
-	database, err := db.Open(":memory:")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := db.Migrate(database); err != nil {
-		t.Fatal(err)
-	}
-	srv := httptest.NewServer(api.NewRouter(database, api.NotifyConfig{}, api.DeadmanConfig{}))
-	t.Cleanup(func() { srv.Close(); database.Close() })
+	database := newTestDB(t)
+	srv := httptest.NewServer(api.NewRouter(database, api.NotifyConfig{}))
+	t.Cleanup(srv.Close)
 
 	body := `{"username":"admin","email":"a@test.com","password":"` + adminPassword + `"}`
 	resp, err := http.Post(srv.URL+"/api/bootstrap", "application/json", strings.NewReader(body))

internal/api/deadman.go

@@ -171,6 +171,7 @@ func ParseDeadmanConfig(matchers string, timeout time.Duration, severity string)
 // deadmanAlert is one switch: the alert row carrying its last heartbeat.
 type deadmanAlert struct {
 	id          int64
+	teamID      int64
 	fingerprint string
 	labels      map[string]string
 	matcher     DeadmanMatcher
@@ -188,27 +189,33 @@ func (a deadmanAlert) groupKey() string { return deadmanGroupPrefix + a.fingerpr
 // It returns the ids of the alerts it owns, because the generic staleness
 // expiry must leave them alone — staleAfter and ends_at would otherwise resolve
 // a heartbeat long before its own, much tighter, timeout ever fired.
-func sweepDeadman(ctx context.Context, db *sql.DB, cfg DeadmanConfig, notify NotifyConfig) map[int64]bool {
+// Each team is swept against its own configuration: its own matchers, its own
+// timeout, its own severity. A team watching nothing is skipped entirely, which
+// is most of them.
+func sweepDeadman(ctx context.Context, db *sql.DB, notify NotifyConfig) map[int64]bool {
 	owned := map[int64]bool{}
-	if !cfg.enabled() {
-		return owned
-	}
 
-	switches, err := deadmanAlerts(ctx, db, cfg)
+	configs, err := deadmanConfigs(ctx, db)
 	if err != nil {
-		log.Printf("deadman: load switches: %v", err)
+		log.Printf("deadman: load configs: %v", err)
 		return owned
 	}
 
 	now := time.Now()
+	for teamID, cfg := range configs {
+		switches, err := deadmanAlerts(ctx, db, teamID, cfg)
+		if err != nil {
+			log.Printf("deadman: load switches for team %d: %v", teamID, err)
+			continue
+		}
 		cutoff := now.Add(-cfg.Timeout).Unix()
 
 		for _, sw := range switches {
 			owned[sw.id] = true
 
-		// An explicit resolved from Alertmanager is a stronger death signal than
-		// mere absence: the sender is telling us the heartbeat stopped, so there
-		// is nothing left to wait out.
+			// An explicit resolved from Alertmanager is a stronger death signal
+			// than mere absence: the sender is telling us the heartbeat
+			// stopped, so there is nothing left to wait out.
 			if sw.resolved || sw.receivedAt < cutoff {
 				if err := deadmanDied(ctx, db, cfg, notify, sw, now); err != nil {
 					log.Printf("deadman: open incident for %s: %v", sw.matcher.Name, err)
@@ -219,25 +226,29 @@ func sweepDeadman(ctx context.Context, db *sql.DB, cfg DeadmanConfig, notify Not
 				log.Printf("deadman: resolve incident for %s: %v", sw.matcher.Name, err)
 			}
 		}
+	}
 	return owned
 }
 
 // deadmanAlerts loads every alert row that a matcher claims. The candidate query
 // is narrowed by alertname so it rides alerts_name_idx; the rest of the matching
 // happens in Go, which keeps one implementation of the rules. The rows are read
-// in full before the caller writes, because the pool holds a single connection.
-func deadmanAlerts(ctx context.Context, db *sql.DB, cfg DeadmanConfig) ([]deadmanAlert, error) {
+// in full before the caller writes, so the writes do not run against an open
+// cursor over the same table.
+func deadmanAlerts(ctx context.Context, db *sql.DB, teamID int64, cfg DeadmanConfig) ([]deadmanAlert, error) {
 	names := cfg.names()
-	args := make([]any, 0, len(names))
-	for _, n := range names {
-		args = append(args, n)
+	args := &sqlArgs{}
+	nameList := make([]any, len(names))
+	for i, n := range names {
+		nameList[i] = n
 	}
 
 	rows, err := db.QueryContext(ctx, `
-		SELECT id, fingerprint, labels, status, received_at
+		SELECT id, team_id, fingerprint, labels, status, received_at
 		FROM   alerts
-		WHERE  name IN (`+placeholders(len(names))+`)
-		  AND  archived_at IS NULL`, args...)
+		WHERE  team_id = `+args.add(teamID)+`
+		  AND  name IN (`+args.addList(nameList)+`)
+		  AND  archived_at IS NULL`, args.all()...)
 	if err != nil {
 		return nil, err
 	}
@@ -247,7 +258,7 @@ func deadmanAlerts(ctx context.Context, db *sql.DB, cfg DeadmanConfig) ([]deadma
 	for rows.Next() {
 		var a deadmanAlert
 		var labelsJSON, status string
-		if err := rows.Scan(&a.id, &a.fingerprint, &labelsJSON, &status, &a.receivedAt); err != nil {
+		if err := rows.Scan(&a.id, &a.teamID, &a.fingerprint, &labelsJSON, &status, &a.receivedAt); err != nil {
 			return nil, err
 		}
 		json.Unmarshal([]byte(labelsJSON), &a.labels) //nolint:errcheck
@@ -277,9 +288,9 @@ func deadmanDied(ctx context.Context, db *sql.DB, cfg DeadmanConfig, notify Noti
 	var lastTriggered, open int64
 	if err := db.QueryRowContext(ctx, `
 		SELECT COALESCE(MAX(triggered_at), 0),
-		       COALESCE(SUM(resolved_at IS NULL), 0)
-		FROM   incidents WHERE group_key = ?`,
-		sw.groupKey()).Scan(&lastTriggered, &open); err != nil {
+		       COUNT(*) FILTER (WHERE resolved_at IS NULL)
+		FROM   incidents WHERE team_id = $1 AND group_key = $2`,
+		sw.teamID, sw.groupKey()).Scan(&lastTriggered, &open); err != nil {
 		return err
 	}
 	if open > 0 || sw.receivedAt <= lastTriggered {
@@ -299,9 +310,9 @@ func deadmanDied(ctx context.Context, db *sql.DB, cfg DeadmanConfig, notify Noti
 		if _, err := tx.ExecContext(ctx, `
 			UPDATE alerts
 			   SET status            = 'resolved',
-			       resolution_source = ?,
-			       ends_at           = COALESCE(ends_at, unixepoch())
-			 WHERE id = ? AND status = 'firing'`, resolutionDeadman, sw.id); err != nil {
+			       resolution_source = $1,
+			       ends_at           = COALESCE(ends_at, `+nowEpoch+`)
+			 WHERE id = $2 AND status = 'firing'`, resolutionDeadman, sw.id); err != nil {
 			return err
 		}
 	}
@@ -312,7 +323,9 @@ func deadmanDied(ctx context.Context, db *sql.DB, cfg DeadmanConfig, notify Noti
 		sev = &severity
 	}
 
-	incidentID, err := openIncident(ctx, tx, notify, sw.groupKey(),
+	// The incident opens in the team whose integration received the heartbeat:
+	// the switch belongs to whoever is watching that source, not to the install.
+	incidentID, err := openIncident(ctx, tx, notify, sw.teamID, sw.groupKey(),
 		"No heartbeat from "+sw.matcher.String(), sw.labels, sev)
 	if err != nil {
 		return err
@@ -341,7 +354,8 @@ func deadmanRecovered(ctx context.Context, db *sql.DB, sw deadmanAlert) error {
 	var incidentID int64
 	switch err := db.QueryRowContext(ctx, `
 		SELECT id FROM incidents
-		 WHERE group_key = ? AND resolved_at IS NULL`, sw.groupKey()).Scan(&incidentID); {
+		 WHERE team_id = $1 AND group_key = $2 AND resolved_at IS NULL`,
+		sw.teamID, sw.groupKey()).Scan(&incidentID); {
 	case err == sql.ErrNoRows:
 		return nil
 	case err != nil:
@@ -356,8 +370,8 @@ func deadmanRecovered(ctx context.Context, db *sql.DB, sw deadmanAlert) error {
 
 	if _, err := tx.ExecContext(ctx, `
 		UPDATE incidents
-		   SET status = 'resolved', resolved_at = ?, resolution_source = ?
-		 WHERE id = ? AND resolved_at IS NULL`,
+		   SET status = 'resolved', resolved_at = $1, resolution_source = $2
+		 WHERE id = $3 AND resolved_at IS NULL`,
 		time.Now().Unix(), incidentResolutionRecovered, incidentID); err != nil {
 		return err
 	}
@@ -376,3 +390,113 @@ func deadmanRecovered(ctx context.Context, db *sql.DB, sw deadmanAlert) error {
 	log.Printf("deadman: %s is back, resolved incident %d", sw.matcher.String(), incidentID)
 	return nil
 }
+
+// ---------------------------------------------------------------------------
+// Per-team configuration
+// ---------------------------------------------------------------------------
+
+// deadmanConfigForTeam reads one team's switches. A team with no row, or with
+// nothing configured, gets a disabled config — which is the right answer rather
+// than an error: most teams watch no heartbeat at all.
+func deadmanConfigForTeam(ctx context.Context, q querier, teamID int64) (DeadmanConfig, error) {
+	var matchers, severity string
+	var timeout int64
+	err := q.QueryRowContext(ctx,
+		"SELECT matchers, timeout_seconds, severity FROM deadman_configs WHERE team_id = $1",
+		teamID).Scan(&matchers, &timeout, &severity)
+	if err == sql.ErrNoRows {
+		return DeadmanConfig{}, nil
+	}
+	if err != nil {
+		return DeadmanConfig{}, err
+	}
+	return parseDeadmanQuietly(matchers, time.Duration(timeout)*time.Second, severity), nil
+}
+
+// deadmanConfigs reads every team's switches in one query, for the sweeper.
+func deadmanConfigs(ctx context.Context, db *sql.DB) (map[int64]DeadmanConfig, error) {
+	rows, err := db.QueryContext(ctx,
+		"SELECT team_id, matchers, timeout_seconds, severity FROM deadman_configs")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := map[int64]DeadmanConfig{}
+	for rows.Next() {
+		var teamID, timeout int64
+		var matchers, severity string
+		if err := rows.Scan(&teamID, &matchers, &timeout, &severity); err != nil {
+			return nil, err
+		}
+		cfg := parseDeadmanQuietly(matchers, time.Duration(timeout)*time.Second, severity)
+		if cfg.enabled() {
+			out[teamID] = cfg
+		}
+	}
+	return out, rows.Err()
+}
+
+// SeedDeadmanConfigs gives every team without a row the server's environment
+// configuration, so the install that upgrades into per-team switches keeps
+// watching exactly what it was watching before.
+//
+// Idempotent, and never overwrites: once a team has a row it owns its own
+// configuration, and a redeploy must not quietly put the environment's value
+// back over an owner's edit.
+//
+// A team created after startup gets no row and therefore watches nothing until
+// its owner says otherwise. That is deliberate: inheriting an install-wide
+// heartbeat would page a new team about a source it has never heard of, and a
+// switch nobody chose is the kind that gets muted rather than fixed.
+func SeedDeadmanConfigs(ctx context.Context, db *sql.DB, cfg DeadmanConfig) error {
+	matchers := make([]string, 0, len(cfg.Matchers))
+	for _, m := range cfg.Matchers {
+		parts := []string{"alertname=" + m.Name}
+		for k, v := range m.Labels {
+			parts = append(parts, k+"="+v)
+		}
+		sort.Strings(parts[1:])
+		matchers = append(matchers, strings.Join(parts, ","))
+	}
+
+	_, err := db.ExecContext(ctx, `
+		INSERT INTO deadman_configs (team_id, matchers, timeout_seconds, severity)
+		SELECT id, $1, $2, $3 FROM teams
+		ON CONFLICT (team_id) DO NOTHING`,
+		strings.Join(matchers, "; "), int64(cfg.Timeout.Seconds()), cfg.Severity)
+	return err
+}
+
+// parseDeadmanQuietly is ParseDeadmanConfig without the startup logging: a
+// team's configuration is read on every sweep and every webhook, and logging it
+// each time would bury everything else.
+func parseDeadmanQuietly(matchers string, timeout time.Duration, severity string) DeadmanConfig {
+	cfg := DeadmanConfig{Timeout: timeout, Severity: severity}
+	for _, entry := range strings.Split(matchers, ";") {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		m := DeadmanMatcher{Labels: map[string]string{}}
+		malformed := false
+		for _, cond := range strings.Split(entry, ",") {
+			k, v, ok := strings.Cut(cond, "=")
+			k, v = strings.TrimSpace(k), strings.TrimSpace(v)
+			if !ok || k == "" || v == "" {
+				malformed = true
+				break
+			}
+			if k == "alertname" {
+				m.Name = v
+				continue
+			}
+			m.Labels[k] = v
+		}
+		if malformed || m.Name == "" {
+			continue
+		}
+		cfg.Matchers = append(cfg.Matchers, m)
+	}
+	return cfg
+}

internal/api/deadman_test.go

@@ -2,6 +2,7 @@ package api_test
 
 import (
 	"net/http"
+	"strings"
 	"testing"
 	"time"
 
@@ -51,7 +52,7 @@ func heartbeat(t *testing.T, s *ts, fingerprint string, labels map[string]string
 // sweeper reads. There is no fake clock in this package.
 func silence(t *testing.T, s *ts, fingerprint string, ago time.Duration) {
 	t.Helper()
-	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = ?",
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = $2",
 		time.Now().Add(-ago).Unix(), fingerprint)
 }
 
@@ -61,9 +62,12 @@ func silence(t *testing.T, s *ts, fingerprint string, ago time.Duration) {
 func ageIncidents(t *testing.T, s *ts, ago time.Duration) {
 	t.Helper()
 	past := time.Now().Add(-ago).Unix()
+	// $2 is cast explicitly: with NULL in the other branch Postgres has nothing
+	// to infer the parameter's type from and defaults it to text, which the
+	// bigint column then refuses.
 	s.exec(t, `UPDATE incidents
-	              SET triggered_at = ?,
-	                  resolved_at  = CASE WHEN resolved_at IS NULL THEN NULL ELSE ? END`,
+	              SET triggered_at = $1,
+	                  resolved_at  = CASE WHEN resolved_at IS NULL THEN NULL ELSE $2::bigint END`,
 		past, past)
 }
 
@@ -72,7 +76,7 @@ func incidentByGroup(t *testing.T, s *ts, groupKey string) (id int64, status, se
 	t.Helper()
 	err := s.db.QueryRow(`
 		SELECT id, status, COALESCE(severity, ''), resolution_source
-		FROM   incidents WHERE group_key = ? ORDER BY id DESC LIMIT 1`,
+		FROM   incidents WHERE group_key = $1 ORDER BY id DESC LIMIT 1`,
 		groupKey).Scan(&id, &status, &severity, &source)
 	if err != nil {
 		t.Fatalf("read incident for group %s: %v", groupKey, err)
@@ -466,3 +470,123 @@ func TestDeadman_DisabledConfigIsInert(t *testing.T) {
 		t.Errorf("expected the generic sweeper to own the alert, got %v", source)
 	}
 }
+
+// ---------------------------------------------------------------------------
+// Per-team configuration
+// ---------------------------------------------------------------------------
+
+// Each team decides for itself what a heartbeat is. The same alert is a
+// heartbeat in one team and an ordinary problem in another.
+func TestDeadman_ConfigurationIsPerTeam(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+	watched := newTeam(t, s, "watched")
+	unwatched := newTeam(t, s, "unwatched")
+
+	// Only the first team calls Watchdog a heartbeat.
+	resp := s.req(t, http.MethodPut, "/api/teams/"+id64(watched.id)+"/deadman", map[string]any{
+		"matchers":        "alertname=Watchdog",
+		"timeout_seconds": 3600,
+		"severity":        "critical",
+	})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("configure the watched team: %d", resp.StatusCode)
+	}
+
+	postToIntegration(t, s, watched.key, "fp-watched", "Watchdog")
+	postToIntegration(t, s, unwatched.key, "fp-unwatched", "Watchdog")
+
+	// A heartbeat opens nothing where it is one; an ordinary alert opens an
+	// incident where it is not.
+	if got := len(list(t, watched.call(http.MethodGet, "/api/incidents", nil))); got != 0 {
+		t.Errorf("the watched team's heartbeat opened %d incident(s), want 0", got)
+	}
+	if got := len(list(t, unwatched.call(http.MethodGet, "/api/incidents", nil))); got != 1 {
+		t.Errorf("the unwatched team's Watchdog opened %d incident(s), want 1", got)
+	}
+
+	// Silence pages only the team that is watching.
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = $2",
+		time.Now().Add(-2*time.Hour).Unix(), "fp-watched")
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = $2",
+		time.Now().Add(-2*time.Hour).Unix(), "fp-unwatched")
+	sweep(t, s, noArchive)
+
+	watchedIncidents := list(t, watched.call(http.MethodGet, "/api/incidents", nil))
+	if len(watchedIncidents) != 1 {
+		t.Fatalf("silence opened %d incident(s) for the watching team, want 1", len(watchedIncidents))
+	}
+	if title := watchedIncidents[0]["title"].(string); title != "No heartbeat from Watchdog" {
+		t.Errorf("unexpected incident title %q", title)
+	}
+	if teamID := int64(watchedIncidents[0]["team_id"].(float64)); teamID != watched.id {
+		t.Errorf("the incident opened in team %d, want %d", teamID, watched.id)
+	}
+
+	// The unwatched team's alert went stale the ordinary way, so it has the one
+	// incident it always had — not a second, dead man's switch one.
+	if got := len(list(t, unwatched.call(http.MethodGet, "/api/incidents", nil))); got != 1 {
+		t.Errorf("the unwatched team ended with %d incident(s), want 1", got)
+	}
+}
+
+// Configuration is an owner's to change and a member's to read, like the rest of
+// a team's settings.
+func TestDeadman_ConfigurationIsOwnerOnly(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+	team := newTeam(t, s, "red")
+
+	// A plain member of that team.
+	var user struct {
+		ID int64 `json:"id"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/users",
+		map[string]string{"username": "plain", "email": "plain@test.com"}), &user)
+	s.req(t, http.MethodPost, "/api/teams/"+id64(team.id)+"/members",
+		map[string]any{"user_id": user.ID, "role": "member"}).Body.Close()
+	var key struct {
+		Key string `json:"key"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/users/"+id64(user.ID)+"/api-keys",
+		map[string]string{"name": "test"}), &key)
+
+	req, _ := http.NewRequest(http.MethodPut,
+		s.URL+"/api/teams/"+id64(team.id)+"/deadman",
+		strings.NewReader(`{"matchers":"alertname=Watchdog","timeout_seconds":60}`))
+	req.Header.Set("Authorization", "Bearer "+key.Key)
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("put: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Errorf("a member editing the switches: expected 403, got %d", resp.StatusCode)
+	}
+
+	read, _ := http.NewRequest(http.MethodGet, s.URL+"/api/teams/"+id64(team.id)+"/deadman", nil)
+	read.Header.Set("Authorization", "Bearer "+key.Key)
+	got, err := http.DefaultClient.Do(read)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	got.Body.Close()
+	if got.StatusCode != http.StatusOK {
+		t.Errorf("a member reading the switches: expected 200, got %d", got.StatusCode)
+	}
+}
+
+// A matcher with no alertname watches nothing, silently, which is the failure
+// this feature exists to prevent — so it is refused at the door.
+func TestDeadman_UnusableMatchersAreRejected(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	resp := s.req(t, http.MethodPut, "/api/teams/"+defaultTeam+"/deadman", map[string]any{
+		"matchers":        "cluster=prod",
+		"timeout_seconds": 900,
+	})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("expected 400 for a matcher with no alertname, got %d", resp.StatusCode)
+	}
+}

internal/api/helpers.go

@@ -2,9 +2,67 @@ package api
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/jackc/pgerrcode"
+	"github.com/jackc/pgx/v5/pgconn"
 )
 
+// sqlArgs accumulates query arguments and hands back the placeholder for each.
+//
+// Postgres numbers its placeholders, so a dynamically assembled WHERE clause has
+// to keep its $1, $2, … in step with the order of the values — which SQLite's
+// positional `?` did for free. Handing out the placeholder and storing the value
+// in one call is what keeps them in step: a filter can be added, removed or
+// reordered without renumbering anything by hand.
+type sqlArgs struct{ vals []any }
+
+// add stores v and returns the placeholder that refers to it.
+func (a *sqlArgs) add(v any) string {
+	a.vals = append(a.vals, v)
+	return "$" + strconv.Itoa(len(a.vals))
+}
+
+// addList stores every value and returns their placeholders as "$1, $2, …",
+// ready to drop into an IN (…) clause. Returns an empty string for no values,
+// which no caller should reach: `IN ()` is a syntax error in Postgres as it was
+// in SQLite, so callers check for an empty set before building the query.
+func (a *sqlArgs) addList(vs []any) string {
+	parts := make([]string, len(vs))
+	for i, v := range vs {
+		parts[i] = a.add(v)
+	}
+	return strings.Join(parts, ", ")
+}
+
+// all returns the accumulated values, to be passed straight to Query or Exec.
+func (a *sqlArgs) all() []any { return a.vals }
+
+// nowEpoch is the SQL expression for "now, as unix seconds", matching how every
+// timestamp in this schema is stored. SQLite spelled it unixepoch().
+//
+// FLOOR, not a bare cast: EXTRACT returns fractional seconds and casting to
+// bigint rounds half up, so a row written at .6 of a second would claim a
+// timestamp one second in the future — off by one against the time.Now().Unix()
+// the Go side stamps, which is what the expiry tests measure.
+const nowEpoch = "FLOOR(EXTRACT(EPOCH FROM now()))::bigint"
+
+// isUniqueViolation reports whether err is a broken unique constraint, which
+// callers turn into 409 Conflict rather than 500.
+//
+// Postgres reports it as SQLSTATE 23505 on a typed error; the SQLite driver this
+// replaced only put "UNIQUE constraint failed" in the message, which is why the
+// check used to be a substring match. Matching the code means a renamed
+// constraint or a translated message cannot quietly turn a conflict back into a
+// 500.
+func isUniqueViolation(err error) bool {
+	var pgErr *pgconn.PgError
+	return errors.As(err, &pgErr) && pgErr.Code == pgerrcode.UniqueViolation
+}
+
 func respond(w http.ResponseWriter, status int, v any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)

internal/api/incident_store.go

@@ -51,12 +51,13 @@ type querier interface {
 }
 
 const incidentSelectFrom = `
-	SELECT i.id, i.group_key, i.title, i.group_labels, i.status, i.severity,
+	SELECT i.id, i.team_id, t.name, i.group_key, i.title, i.group_labels, i.status, i.severity,
 	       i.triggered_at,
 	       i.acknowledged_by, i.acknowledged_at, ack.username,
 	       i.assigned_to, asg.username, i.snoozed_until,
 	       i.resolved_at, i.resolution_source, i.archived_at
 	FROM   incidents i
+	JOIN   teams t ON t.id = i.team_id
 	LEFT   JOIN users ack ON ack.id = i.acknowledged_by
 	LEFT   JOIN users asg ON asg.id = i.assigned_to`
 
@@ -67,7 +68,7 @@ func scanIncident(s scanner) (models.Incident, error) {
 	var ackAt, snoozedUntil, resolvedAt, archivedAt *int64
 
 	if err := s.Scan(
-		&i.ID, &i.GroupKey, &i.Title, &groupLabelsJSON, &i.Status, &i.Severity,
+		&i.ID, &i.TeamID, &i.TeamName, &i.GroupKey, &i.Title, &groupLabelsJSON, &i.Status, &i.Severity,
 		&triggeredAt,
 		&i.AcknowledgedByID, &ackAt, &i.AcknowledgedByUser,
 		&i.AssignedToID, &i.AssignedToUser, &snoozedUntil,
@@ -95,7 +96,7 @@ func unixPtr(sec *int64) *time.Time {
 }
 
 func fetchIncident(ctx context.Context, q querier, id int64) (models.Incident, error) {
-	return scanIncident(q.QueryRowContext(ctx, incidentSelectFrom+" WHERE i.id = ?", id))
+	return scanIncident(q.QueryRowContext(ctx, incidentSelectFrom+" WHERE i.id = $1", id))
 }
 
 // logEvent appends one entry to an incident's timeline. A nil userID means the
@@ -103,7 +104,7 @@ func fetchIncident(ctx context.Context, q querier, id int64) (models.Incident, e
 func logEvent(ctx context.Context, q querier, incidentID int64, evType string, userID, alertID *int64, detail *string) error {
 	_, err := q.ExecContext(ctx, `
 		INSERT INTO incident_events (incident_id, type, user_id, alert_id, detail, created_at)
-		VALUES (?, ?, ?, ?, ?, ?)`,
+		VALUES ($1, $2, $3, $4, $5, $6)`,
 		incidentID, evType, userID, alertID, detail, time.Now().Unix())
 	return err
 }
@@ -113,12 +114,17 @@ func todayUTC() string {
 	return time.Now().UTC().Format("2006-01-02")
 }
 
-// currentOnCall returns today's on-call user, or nil when nobody is scheduled.
-// A missing schedule entry is not an error — incidents just open unassigned.
-func currentOnCall(ctx context.Context, q querier) (*int64, error) {
+// currentOnCall returns a team's on-call user for today, or nil when nobody is
+// scheduled. A missing schedule entry is not an error — incidents just open
+// unassigned.
+//
+// Per team: each team keeps its own rota, so two teams can have two different
+// people on call on the same day, which was the point of scoping the schedule.
+func currentOnCall(ctx context.Context, q querier, teamID int64) (*int64, error) {
 	var userID int64
 	err := q.QueryRowContext(ctx,
-		"SELECT user_id FROM schedule_entries WHERE date = ?", todayUTC()).Scan(&userID)
+		"SELECT user_id FROM schedule_entries WHERE team_id = $1 AND date = $2",
+		teamID, todayUTC()).Scan(&userID)
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}
@@ -154,10 +160,10 @@ func severityRank(s string) int {
 // in the queue while the work is still open.
 func refreshSeverity(ctx context.Context, q querier, incidentID int64) error {
 	rows, err := q.QueryContext(ctx, `
-		SELECT json_extract(a.labels, '$.'||?)
+		SELECT a.labels ->> $1
 		FROM   incident_alerts ia
 		JOIN   alerts a ON a.id = ia.alert_id
-		WHERE  ia.incident_id = ?`, severityLabel, incidentID)
+		WHERE  ia.incident_id = $2`, severityLabel, incidentID)
 	if err != nil {
 		return err
 	}
@@ -185,9 +191,9 @@ func refreshSeverity(ctx context.Context, q querier, incidentID int64) error {
 	// The comparison lives in SQL so an unrelated concurrent update cannot be
 	// clobbered by a stale read.
 	_, err = q.ExecContext(ctx, `
-		UPDATE incidents SET severity = ?
-		 WHERE id = ?
-		   AND (severity IS NULL OR `+severityRankSQL("severity")+` < ?)`,
+		UPDATE incidents SET severity = $1
+		 WHERE id = $2
+		   AND (severity IS NULL OR `+severityRankSQL("severity")+` < $3)`,
 		best, incidentID, severityRank(best))
 	return err
 }
@@ -210,9 +216,9 @@ func resolveIfSettled(ctx context.Context, q querier, incidentID int64) (bool, e
 	res, err := q.ExecContext(ctx, `
 		UPDATE incidents
 		   SET status            = 'resolved',
-		       resolved_at       = ?,
-		       resolution_source = ?
-		 WHERE id = ?
+		       resolved_at       = $1,
+		       resolution_source = $2
+		 WHERE id = $3
 		   AND resolved_at IS NULL
 		   -- An incident with no members yet is mid-creation, not settled.
 		   AND EXISTS (SELECT 1 FROM incident_alerts ia WHERE ia.incident_id = incidents.id)
@@ -245,8 +251,8 @@ func resolveIfSettled(ctx context.Context, q querier, incidentID int64) (bool, e
 func acknowledgeIncident(ctx context.Context, q querier, incidentID, userID int64) (bool, error) {
 	res, err := q.ExecContext(ctx, `
 		UPDATE incidents
-		   SET status = 'acknowledged', acknowledged_by = ?, acknowledged_at = ?
-		 WHERE id = ? AND resolved_at IS NULL`,
+		   SET status = 'acknowledged', acknowledged_by = $1, acknowledged_at = $2
+		 WHERE id = $3 AND resolved_at IS NULL`,
 		userID, time.Now().Unix(), incidentID)
 	if err != nil {
 		return false, err
@@ -266,7 +272,7 @@ func openIncidentForAlert(ctx context.Context, q querier, alertID int64) (int64,
 		SELECT i.id
 		FROM   incident_alerts ia
 		JOIN   incidents i ON i.id = ia.incident_id
-		WHERE  ia.alert_id = ? AND i.resolved_at IS NULL`, alertID).Scan(&id)
+		WHERE  ia.alert_id = $1 AND i.resolved_at IS NULL`, alertID).Scan(&id)
 	if err == sql.ErrNoRows {
 		return 0, nil
 	}

internal/api/incidents.go

@@ -17,13 +17,21 @@ func handleListIncidents(db *sql.DB) http.HandlerFunc {
 		q := r.URL.Query()
 
 		where := []string{}
-		args := []any{}
+		args := &sqlArgs{}
+
+		// The combined queue: every team the caller belongs to, in one list. A
+		// caller in no team sees an empty queue rather than everybody's.
+		where = append(where, "i.team_id = ANY("+args.add(callerTeamIDs(r.Context()))+")")
+		if team := q.Get("team_id"); team != "" {
+			if n, err := strconv.ParseInt(team, 10, 64); err == nil {
+				where = append(where, "i.team_id = "+args.add(n))
+			}
+		}
 
 		// Without an explicit status the queue shows open work, which is what an
 		// on-call person opens the tool to see.
 		if status := q.Get("status"); status != "" {
-			where = append(where, "i.status = ?")
-			args = append(args, status)
+			where = append(where, "i.status = "+args.add(status))
 		} else {
 			where = append(where, "i.resolved_at IS NULL")
 		}
@@ -36,33 +44,27 @@ func handleListIncidents(db *sql.DB) http.HandlerFunc {
 
 		// A snooze expires by simply falling into the past; nothing sweeps it.
 		if q.Get("snoozed") == "true" {
-			where = append(where, "i.snoozed_until > ?")
-			args = append(args, time.Now().Unix())
+			where = append(where, "i.snoozed_until > "+args.add(time.Now().Unix()))
 		} else {
-			where = append(where, "(i.snoozed_until IS NULL OR i.snoozed_until <= ?)")
-			args = append(args, time.Now().Unix())
+			where = append(where, "(i.snoozed_until IS NULL OR i.snoozed_until <= "+args.add(time.Now().Unix())+")")
 		}
 
 		if severity := q.Get("severity"); severity != "" {
-			where = append(where, "i.severity = ?")
-			args = append(args, severity)
+			where = append(where, "i.severity = "+args.add(severity))
 		}
 		if assignee := q.Get("assigned_to"); assignee != "" {
 			if n, err := strconv.ParseInt(assignee, 10, 64); err == nil {
-				where = append(where, "i.assigned_to = ?")
-				args = append(args, n)
+				where = append(where, "i.assigned_to = "+args.add(n))
 			}
 		}
 		if from := q.Get("from"); from != "" {
 			if t, err := time.Parse("2006-01-02", from); err == nil {
-				where = append(where, "i.triggered_at >= ?")
-				args = append(args, t.UTC().Unix())
+				where = append(where, "i.triggered_at >= "+args.add(t.UTC().Unix()))
 			}
 		}
 		if to := q.Get("to"); to != "" {
 			if t, err := time.Parse("2006-01-02", to); err == nil {
-				where = append(where, "i.triggered_at < ?")
-				args = append(args, t.UTC().AddDate(0, 0, 1).Unix())
+				where = append(where, "i.triggered_at < "+args.add(t.UTC().AddDate(0, 0, 1).Unix()))
 			}
 		}
 
@@ -77,12 +79,11 @@ func handleListIncidents(db *sql.DB) http.HandlerFunc {
 		if q.Get("sort") == "severity" {
 			order = severityRankSQL("i.severity") + " DESC, i.triggered_at DESC"
 		}
-		args = append(args, limit)
 
 		rows, err := db.QueryContext(r.Context(),
-			fmt.Sprintf("%s WHERE %s ORDER BY %s LIMIT ?",
-				incidentSelectFrom, strings.Join(where, " AND "), order),
-			args...)
+			fmt.Sprintf("%s WHERE %s ORDER BY %s LIMIT %s",
+				incidentSelectFrom, strings.Join(where, " AND "), order, args.add(limit)),
+			args.all()...)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -104,7 +105,7 @@ func handleListIncidents(db *sql.DB) http.HandlerFunc {
 
 func handleGetIncident(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -127,7 +128,7 @@ func handleGetIncident(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentAlerts(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -145,7 +146,7 @@ func handleIncidentAlerts(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentTimeline(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -158,7 +159,7 @@ func handleIncidentTimeline(db *sql.DB) http.HandlerFunc {
 			       e.alert_id, e.detail, e.created_at
 			FROM   incident_events e
 			LEFT   JOIN users u ON u.id = e.user_id
-			WHERE  e.incident_id = ?
+			WHERE  e.incident_id = $1
 			ORDER  BY e.created_at ASC, e.id ASC`, id)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
@@ -184,7 +185,7 @@ func handleIncidentTimeline(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentAcknowledge(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -207,14 +208,14 @@ func handleIncidentAcknowledge(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentUnacknowledge(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
 		user, _ := userFromContext(r.Context())
 		if !updateOpenIncident(w, r, db, id,
 			`UPDATE incidents SET status = 'triggered', acknowledged_by = NULL, acknowledged_at = NULL
-			  WHERE id = ? AND resolved_at IS NULL`, id) {
+			  WHERE id = $1 AND resolved_at IS NULL`, id) {
 			return
 		}
 		if err := logEvent(r.Context(), db, id, evUnacknowledged, &user.ID, nil, nil); err != nil {
@@ -231,14 +232,14 @@ func handleIncidentUnacknowledge(db *sql.DB) http.HandlerFunc {
 // re-send of an alert that never stopped firing. Use snooze for "not now".
 func handleIncidentResolve(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
 		user, _ := userFromContext(r.Context())
 		if !updateOpenIncident(w, r, db, id,
-			`UPDATE incidents SET status = 'resolved', resolved_at = ?, resolution_source = ?
-			  WHERE id = ? AND resolved_at IS NULL`,
+			`UPDATE incidents SET status = 'resolved', resolved_at = $1, resolution_source = $2
+			  WHERE id = $3 AND resolved_at IS NULL`,
 			time.Now().Unix(), incidentResolutionManual, id) {
 			return
 		}
@@ -252,7 +253,7 @@ func handleIncidentResolve(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentAssign(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -269,13 +270,13 @@ func handleIncidentAssign(db *sql.DB) http.HandlerFunc {
 		}
 		var exists int
 		if err := db.QueryRowContext(r.Context(),
-			"SELECT 1 FROM users WHERE id = ?", req.UserID).Scan(&exists); err != nil {
+			"SELECT 1 FROM users WHERE id = $1", req.UserID).Scan(&exists); err != nil {
 			respond(w, http.StatusNotFound, errResp("user not found"))
 			return
 		}
 
 		if !updateOpenIncident(w, r, db, id,
-			"UPDATE incidents SET assigned_to = ? WHERE id = ? AND resolved_at IS NULL",
+			"UPDATE incidents SET assigned_to = $1 WHERE id = $2 AND resolved_at IS NULL",
 			req.UserID, id) {
 			return
 		}
@@ -293,7 +294,7 @@ func handleIncidentAssign(db *sql.DB) http.HandlerFunc {
 // {"duration": "2h"}.
 func handleIncidentSnooze(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -333,7 +334,7 @@ func handleIncidentSnooze(db *sql.DB) http.HandlerFunc {
 
 		user, _ := userFromContext(r.Context())
 		if !updateOpenIncident(w, r, db, id,
-			"UPDATE incidents SET snoozed_until = ? WHERE id = ? AND resolved_at IS NULL",
+			"UPDATE incidents SET snoozed_until = $1 WHERE id = $2 AND resolved_at IS NULL",
 			until.Unix(), id) {
 			return
 		}
@@ -348,13 +349,13 @@ func handleIncidentSnooze(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentUnsnooze(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
 		user, _ := userFromContext(r.Context())
 		if !updateOpenIncident(w, r, db, id,
-			"UPDATE incidents SET snoozed_until = NULL WHERE id = ? AND resolved_at IS NULL", id) {
+			"UPDATE incidents SET snoozed_until = NULL WHERE id = $1 AND resolved_at IS NULL", id) {
 			return
 		}
 		if err := logEvent(r.Context(), db, id, evUnsnoozed, &user.ID, nil, nil); err != nil {
@@ -367,12 +368,12 @@ func handleIncidentUnsnooze(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentArchive(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
 		res, err := db.ExecContext(r.Context(),
-			"UPDATE incidents SET archived_at = unixepoch() WHERE id = ?", id)
+			"UPDATE incidents SET archived_at = "+nowEpoch+" WHERE id = $1", id)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -387,12 +388,12 @@ func handleIncidentArchive(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentUnarchive(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
 		res, err := db.ExecContext(r.Context(),
-			"UPDATE incidents SET archived_at = NULL WHERE id = ?", id)
+			"UPDATE incidents SET archived_at = NULL WHERE id = $1", id)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -409,7 +410,7 @@ func handleIncidentUnarchive(db *sql.DB) http.HandlerFunc {
 // single query renders the whole story of an incident in order.
 func handleCreateNote(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -430,14 +431,15 @@ func handleCreateNote(db *sql.DB) http.HandlerFunc {
 
 		user, _ := userFromContext(r.Context())
 		now := time.Now()
-		res, err := db.ExecContext(r.Context(), `
+		var eventID int64
+		err := db.QueryRowContext(r.Context(), `
 			INSERT INTO incident_events (incident_id, type, user_id, detail, created_at)
-			VALUES (?, ?, ?, ?, ?)`, id, evNote, user.ID, req.Content, now.Unix())
+			VALUES ($1, $2, $3, $4, $5)
+			RETURNING id`, id, evNote, user.ID, req.Content, now.Unix()).Scan(&eventID)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
-		eventID, _ := res.LastInsertId()
 
 		respond(w, http.StatusCreated, models.IncidentEvent{
 			ID:         eventID,
@@ -455,7 +457,7 @@ func handleCreateNote(db *sql.DB) http.HandlerFunc {
 // rest of the timeline is what actually happened, and is not editable.
 func handleDeleteNote(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -468,7 +470,7 @@ func handleDeleteNote(db *sql.DB) http.HandlerFunc {
 		user, _ := userFromContext(r.Context())
 		res, err := db.ExecContext(r.Context(), `
 			DELETE FROM incident_events
-			 WHERE id = ? AND incident_id = ? AND type = ? AND user_id = ?`,
+			 WHERE id = $1 AND incident_id = $2 AND type = $3 AND user_id = $4`,
 			eventID, id, evNote, user.ID)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
@@ -486,19 +488,32 @@ func handleDeleteNote(db *sql.DB) http.HandlerFunc {
 // Shared handler plumbing
 // ---------------------------------------------------------------------------
 
-func incidentIDParam(w http.ResponseWriter, r *http.Request) (int64, bool) {
+// incidentIDParam reads {id} from the path AND confirms the incident belongs to
+// a team the caller is in. Both in one place, deliberately: every incident route
+// goes through here, so scoping cannot be forgotten by writing a new handler
+// that only remembers the first half.
+//
+// An incident in somebody else's team is reported as not found rather than
+// forbidden, because "there is an incident 41 you may not see" is itself
+// something only that team should know.
+func incidentIDParam(w http.ResponseWriter, r *http.Request, db *sql.DB) (int64, bool) {
 	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	if err != nil {
 		respond(w, http.StatusBadRequest, errResp("invalid incident id"))
 		return 0, false
 	}
+	if !incidentExists(w, r, db, id) {
+		return 0, false
+	}
 	return id, true
 }
 
+// incidentExists reports whether the incident is one the caller may see at all.
 func incidentExists(w http.ResponseWriter, r *http.Request, db *sql.DB, id int64) bool {
 	var exists int
 	if err := db.QueryRowContext(r.Context(),
-		"SELECT 1 FROM incidents WHERE id = ?", id).Scan(&exists); err != nil {
+		"SELECT 1 FROM incidents WHERE id = $1 AND team_id = ANY($2)",
+		id, callerTeamIDs(r.Context())).Scan(&exists); err != nil {
 		respond(w, http.StatusNotFound, errResp("incident not found"))
 		return false
 	}
@@ -538,7 +553,7 @@ func respondIncident(w http.ResponseWriter, r *http.Request, db *sql.DB, id int6
 func incidentAlerts(r *http.Request, db *sql.DB, id int64) ([]models.Alert, error) {
 	rows, err := db.QueryContext(r.Context(), alertSelectFrom+`
 		JOIN incident_alerts m ON m.alert_id = a.id
-		WHERE m.incident_id = ?
+		WHERE m.incident_id = $1
 		ORDER BY a.received_at DESC`, id)
 	if err != nil {
 		return nil, err

internal/api/incidents_test.go

@@ -4,14 +4,10 @@ import (
 	"context"
 	"fmt"
 	"net/http"
-	"os"
-	"path/filepath"
-	"sort"
 	"testing"
 	"time"
 
 	"git.ryuvia.com/niklas/terdut-server/internal/api"
-	"git.ryuvia.com/niklas/terdut-server/internal/db"
 )
 
 // amAlert builds one alert of a webhook payload.
@@ -288,7 +284,7 @@ func TestExpiry_CascadesToIncidentResolution(t *testing.T) {
 	s := newTS(t)
 	postAlert(t, s, "fp-exp", "firing", time.Now().Add(-24*time.Hour).Format(time.RFC3339), zeroTime)
 
-	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'fp-exp'",
+	s.exec(t, "UPDATE alerts SET received_at = $1 WHERE fingerprint = 'fp-exp'",
 		time.Now().Add(-10*time.Hour).Unix())
 	sweep(t, s, 6*time.Hour)
 
@@ -429,7 +425,7 @@ func TestIncident_AutoAssignedToCurrentOnCall(t *testing.T) {
 	s := newTS(t)
 
 	today := time.Now().UTC().Format("2006-01-02")
-	resp := s.req(t, http.MethodPost, "/api/schedule",
+	resp := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": 1, "dates": []string{today}})
 	if resp.StatusCode != http.StatusCreated {
 		t.Fatalf("schedule assignment returned %d", resp.StatusCode)
@@ -611,9 +607,9 @@ func TestSweeper_ArchivesResolvedIncidents(t *testing.T) {
 	})
 	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
 
-	s.exec(t, "UPDATE incidents SET resolved_at = ? WHERE id = 1",
+	s.exec(t, "UPDATE incidents SET resolved_at = $1 WHERE id = 1",
 		time.Now().Add(-30*24*time.Hour).Unix())
-	api.Sweep(context.Background(), s.db, 7*24*time.Hour, 6*time.Hour, s.deadman, s.notify)
+	api.Sweep(context.Background(), s.db, 7*24*time.Hour, 6*time.Hour, s.notify)
 
 	if inc := getIncident(t, s, 1); inc["archived_at"] == nil {
 		t.Error("expected the sweeper to archive a long-resolved incident")
@@ -654,8 +650,9 @@ func TestStats_Incidents(t *testing.T) {
 }
 
 // An empty window is a report of zero, not a failure. SUM over no rows is NULL
-// in SQLite, which used to come back as a 500 the moment every incident was
-// archived — the state a quiet installation settles into.
+// in Postgres as it was in SQLite, and that used to come back as a 500 the
+// moment every incident was archived — the state a quiet installation settles
+// into.
 func TestStats_IncidentsEmptyWindowIsZeroNotAnError(t *testing.T) {
 	s := newTS(t)
 
@@ -722,101 +719,6 @@ func TestStats_IncidentsNullMTTAWhenNothingAcknowledged(t *testing.T) {
 	}
 }
 
-// ---------------------------------------------------------------------------
-// Migration backfill
-// ---------------------------------------------------------------------------
-
-// An upgrade must not drop the acknowledgements and comments people already
-// have, so 008 is replayed here over a database left at 007.
-func TestMigration_BackfillCarriesAckAndComments(t *testing.T) {
-	database, err := db.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	t.Cleanup(func() { database.Close() })
-
-	files, err := filepath.Glob("../db/migrations/*.sql")
-	if err != nil || len(files) == 0 {
-		t.Fatalf("find migrations: %v", err)
-	}
-	sort.Strings(files)
-
-	var incidentsMigration string
-	for _, f := range files {
-		if filepath.Base(f) >= "008" {
-			incidentsMigration = f
-			break
-		}
-		data, err := os.ReadFile(f)
-		if err != nil {
-			t.Fatalf("read %s: %v", f, err)
-		}
-		if _, err := database.Exec(string(data)); err != nil {
-			t.Fatalf("apply %s: %v", f, err)
-		}
-	}
-	if incidentsMigration == "" {
-		t.Fatal("008 migration not found")
-	}
-
-	// A database as it would look on the old schema: an acknowledged firing
-	// alert with a comment on it.
-	if _, err := database.Exec(`
-		INSERT INTO users (id, username, email) VALUES (1, 'admin', 'admin@test.com');
-		INSERT INTO alerts (id, fingerprint, name, status, labels, annotations,
-		                    starts_at, received_at, acknowledged_by, acknowledged_at)
-		VALUES (1, 'legacy-fp', 'LegacyAlert', 'firing',
-		        '{"severity":"warning"}', '{}', 1000, 1000, 1, 1500);
-		INSERT INTO alert_comments (alert_id, user_id, content, created_at)
-		VALUES (1, 1, 'legacy comment', 1600);`); err != nil {
-		t.Fatalf("seed pre-008 data: %v", err)
-	}
-
-	data, err := os.ReadFile(incidentsMigration)
-	if err != nil {
-		t.Fatalf("read 008: %v", err)
-	}
-	if _, err := database.Exec(string(data)); err != nil {
-		t.Fatalf("apply 008: %v", err)
-	}
-
-	var status, groupKey string
-	var ackBy int64
-	var severity string
-	if err := database.QueryRow(
-		"SELECT status, group_key, acknowledged_by, severity FROM incidents WHERE id = 1",
-	).Scan(&status, &groupKey, &ackBy, &severity); err != nil {
-		t.Fatalf("read backfilled incident: %v", err)
-	}
-	if status != "acknowledged" {
-		t.Errorf("expected the ack to carry over as status, got %q", status)
-	}
-	if groupKey != "backfill:legacy-fp" {
-		t.Errorf("unexpected group_key %q", groupKey)
-	}
-	if ackBy != 1 {
-		t.Errorf("expected acknowledged_by 1, got %d", ackBy)
-	}
-	if severity != "warning" {
-		t.Errorf("expected severity carried from labels, got %q", severity)
-	}
-
-	var notes int
-	if err := database.QueryRow(
-		"SELECT COUNT(*) FROM incident_events WHERE type = 'note' AND detail = 'legacy comment'",
-	).Scan(&notes); err != nil {
-		t.Fatalf("count notes: %v", err)
-	}
-	if notes != 1 {
-		t.Errorf("expected the comment to become a note, got %d", notes)
-	}
-
-	// And the columns that caused the ack-survives-a-re-fire bug are gone.
-	if _, err := database.Exec("SELECT acknowledged_by FROM alerts"); err == nil {
-		t.Error("expected alerts.acknowledged_by to be dropped")
-	}
-}
-
 func contains(haystack []string, needle string) bool {
 	for _, s := range haystack {
 		if s == needle {

internal/api/middleware.go

@@ -17,6 +17,7 @@ type contextKey string
 const (
 	ctxUser    contextKey = "user"
 	ctxSession contextKey = "session"
+	ctxTeams   contextKey = "teams"
 )
 
 // AuthMiddleware accepts either of the two credentials the server issues: an
@@ -66,11 +67,44 @@ func AuthMiddleware(db *sql.DB) func(http.Handler) http.Handler {
 	}
 }
 
+// AdminOnly rejects a caller who is not a system administrator. It runs inside
+// AuthMiddleware's group, so by the time it sees a request the caller is known.
+//
+// 403 and not 404: the route exists and the caller is authenticated, they are
+// simply not allowed. Hiding the endpoint would buy nothing — every one of them
+// is in the README.
+func AdminOnly(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		caller, ok := userFromContext(r.Context())
+		if !ok || !caller.IsAdmin {
+			respond(w, http.StatusForbidden, errResp("administrator access required"))
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// requireSelfOrAdmin guards the endpoints that are self-service for your own
+// account and administration for anybody else's: your password, your ntfy
+// topic, your API keys. Reports whether the request may proceed, and answers it
+// if not.
+//
+// An API key is not an escalation: it carries exactly the rights of the user it
+// belongs to, so minting your own is no more than signing in again.
+func requireSelfOrAdmin(w http.ResponseWriter, r *http.Request, targetID int64) bool {
+	caller, ok := userFromContext(r.Context())
+	if !ok || (caller.ID != targetID && !caller.IsAdmin) {
+		respond(w, http.StatusForbidden, errResp("administrator access required"))
+		return false
+	}
+	return true
+}
+
 // apiKeyUser resolves an API key to its user and stamps its last use.
 func apiKeyUser(ctx context.Context, db *sql.DB, token string) (int64, bool) {
 	var keyID, userID int64
 	err := db.QueryRowContext(ctx,
-		"SELECT id, user_id FROM api_keys WHERE key_hash = ?", hashToken(token),
+		"SELECT id, user_id FROM api_keys WHERE key_hash = $1", hashToken(token),
 	).Scan(&keyID, &userID)
 	if err != nil {
 		return 0, false
@@ -78,7 +112,7 @@ func apiKeyUser(ctx context.Context, db *sql.DB, token string) (int64, bool) {
 
 	// best-effort; don't fail the request if this update fails
 	db.ExecContext(ctx,
-		"UPDATE api_keys SET last_used_at = ? WHERE id = ?",
+		"UPDATE api_keys SET last_used_at = $1 WHERE id = $2",
 		time.Now().Unix(), keyID)
 	return userID, true
 }
@@ -91,7 +125,7 @@ func sessionUser(ctx context.Context, db *sql.DB, token string) (sessionID, user
 	var lastSeen int64
 	err := db.QueryRowContext(ctx, `
 		SELECT id, user_id, last_seen_at FROM sessions
-		 WHERE token_hash = ? AND expires_at > ?`,
+		 WHERE token_hash = $1 AND expires_at > $2`,
 		hashToken(token), now.Unix()).Scan(&sessionID, &userID, &lastSeen)
 	if err != nil {
 		return 0, 0, false
@@ -99,7 +133,7 @@ func sessionUser(ctx context.Context, db *sql.DB, token string) (sessionID, user
 
 	if now.Sub(time.Unix(lastSeen, 0)) > sessionTouchEvery {
 		db.ExecContext(ctx,
-			"UPDATE sessions SET last_seen_at = ?, expires_at = ? WHERE id = ?",
+			"UPDATE sessions SET last_seen_at = $1, expires_at = $2 WHERE id = $3",
 			now.Unix(), now.Add(sessionTTL).Unix(), sessionID)
 	}
 	return sessionID, userID, true
@@ -111,14 +145,24 @@ func serveAs(w http.ResponseWriter, r *http.Request, next http.Handler, db *sql.
 	var u models.User
 	var createdUnix int64
 	if err := db.QueryRowContext(r.Context(),
-		"SELECT id, username, email, created_at FROM users WHERE id = ?", userID,
-	).Scan(&u.ID, &u.Username, &u.Email, &createdUnix); err != nil {
+		"SELECT id, username, email, created_at, is_admin FROM users WHERE id = $1", userID,
+	).Scan(&u.ID, &u.Username, &u.Email, &createdUnix, &u.IsAdmin); err != nil {
 		respond(w, http.StatusUnauthorized, errResp("unauthorized"))
 		return
 	}
 	u.CreatedAt = time.Unix(createdUnix, 0).UTC()
 
-	ctx := context.WithValue(r.Context(), ctxUser, u)
+	// Every scoped query needs the caller's teams, so they are loaded once here
+	// rather than per handler. One extra round trip per request, against a
+	// table with one row per membership.
+	teams, err := callerMemberships(r.Context(), db, userID)
+	if err != nil {
+		respond(w, http.StatusInternalServerError, errResp("internal error"))
+		return
+	}
+
+	ctx := context.WithValue(r.Context(), ctxTeams, teams)
+	ctx = context.WithValue(ctx, ctxUser, u)
 	if sessionID != 0 {
 		ctx = context.WithValue(ctx, ctxSession, sessionID)
 	}
@@ -135,6 +179,90 @@ func userFromContext(ctx context.Context) (models.User, bool) {
 	return u, ok
 }
 
+// membership is the caller's role in one team.
+type membership struct {
+	teamID int64
+	role   string
+}
+
+func callerMemberships(ctx context.Context, db *sql.DB, userID int64) ([]membership, error) {
+	rows, err := db.QueryContext(ctx,
+		"SELECT team_id, role FROM team_members WHERE user_id = $1 ORDER BY team_id", userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []membership
+	for rows.Next() {
+		var m membership
+		if err := rows.Scan(&m.teamID, &m.role); err != nil {
+			return nil, err
+		}
+		out = append(out, m)
+	}
+	return out, rows.Err()
+}
+
+// callerTeamIDs lists the teams the caller belongs to, for the `team_id = ANY`
+// filter every list query carries. An admin is NOT implicitly in every team:
+// administration is about accounts, not about reading other people's incidents,
+// and an admin who needs to see a team's queue can add themselves to it.
+func callerTeamIDs(ctx context.Context) []int64 {
+	ms, _ := ctx.Value(ctxTeams).([]membership)
+	ids := make([]int64, 0, len(ms))
+	for _, m := range ms {
+		ids = append(ids, m.teamID)
+	}
+	return ids
+}
+
+// callerRole reports the caller's role in one team, and whether they are in it
+// at all.
+func callerRole(ctx context.Context, teamID int64) (string, bool) {
+	ms, _ := ctx.Value(ctxTeams).([]membership)
+	for _, m := range ms {
+		if m.teamID == teamID {
+			return m.role, true
+		}
+	}
+	return "", false
+}
+
+// requireTeamMember answers the request and reports false unless the caller
+// belongs to teamID.
+//
+// 404, not 403: whether a team exists is itself something only its members
+// should learn, and the same reasoning applies to every incident and alert
+// under it.
+func requireTeamMember(w http.ResponseWriter, r *http.Request, teamID int64) bool {
+	if _, ok := callerRole(r.Context(), teamID); !ok {
+		respond(w, http.StatusNotFound, errResp("not found"))
+		return false
+	}
+	return true
+}
+
+// requireTeamOwner is requireTeamMember for the things only an owner may change:
+// the schedule, the integrations and who is in the team. A system administrator
+// passes without being a member, because somebody has to be able to repair a
+// team whose owner has left.
+func requireTeamOwner(w http.ResponseWriter, r *http.Request, teamID int64) bool {
+	role, ok := callerRole(r.Context(), teamID)
+	if ok && role == models.RoleOwner {
+		return true
+	}
+	if caller, _ := userFromContext(r.Context()); caller.IsAdmin {
+		return true
+	}
+	if !ok {
+		respond(w, http.StatusNotFound, errResp("not found"))
+		return false
+	}
+	respond(w, http.StatusForbidden, errResp("team owner access required"))
+	return false
+}
+
 // sessionFromContext returns the id of the session a request was authenticated
 // with, or false for an API-key request.
 func sessionFromContext(ctx context.Context) (int64, bool) {

internal/api/notifier.go

@@ -151,19 +151,20 @@ func enqueueReminders(ctx context.Context, db *sql.DB, cfg NotifyConfig) {
 		JOIN   incidents i ON i.id = n.incident_id
 		WHERE  n.id = (SELECT MAX(id) FROM notifications WHERE incident_id = n.incident_id)
 		  AND  n.sent_at IS NOT NULL
-		  AND  n.created_at <= ?
+		  AND  n.created_at <= $1
 		  AND  i.resolved_at IS NULL
 		  AND  i.archived_at IS NULL
 		  AND  i.status = 'triggered'
-		  AND  (i.snoozed_until IS NULL OR i.snoozed_until <= ?)`,
+		  AND  (i.snoozed_until IS NULL OR i.snoozed_until <= $2)`,
 		now.Add(-cfg.RepeatEvery).Unix(), now.Unix())
 	if err != nil {
 		log.Printf("notifier: find reminders: %v", err)
 		return
 	}
 
-	// Collected before inserting: the pool is limited to a single connection, so
-	// an open cursor would block the writes behind it.
+	// Collected before inserting, rather than written while walking the cursor:
+	// the inserts below are what this query selects on, and a cursor reading its
+	// own writes is a hazard whatever the pool size.
 	var pending []due
 	for rows.Next() {
 		var d due
@@ -217,7 +218,7 @@ func deliverPending(ctx context.Context, db *sql.DB, cfg NotifyConfig) {
 			continue
 		}
 		if _, err := db.ExecContext(ctx,
-			"UPDATE notifications SET sent_at = ?, attempts = attempts + 1, last_error = NULL WHERE id = ?",
+			"UPDATE notifications SET sent_at = $1, attempts = attempts + 1, last_error = NULL WHERE id = $2",
 			time.Now().Unix(), n.id); err != nil {
 			log.Printf("notifier: mark sent %d: %v", n.id, err)
 		}
@@ -240,10 +241,10 @@ func pendingNotifications(ctx context.Context, db *sql.DB) ([]outboxRow, error)
 		SELECT id, incident_id, user_id, topic, kind, attempts
 		FROM   notifications
 		WHERE  sent_at IS NULL
-		  AND  send_after <= ?
-		  AND  attempts < ?
+		  AND  send_after <= $1
+		  AND  attempts < $2
 		ORDER  BY id
-		LIMIT  ?`, time.Now().Unix(), notifyMaxAttempts, notifyBatch)
+		LIMIT  $3`, time.Now().Unix(), notifyMaxAttempts, notifyBatch)
 	if err != nil {
 		return nil, err
 	}
@@ -269,7 +270,7 @@ func pendingNotifications(ctx context.Context, db *sql.DB) ([]outboxRow, error)
 func markFailed(ctx context.Context, db *sql.DB, n outboxRow, cause error) {
 	next := time.Now().Add(retryDelay(n.attempts)).Unix()
 	if _, err := db.ExecContext(ctx,
-		"UPDATE notifications SET attempts = attempts + 1, send_after = ?, last_error = ? WHERE id = ?",
+		"UPDATE notifications SET attempts = attempts + 1, send_after = $1, last_error = $2 WHERE id = $3",
 		next, cause.Error(), n.id); err != nil {
 		log.Printf("notifier: mark failed %d: %v", n.id, err)
 	}
@@ -307,7 +308,7 @@ func deliver(ctx context.Context, db *sql.DB, cfg NotifyConfig, n outboxRow) err
 		SELECT COUNT(*)
 		FROM   incident_alerts ia
 		JOIN   alerts a ON a.id = ia.alert_id
-		WHERE  ia.incident_id = ? AND a.status = 'firing'`, n.incidentID).Scan(&firing); err != nil {
+		WHERE  ia.incident_id = $1 AND a.status = 'firing'`, n.incidentID).Scan(&firing); err != nil {
 		return fmt.Errorf("count firing: %w", err)
 	}
 
@@ -475,7 +476,7 @@ func enqueueNotification(ctx context.Context, q querier, incidentID int64, userI
 	now := time.Now().Unix()
 	_, err := q.ExecContext(ctx, `
 		INSERT INTO notifications (incident_id, user_id, topic, kind, created_at, send_after)
-		VALUES (?, ?, ?, ?, ?, ?)`, incidentID, userID, topic, kind, now, now)
+		VALUES ($1, $2, $3, $4, $5, $6)`, incidentID, userID, topic, kind, now, now)
 	return err
 }
 
@@ -489,7 +490,7 @@ func notifyTarget(ctx context.Context, q querier, cfg NotifyConfig, onCall *int6
 	if onCall != nil {
 		var t *string
 		err := q.QueryRowContext(ctx,
-			"SELECT ntfy_topic FROM users WHERE id = ?", *onCall).Scan(&t)
+			"SELECT ntfy_topic FROM users WHERE id = $1", *onCall).Scan(&t)
 		if err == nil && t != nil && *t != "" {
 			return *t, onCall
 		}
@@ -522,7 +523,7 @@ func enqueueResolved(ctx context.Context, q querier, incidentID int64) error {
 	var userID *int64
 	err := q.QueryRowContext(ctx, `
 		SELECT topic, user_id FROM notifications
-		 WHERE incident_id = ? ORDER BY id DESC LIMIT 1`, incidentID).Scan(&topic, &userID)
+		 WHERE incident_id = $1 ORDER BY id DESC LIMIT 1`, incidentID).Scan(&topic, &userID)
 	if err == sql.ErrNoRows {
 		return nil
 	}

internal/api/notify_ack.go

@@ -28,7 +28,7 @@ func issueAckToken(ctx context.Context, q querier, incidentID, userID int64) (st
 	now := time.Now()
 	if _, err := q.ExecContext(ctx, `
 		INSERT INTO incident_ack_tokens (token_hash, incident_id, user_id, created_at, expires_at)
-		VALUES (?, ?, ?, ?, ?)`,
+		VALUES ($1, $2, $3, $4, $5)`,
 		hash, incidentID, userID, now.Unix(), now.Add(ackTokenTTL).Unix()); err != nil {
 		return "", err
 	}
@@ -51,7 +51,7 @@ func handleNotifyAck(db *sql.DB) http.HandlerFunc {
 		var incidentID, userID int64
 		err := db.QueryRowContext(r.Context(), `
 			SELECT incident_id, user_id FROM incident_ack_tokens
-			 WHERE token_hash = ? AND expires_at > ?`,
+			 WHERE token_hash = $1 AND expires_at > $2`,
 			hash, time.Now().Unix()).Scan(&incidentID, &userID)
 		if err != nil {
 			// Unknown and expired get the same answer, so the endpoint cannot be
@@ -87,7 +87,7 @@ func handleNotifyAck(db *sql.DB) http.HandlerFunc {
 // fires in practice.
 func purgeAckTokens(ctx context.Context, db *sql.DB) {
 	res, err := db.ExecContext(ctx,
-		"DELETE FROM incident_ack_tokens WHERE expires_at < ?", time.Now().Unix())
+		"DELETE FROM incident_ack_tokens WHERE expires_at < $1", time.Now().Unix())
 	if err != nil {
 		log.Printf("sweeper: purge ack tokens: %v", err)
 		return

internal/api/notify_test.go

@@ -95,7 +95,7 @@ func notifyTS(t *testing.T, cfg api.NotifyConfig) (*ts, *fakeNtfy) {
 func putOnCall(t *testing.T, s *ts, userID int) {
 	t.Helper()
 	today := time.Now().UTC().Format("2006-01-02")
-	resp := s.req(t, http.MethodPost, "/api/schedule",
+	resp := s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/schedule",
 		map[string]any{"user_id": userID, "dates": []string{today}})
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusCreated {
@@ -125,7 +125,7 @@ func (s *ts) countNotifications(t *testing.T, kind string) int {
 	query := "SELECT COUNT(*) FROM notifications"
 	args := []any{}
 	if kind != "" {
-		query += " WHERE kind = ?"
+		query += " WHERE kind = $1"
 		args = append(args, kind)
 	}
 	if err := s.db.QueryRow(query, args...).Scan(&n); err != nil {
@@ -326,7 +326,7 @@ func TestNotify_ExhaustedRetriesAreRecordedOnce(t *testing.T) {
 	// One pass per attempt, each made due by clearing the backoff the last one set.
 	for i := 0; i < 10; i++ {
 		s.sweepNotify(t)
-		s.exec(t, "UPDATE notifications SET send_after = ? WHERE sent_at IS NULL",
+		s.exec(t, "UPDATE notifications SET send_after = $1 WHERE sent_at IS NULL",
 			time.Now().Add(-time.Second).Unix())
 	}
 
@@ -415,7 +415,7 @@ func TestNotify_AckRejectsExpiredToken(t *testing.T) {
 
 	// Age the token past its TTL. The token's inputs are wall-clock timestamps,
 	// so this is the same trick the sweeper tests use.
-	s.exec(t, "UPDATE incident_ack_tokens SET expires_at = ?", time.Now().Add(-time.Minute).Unix())
+	s.exec(t, "UPDATE incident_ack_tokens SET expires_at = $1", time.Now().Add(-time.Minute).Unix())
 
 	resp, err := http.Post(s.URL+path, "application/json", nil)
 	if err != nil {
@@ -436,9 +436,9 @@ func TestNotify_SweepPurgesExpiredAckTokens(t *testing.T) {
 
 	fireCritical(t, s)
 	s.sweepNotify(t)
-	s.exec(t, "UPDATE incident_ack_tokens SET expires_at = ?", time.Now().Add(-time.Minute).Unix())
+	s.exec(t, "UPDATE incident_ack_tokens SET expires_at = $1", time.Now().Add(-time.Minute).Unix())
 
-	api.Sweep(context.Background(), s.db, 168*time.Hour, 6*time.Hour, s.deadman, s.notify)
+	api.Sweep(context.Background(), s.db, 168*time.Hour, 6*time.Hour, s.notify)
 
 	var n int
 	if err := s.db.QueryRow("SELECT COUNT(*) FROM incident_ack_tokens").Scan(&n); err != nil {
@@ -457,7 +457,7 @@ func TestNotify_SweepPurgesExpiredAckTokens(t *testing.T) {
 // reminder as due.
 func (s *ts) ageNotifications(t *testing.T, by time.Duration) {
 	t.Helper()
-	s.exec(t, "UPDATE notifications SET created_at = ? WHERE sent_at IS NOT NULL",
+	s.exec(t, "UPDATE notifications SET created_at = $1 WHERE sent_at IS NOT NULL",
 		time.Now().Add(-by).Unix())
 }
 
@@ -693,7 +693,7 @@ func TestNotify_FailedDeliveryRetriesWithBackoff(t *testing.T) {
 
 	// Once due and once ntfy recovers, it goes out.
 	f.failWith(http.StatusOK)
-	s.exec(t, "UPDATE notifications SET send_after = ? WHERE id = 1", time.Now().Add(-time.Second).Unix())
+	s.exec(t, "UPDATE notifications SET send_after = $1 WHERE id = 1", time.Now().Add(-time.Second).Unix())
 	s.sweepNotify(t)
 
 	if err := s.db.QueryRow("SELECT sent_at FROM notifications WHERE id = 1").Scan(&sentAt); err != nil {
@@ -715,7 +715,7 @@ func TestNotify_UnsentNotificationBlocksReminders(t *testing.T) {
 
 	fireCritical(t, s)
 	s.sweepNotify(t)
-	s.exec(t, "UPDATE notifications SET created_at = ?", time.Now().Add(-time.Hour).Unix())
+	s.exec(t, "UPDATE notifications SET created_at = $1", time.Now().Add(-time.Hour).Unix())
 	s.sweepNotify(t)
 
 	if got := s.countNotifications(t, "reminder"); got != 0 {

internal/api/router.go

@@ -9,11 +9,11 @@ import (
 	"github.com/go-chi/chi/v5/middleware"
 )
 
-// NewRouter builds the HTTP surface. notify and deadman are passed through to
-// the webhook, the only handler that has to decide where a new incident's page
-// goes and which arriving alerts are heartbeats rather than problems. A zero
-// notify disables notifications; a zero deadman disables dead man's switches.
-func NewRouter(db *sql.DB, notify NotifyConfig, deadman DeadmanConfig) http.Handler {
+// NewRouter builds the HTTP surface. notify is passed through to the webhook,
+// the only handler that has to decide where a new incident's page goes; a zero
+// notify disables notifications. Dead man's switches are per team and read from
+// the database, so nothing about them is wired in here.
+func NewRouter(db *sql.DB, notify NotifyConfig) http.Handler {
 	r := chi.NewRouter()
 	r.Use(middleware.Logger)
 	r.Use(middleware.Recoverer)
@@ -27,9 +27,18 @@ func NewRouter(db *sql.DB, notify NotifyConfig, deadman DeadmanConfig) http.Hand
 	// the scoped token in its path rather than an API key, and has to stay
 	// reachable from outside the cluster for the button to work.
 	r.Post("/api/bootstrap", handleBootstrap(db))
-	r.Post("/api/alertmanager/webhook", handleAlertmanagerWebhook(db, notify, deadman))
 	r.Post("/api/notify/ack/{token}", handleNotifyAck(db))
 
+	// Alert ingestion. The key in the path says both that the sender may post
+	// and which team the alerts belong to, which is why it needs no session.
+	r.Post("/api/integrations/{key}/alertmanager", handleIntegrationWebhook(db, notify))
+
+	// DEPRECATED, and unauthenticated: anything that can reach the port can
+	// open an incident here. Kept for one release so an upgrade does not stop
+	// delivering while the Alertmanager config is edited; it routes everything
+	// to the oldest team. Remove it once senders carry a key.
+	r.Post("/api/alertmanager/webhook", handleLegacyWebhook(db, notify))
+
 	// Signing in to the web UI. Login trades a password for a session cookie,
 	// which AuthMiddleware accepts in place of an API key.
 	r.Post("/api/login", handleLogin(db, newLoginLimiter(), notify.PublicURL))
@@ -40,14 +49,30 @@ func NewRouter(db *sql.DB, notify NotifyConfig, deadman DeadmanConfig) http.Hand
 		r.Use(AuthMiddleware(db))
 
 		r.Get("/api/me", handleMe(db))
+
+		// Readable by anyone signed in: the queue's assignment control and the
+		// on-call schedule both need to name people.
 		r.Get("/api/users", handleListUsers(db))
-		r.Post("/api/users", handleCreateUser(db))
-		r.Delete("/api/users/{id}", handleDeleteUser(db))
+
+		// Your own account, or anybody's if you are an admin. The handlers call
+		// requireSelfOrAdmin rather than sitting behind AdminOnly, because
+		// which rule applies depends on the {id} in the path.
 		r.Put("/api/users/{id}/notify", handleSetNotifyTarget(db))
 		r.Put("/api/users/{id}/password", handleSetPassword(db))
 		r.Post("/api/users/{id}/api-keys", handleCreateAPIKey(db))
 		r.Delete("/api/users/{id}/api-keys/{keyID}", handleDeleteAPIKey(db))
 
+		// Administration: who exists, and who is an administrator. Until #3
+		// these were open to any authenticated caller, which meant every user
+		// could delete every other one.
+		r.Group(func(r chi.Router) {
+			r.Use(AdminOnly)
+
+			r.Post("/api/users", handleCreateUser(db))
+			r.Delete("/api/users/{id}", handleDeleteUser(db))
+			r.Put("/api/users/{id}/admin", handleSetAdmin(db))
+		})
+
 		// Alerts are read-only: they are Alertmanager's record, not a work
 		// queue. Everything a person does happens on the incident instead.
 		r.Get("/api/alerts", handleListAlerts(db))
@@ -68,10 +93,31 @@ func NewRouter(db *sql.DB, notify NotifyConfig, deadman DeadmanConfig) http.Hand
 		r.Post("/api/incidents/{id}/notes", handleCreateNote(db))
 		r.Delete("/api/incidents/{id}/notes/{eventID}", handleDeleteNote(db))
 
-		r.Post("/api/schedule", handleCreateSchedule(db))
-		r.Get("/api/schedule/current", handleCurrentSchedule(db)) // must be before /{id}
-		r.Get("/api/schedule", handleListSchedule(db))
-		r.Delete("/api/schedule/{id}", handleDeleteSchedule(db))
+		// Teams. A user sees the teams they belong to; an owner configures one.
+		r.Get("/api/teams", handleListTeams(db))
+		r.Post("/api/teams", handleCreateTeam(db))
+		r.Delete("/api/teams/{teamID}", handleDeleteTeam(db))
+		r.Get("/api/teams/{teamID}/members", handleListTeamMembers(db))
+		r.Post("/api/teams/{teamID}/members", handleAddTeamMember(db))
+		r.Delete("/api/teams/{teamID}/members/{userID}", handleRemoveTeamMember(db))
+
+		// A team's own dead man's switches: which of its alerts are heartbeats,
+		// and how long a silence has to last before somebody is paged.
+		r.Get("/api/teams/{teamID}/deadman", handleGetTeamDeadman(db))
+		r.Put("/api/teams/{teamID}/deadman", handleSetTeamDeadman(db))
+
+		// Integrations: where a team's alerts come in, and the key that says so.
+		r.Get("/api/teams/{teamID}/integrations", handleListIntegrations(db))
+		r.Post("/api/teams/{teamID}/integrations", handleCreateIntegration(db, notify.PublicURL))
+		r.Delete("/api/teams/{teamID}/integrations/{integrationID}", handleDeleteIntegration(db))
+
+		// The rota is per team. /api/schedule/current is the exception: it
+		// answers across every team the caller is in, which is what somebody on
+		// two rotas wants to see.
+		r.Get("/api/schedule/current", handleCurrentSchedule(db))
+		r.Post("/api/teams/{teamID}/schedule", handleCreateSchedule(db))
+		r.Get("/api/teams/{teamID}/schedule", handleListSchedule(db))
+		r.Delete("/api/teams/{teamID}/schedule/{id}", handleDeleteSchedule(db))
 
 		r.Get("/api/stats/incidents", handleStatsIncidents(db))
 		r.Get("/api/stats/alerts", handleStatsAlerts(db))

internal/api/schedule.go

@@ -12,8 +12,18 @@ import (
 	"github.com/go-chi/chi/v5"
 )
 
+// The schedule is per team: each team keeps its own rota, so two teams can have
+// two different people on call on the same day. Editing it is an owner's job,
+// like the rest of a team's configuration; reading it is any member's.
 func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
 		var req struct {
 			UserID int64    `json:"user_id"`
 			Dates  []string `json:"dates"`
@@ -43,10 +53,13 @@ func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 			}
 		}
 
-		// Verify the user exists.
+		// The person taking the shift has to be in the team: paging somebody
+		// who cannot open the incident is worse than paging nobody.
 		var exists int
-		if err := db.QueryRowContext(r.Context(), "SELECT 1 FROM users WHERE id = ?", req.UserID).Scan(&exists); err != nil {
-			respond(w, http.StatusNotFound, errResp("user not found"))
+		if err := db.QueryRowContext(r.Context(),
+			"SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2",
+			teamID, req.UserID).Scan(&exists); err != nil {
+			respond(w, http.StatusNotFound, errResp("user is not a member of this team"))
 			return
 		}
 
@@ -64,14 +77,16 @@ func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 		for _, d := range req.Dates {
 			if req.Replace {
 				if _, err := tx.ExecContext(r.Context(),
-					"DELETE FROM schedule_entries WHERE date = ?", d); err != nil {
+					"DELETE FROM schedule_entries WHERE team_id = $1 AND date = $2",
+					teamID, d); err != nil {
 					respond(w, http.StatusInternalServerError, errResp("internal error"))
 					return
 				}
 			}
 			if _, err := tx.ExecContext(r.Context(),
-				"INSERT INTO schedule_entries (user_id, date) VALUES (?, ?)", req.UserID, d); err != nil {
-				if strings.Contains(err.Error(), "UNIQUE constraint failed") {
+				"INSERT INTO schedule_entries (team_id, user_id, date) VALUES ($1, $2, $3)",
+				teamID, req.UserID, d); err != nil {
+				if isUniqueViolation(err) {
 					respond(w, http.StatusConflict,
 						errResp("date already assigned: "+d+" (pass replace to take it)"))
 					return
@@ -90,7 +105,7 @@ func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 		for _, d := range req.Dates {
 			dateSet[d] = true
 		}
-		all, err := scheduleRange(r.Context(), db, req.Dates[0], req.Dates[len(req.Dates)-1])
+		all, err := scheduleRange(r.Context(), db, teamID, req.Dates[0], req.Dates[len(req.Dates)-1])
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -107,6 +122,13 @@ func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 
 func handleListSchedule(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamMember(w, r, teamID) {
+			return
+		}
 		q := r.URL.Query()
 		from, to := q.Get("from"), q.Get("to")
 
@@ -123,7 +145,7 @@ func handleListSchedule(db *sql.DB) http.HandlerFunc {
 			}
 		}
 
-		entries, err := scheduleRange(r.Context(), db, from, to)
+		entries, err := scheduleRange(r.Context(), db, teamID, from, to)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -134,12 +156,20 @@ func handleListSchedule(db *sql.DB) http.HandlerFunc {
 
 func handleDeleteSchedule(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
 		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 		if err != nil {
 			respond(w, http.StatusBadRequest, errResp("invalid schedule id"))
 			return
 		}
-		res, err := db.ExecContext(r.Context(), "DELETE FROM schedule_entries WHERE id = ?", id)
+		res, err := db.ExecContext(r.Context(),
+			"DELETE FROM schedule_entries WHERE id = $1 AND team_id = $2", id, teamID)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -152,55 +182,66 @@ func handleDeleteSchedule(db *sql.DB) http.HandlerFunc {
 	}
 }
 
+// handleCurrentSchedule answers "who is on call right now" for every team the
+// caller belongs to — one entry per team, so somebody on two rotas sees both.
+// A team with nobody scheduled today simply does not appear.
 func handleCurrentSchedule(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		today := time.Now().UTC().Format("2006-01-02")
 
-		var e models.ScheduleEntry
-		var ts int64
-		err := db.QueryRowContext(r.Context(), `
-			SELECT s.id, s.user_id, u.username, s.date, s.created_at
+		rows, err := db.QueryContext(r.Context(), `
+			SELECT s.id, s.team_id, t.name, s.user_id, u.username, s.date, s.created_at
 			FROM   schedule_entries s
 			JOIN   users u ON u.id = s.user_id
-			WHERE  s.date = ?`, today).Scan(&e.ID, &e.UserID, &e.Username, &e.Date, &ts)
-		if err == sql.ErrNoRows {
-			respond(w, http.StatusNotFound, errResp("no one is on call today"))
-			return
-		}
+			JOIN   teams t ON t.id = s.team_id
+			WHERE  s.date = $1 AND s.team_id = ANY($2)
+			ORDER  BY t.name`, today, callerTeamIDs(r.Context()))
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
+		defer rows.Close()
+
+		entries := []models.ScheduleEntry{}
+		for rows.Next() {
+			var e models.ScheduleEntry
+			var ts int64
+			if err := rows.Scan(&e.ID, &e.TeamID, &e.TeamName, &e.UserID, &e.Username, &e.Date, &ts); err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
 			e.CreatedAt = time.Unix(ts, 0).UTC()
-		respond(w, http.StatusOK, e)
+			entries = append(entries, e)
+		}
+		if err := rows.Err(); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, entries)
 	}
 }
 
 // scheduleRange returns schedule entries ordered by date.
 // from and to are YYYY-MM-DD strings; an empty string means unbounded on that side.
-func scheduleRange(ctx context.Context, db *sql.DB, from, to string) ([]models.ScheduleEntry, error) {
-	where := []string{}
-	args := []any{}
+func scheduleRange(ctx context.Context, db *sql.DB, teamID int64, from, to string) ([]models.ScheduleEntry, error) {
+	args := &sqlArgs{}
+	where := []string{"s.team_id = " + args.add(teamID)}
 	if from != "" {
-		where = append(where, "s.date >= ?")
-		args = append(args, from)
+		where = append(where, "s.date >= "+args.add(from))
 	}
 	if to != "" {
-		where = append(where, "s.date <= ?")
-		args = append(args, to)
+		where = append(where, "s.date <= "+args.add(to))
 	}
 
-	clause := "1=1"
-	if len(where) > 0 {
-		clause = strings.Join(where, " AND ")
-	}
+	clause := strings.Join(where, " AND ")
 
 	rows, err := db.QueryContext(ctx, `
-		SELECT s.id, s.user_id, u.username, s.date, s.created_at
+		SELECT s.id, s.team_id, t.name, s.user_id, u.username, s.date, s.created_at
 		FROM   schedule_entries s
 		JOIN   users u ON u.id = s.user_id
+		JOIN   teams t ON t.id = s.team_id
 		WHERE  `+clause+`
-		ORDER  BY s.date ASC`, args...)
+		ORDER  BY s.date ASC`, args.all()...)
 	if err != nil {
 		return nil, err
 	}
@@ -210,7 +251,7 @@ func scheduleRange(ctx context.Context, db *sql.DB, from, to string) ([]models.S
 	for rows.Next() {
 		var e models.ScheduleEntry
 		var ts int64
-		if err := rows.Scan(&e.ID, &e.UserID, &e.Username, &e.Date, &ts); err != nil {
+		if err := rows.Scan(&e.ID, &e.TeamID, &e.TeamName, &e.UserID, &e.Username, &e.Date, &ts); err != nil {
 			return nil, err
 		}
 		e.CreatedAt = time.Unix(ts, 0).UTC()

internal/api/stats.go

@@ -11,7 +11,7 @@ import (
 
 func handleStatsAlerts(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query(), "received_at")
+		where, args := statsFilter(r.URL.Query(), "received_at", callerTeamIDs(r.Context()))
 
 		// COALESCE because SUM over zero rows is NULL, not 0, and a count of
 		// nothing is 0 — without it an empty window is a 500 rather than a
@@ -21,7 +21,7 @@ func handleStatsAlerts(db *sql.DB) http.HandlerFunc {
 			SELECT COUNT(*),
 			       COALESCE(SUM(CASE WHEN status = 'firing'   THEN 1 ELSE 0 END), 0),
 			       COALESCE(SUM(CASE WHEN status = 'resolved' THEN 1 ELSE 0 END), 0)
-			FROM alerts WHERE %s`, where), args...,
+			FROM alerts WHERE %s`, where), args.all()...,
 		).Scan(&total, &firing, &resolved)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
@@ -37,7 +37,7 @@ func handleStatsAlerts(db *sql.DB) http.HandlerFunc {
 
 func handleStatsTop(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query(), "received_at")
+		where, args := statsFilter(r.URL.Query(), "received_at", callerTeamIDs(r.Context()))
 
 		limit := 10
 		if l := r.URL.Query().Get("limit"); l != "" {
@@ -47,15 +47,13 @@ func handleStatsTop(db *sql.DB) http.HandlerFunc {
 				limit = n
 			}
 		}
-		args = append(args, limit)
-
 		rows, err := db.QueryContext(r.Context(), fmt.Sprintf(`
 			SELECT name, COUNT(*) AS cnt
 			FROM   alerts
 			WHERE  %s
 			GROUP  BY name
 			ORDER  BY cnt DESC
-			LIMIT  ?`, where), args...)
+			LIMIT  %s`, where, args.add(limit)), args.all()...)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -81,15 +79,15 @@ func handleStatsTop(db *sql.DB) http.HandlerFunc {
 
 func handleStatsByHour(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query(), "received_at")
+		where, args := statsFilter(r.URL.Query(), "received_at", callerTeamIDs(r.Context()))
 
 		rows, err := db.QueryContext(r.Context(), fmt.Sprintf(`
-			SELECT CAST(strftime('%%H', datetime(received_at, 'unixepoch')) AS INTEGER) AS hr,
+			SELECT EXTRACT(HOUR FROM to_timestamp(received_at) AT TIME ZONE 'UTC')::int AS hr,
 			       COUNT(*) AS cnt
 			FROM   alerts
 			WHERE  %s
 			GROUP  BY hr
-			ORDER  BY hr ASC`, where), args...)
+			ORDER  BY hr ASC`, where), args.all()...)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -121,16 +119,17 @@ func handleStatsByHour(db *sql.DB) http.HandlerFunc {
 
 func handleStatsByDay(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query(), "received_at")
+		where, args := statsFilter(r.URL.Query(), "received_at", callerTeamIDs(r.Context()))
 
-		// SQLite strftime('%w') → 0=Sunday … 6=Saturday
+		// Postgres EXTRACT(DOW …) → 0=Sunday … 6=Saturday, the same numbering
+		// SQLite's strftime('%w') returned, so the frontend needs no change.
 		rows, err := db.QueryContext(r.Context(), fmt.Sprintf(`
-			SELECT CAST(strftime('%%w', datetime(received_at, 'unixepoch')) AS INTEGER) AS dow,
+			SELECT EXTRACT(DOW FROM to_timestamp(received_at) AT TIME ZONE 'UTC')::int AS dow,
 			       COUNT(*) AS cnt
 			FROM   alerts
 			WHERE  %s
 			GROUP  BY dow
-			ORDER  BY dow ASC`, where), args...)
+			ORDER  BY dow ASC`, where), args.all()...)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -168,7 +167,7 @@ func handleStatsByDay(db *sql.DB) http.HandlerFunc {
 // mutated in place and carry no acknowledgement or closure time.
 func handleStatsIncidents(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query(), "triggered_at")
+		where, args := statsFilter(r.URL.Query(), "triggered_at", callerTeamIDs(r.Context()))
 
 		// The counts are COALESCEd because SUM over zero rows is NULL, not 0.
 		// The averages are not: mtta and mttr stay null on purpose, since zero
@@ -184,7 +183,7 @@ func handleStatsIncidents(db *sql.DB) http.HandlerFunc {
 			                THEN acknowledged_at - triggered_at END),
 			       AVG(CASE WHEN resolved_at IS NOT NULL
 			                THEN resolved_at - triggered_at END)
-			FROM incidents WHERE %s`, where), args...,
+			FROM incidents WHERE %s`, where), args.all()...,
 		).Scan(&total, &triggered, &acknowledged, &resolved, &mtta, &mttr)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
@@ -207,18 +206,21 @@ func handleStatsIncidents(db *sql.DB) http.HandlerFunc {
 // statsFilter builds a WHERE clause and args from optional ?from and ?to query
 // params, filtering on timeCol. Archived rows are always excluded, matching the
 // default list views.
-func statsFilter(q url.Values, timeCol string) (where string, args []any) {
-	clauses := []string{"archived_at IS NULL"}
+//
+// teamIDs scopes every figure to the caller's own teams: a report that counted
+// other teams' incidents would leak their volume and their names through the
+// top-alerts list, and would not be a number about the reader's work anyway.
+func statsFilter(q url.Values, timeCol string, teamIDs []int64) (where string, args *sqlArgs) {
+	args = &sqlArgs{}
+	clauses := []string{"archived_at IS NULL", "team_id = ANY(" + args.add(teamIDs) + ")"}
 	if from := q.Get("from"); from != "" {
 		if t, err := time.Parse("2006-01-02", from); err == nil {
-			clauses = append(clauses, timeCol+" >= ?")
-			args = append(args, t.UTC().Unix())
+			clauses = append(clauses, timeCol+" >= "+args.add(t.UTC().Unix()))
 		}
 	}
 	if to := q.Get("to"); to != "" {
 		if t, err := time.Parse("2006-01-02", to); err == nil {
-			clauses = append(clauses, timeCol+" < ?")
-			args = append(args, t.UTC().AddDate(0, 0, 1).Unix())
+			clauses = append(clauses, timeCol+" < "+args.add(t.UTC().AddDate(0, 0, 1).Unix()))
 		}
 	}
 	return strings.Join(clauses, " AND "), args

internal/api/teams.go

@@ -0,0 +1,575 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/models"
+	"github.com/go-chi/chi/v5"
+)
+
+// handleListTeams lists the caller's own teams, each with their role in it. An
+// administrator listing every team goes through the admin endpoint instead:
+// this one answers "what am I part of", which is what the UI's team filter and
+// the combined queue are built from.
+func handleListTeams(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		caller, _ := userFromContext(r.Context())
+		rows, err := db.QueryContext(r.Context(), `
+			SELECT t.id, t.name, t.created_at, m.role
+			FROM   teams t
+			JOIN   team_members m ON m.team_id = t.id
+			WHERE  m.user_id = $1
+			ORDER  BY t.name`, caller.ID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer rows.Close()
+
+		teams := []models.Team{}
+		for rows.Next() {
+			var t models.Team
+			var created int64
+			if err := rows.Scan(&t.ID, &t.Name, &created, &t.Role); err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
+			t.CreatedAt = time.Unix(created, 0).UTC()
+			teams = append(teams, t)
+		}
+		if err := rows.Err(); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, teams)
+	}
+}
+
+// handleCreateTeam creates a team and makes its creator the first owner. A team
+// with no owner would need an administrator to repair before anybody could use
+// it, so the two happen in one transaction.
+func handleCreateTeam(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req struct {
+			Name string `json:"name"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		req.Name = strings.TrimSpace(req.Name)
+		if req.Name == "" {
+			respond(w, http.StatusBadRequest, errResp("name is required"))
+			return
+		}
+
+		caller, _ := userFromContext(r.Context())
+
+		tx, err := db.BeginTx(r.Context(), nil)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer tx.Rollback() //nolint:errcheck
+
+		var team models.Team
+		var created int64
+		if err := tx.QueryRowContext(r.Context(),
+			"INSERT INTO teams (name) VALUES ($1) RETURNING id, name, created_at",
+			req.Name).Scan(&team.ID, &team.Name, &created); err != nil {
+			if isUniqueViolation(err) {
+				respond(w, http.StatusConflict, errResp("a team with that name already exists"))
+				return
+			}
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if _, err := tx.ExecContext(r.Context(),
+			"INSERT INTO team_members (team_id, user_id, role) VALUES ($1, $2, $3)",
+			team.ID, caller.ID, models.RoleOwner); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if err := tx.Commit(); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		team.CreatedAt = time.Unix(created, 0).UTC()
+		team.Role = models.RoleOwner
+		respond(w, http.StatusCreated, team)
+	}
+}
+
+// handleDeleteTeam removes a team and, by cascade, its incidents, alerts,
+// schedule and integrations.
+//
+// Refused while the team still has open incidents: deleting a team is tidying
+// up, and tidying up should never be how an unacknowledged page disappears.
+// Resolve or archive them first, deliberately.
+func handleDeleteTeam(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
+
+		var open int
+		if err := db.QueryRowContext(r.Context(),
+			"SELECT COUNT(*) FROM incidents WHERE team_id = $1 AND resolved_at IS NULL", teamID).
+			Scan(&open); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if open > 0 {
+			respond(w, http.StatusConflict, errResp("team still has open incidents"))
+			return
+		}
+
+		res, err := db.ExecContext(r.Context(), "DELETE FROM teams WHERE id = $1", teamID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("not found"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// handleListTeamMembers names everybody in a team. Visible to any member: you
+// can see who else is on the rota you are on.
+func handleListTeamMembers(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamMember(w, r, teamID) {
+			return
+		}
+
+		rows, err := db.QueryContext(r.Context(), `
+			SELECT m.team_id, m.user_id, u.username, m.role, m.joined_at
+			FROM   team_members m
+			JOIN   users u ON u.id = m.user_id
+			WHERE  m.team_id = $1
+			ORDER  BY u.username`, teamID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer rows.Close()
+
+		members := []models.TeamMember{}
+		for rows.Next() {
+			var m models.TeamMember
+			var joined int64
+			if err := rows.Scan(&m.TeamID, &m.UserID, &m.Username, &m.Role, &joined); err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
+			m.JoinedAt = time.Unix(joined, 0).UTC()
+			members = append(members, m)
+		}
+		if err := rows.Err(); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, members)
+	}
+}
+
+// handleAddTeamMember adds a user to a team, or changes the role of somebody
+// already in it.
+func handleAddTeamMember(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
+
+		var req struct {
+			UserID int64  `json:"user_id"`
+			Role   string `json:"role"`
+		}
+		if err := decodeJSON(r, &req); err != nil || req.UserID == 0 {
+			respond(w, http.StatusBadRequest, errResp("user_id is required"))
+			return
+		}
+		if req.Role == "" {
+			req.Role = models.RoleMember
+		}
+		if req.Role != models.RoleOwner && req.Role != models.RoleMember {
+			respond(w, http.StatusBadRequest, errResp("role must be owner or member"))
+			return
+		}
+
+		_, err := db.ExecContext(r.Context(), `
+			INSERT INTO team_members (team_id, user_id, role)
+			VALUES ($1, $2, $3)
+			ON CONFLICT (team_id, user_id) DO UPDATE SET role = excluded.role`,
+			teamID, req.UserID, req.Role)
+		if err != nil {
+			// The only foreign key that can fail here is the user: the team was
+			// resolved from the caller's own membership.
+			respond(w, http.StatusNotFound, errResp("user not found"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// handleRemoveTeamMember takes a user out of a team.
+//
+// A team must keep an owner, for the same reason the install must keep an
+// administrator: otherwise nobody can configure it, and repairing that needs
+// somebody with more access than the team has.
+func handleRemoveTeamMember(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
+		userID, err := strconv.ParseInt(chi.URLParam(r, "userID"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid user id"))
+			return
+		}
+
+		last, err := isLastTeamOwner(r.Context(), db, teamID, userID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if last {
+			respond(w, http.StatusConflict, errResp("cannot remove the last owner of a team"))
+			return
+		}
+
+		res, err := db.ExecContext(r.Context(),
+			"DELETE FROM team_members WHERE team_id = $1 AND user_id = $2", teamID, userID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("not a member of this team"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+func isLastTeamOwner(ctx context.Context, db *sql.DB, teamID, userID int64) (bool, error) {
+	var last bool
+	err := db.QueryRowContext(ctx, `
+		SELECT EXISTS (SELECT 1 FROM team_members
+		                WHERE team_id = $1 AND user_id = $2 AND role = 'owner')
+		   AND NOT EXISTS (SELECT 1 FROM team_members
+		                    WHERE team_id = $1 AND user_id <> $2 AND role = 'owner')`,
+		teamID, userID).Scan(&last)
+	return last, err
+}
+
+// ---------------------------------------------------------------------------
+// Integrations
+// ---------------------------------------------------------------------------
+
+// handleListIntegrations lists a team's integrations. Never the keys: those
+// exist in plaintext only in the response that created them.
+func handleListIntegrations(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamMember(w, r, teamID) {
+			return
+		}
+
+		rows, err := db.QueryContext(r.Context(), `
+			SELECT id, team_id, kind, name, created_at, last_used_at
+			FROM   integrations
+			WHERE  team_id = $1
+			ORDER  BY id`, teamID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer rows.Close()
+
+		integrations := []models.Integration{}
+		for rows.Next() {
+			var i models.Integration
+			var created int64
+			var lastUsed *int64
+			if err := rows.Scan(&i.ID, &i.TeamID, &i.Kind, &i.Name, &created, &lastUsed); err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
+			i.CreatedAt = time.Unix(created, 0).UTC()
+			i.LastUsedAt = unixPtr(lastUsed)
+			integrations = append(integrations, i)
+		}
+		if err := rows.Err(); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, integrations)
+	}
+}
+
+// handleCreateIntegration mints an integration key. The key is returned once,
+// in this response, and only its hash is kept — the same handling as an API key
+// or an acknowledgement token.
+func handleCreateIntegration(db *sql.DB, publicURL string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
+
+		var req struct {
+			Name string `json:"name"`
+			Kind string `json:"kind"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		req.Name = strings.TrimSpace(req.Name)
+		if req.Name == "" {
+			respond(w, http.StatusBadRequest, errResp("name is required"))
+			return
+		}
+		if req.Kind == "" {
+			req.Kind = models.IntegrationAlertmanager
+		}
+		if req.Kind != models.IntegrationAlertmanager {
+			respond(w, http.StatusBadRequest, errResp("unsupported integration kind"))
+			return
+		}
+
+		raw, hash, err := randomToken()
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		var i models.Integration
+		var created int64
+		if err := db.QueryRowContext(r.Context(), `
+			INSERT INTO integrations (team_id, kind, name, key_hash)
+			VALUES ($1, $2, $3, $4)
+			RETURNING id, team_id, kind, name, created_at`,
+			teamID, req.Kind, req.Name, hash).
+			Scan(&i.ID, &i.TeamID, &i.Kind, &i.Name, &created); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		i.CreatedAt = time.Unix(created, 0).UTC()
+		i.Key = raw
+		i.URL = strings.TrimSuffix(publicURL, "/") + integrationPath(raw, i.Kind)
+		respond(w, http.StatusCreated, i)
+	}
+}
+
+func handleDeleteIntegration(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
+		id, err := strconv.ParseInt(chi.URLParam(r, "integrationID"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid integration id"))
+			return
+		}
+
+		res, err := db.ExecContext(r.Context(),
+			"DELETE FROM integrations WHERE id = $1 AND team_id = $2", id, teamID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("not found"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// integrationPath is where a sender of this kind posts. Built in one place so
+// the URL handed out at creation and the route the router registers cannot
+// drift apart.
+func integrationPath(key, kind string) string {
+	return "/api/integrations/" + key + "/" + kind
+}
+
+// teamIDForKey resolves an integration key to its team, and stamps the key's
+// last use. An unknown key is not an error worth distinguishing: the caller is
+// told nothing beyond "no".
+func teamIDForKey(ctx context.Context, db *sql.DB, key string) (int64, error) {
+	var teamID int64
+	err := db.QueryRowContext(ctx,
+		"SELECT team_id FROM integrations WHERE key_hash = $1", hashToken(key)).Scan(&teamID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, errUnknownIntegration
+	}
+	if err != nil {
+		return 0, err
+	}
+	// Best effort, like an API key's: a failed stamp must not reject an alert.
+	db.ExecContext(ctx, //nolint:errcheck
+		"UPDATE integrations SET last_used_at = $1 WHERE key_hash = $2",
+		time.Now().Unix(), hashToken(key))
+	return teamID, nil
+}
+
+var errUnknownIntegration = errors.New("unknown integration key")
+
+// teamParam reads {teamID} from the path.
+func teamParam(w http.ResponseWriter, r *http.Request) (int64, bool) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "teamID"), 10, 64)
+	if err != nil {
+		respond(w, http.StatusBadRequest, errResp("invalid team id"))
+		return 0, false
+	}
+	return id, true
+}
+
+// defaultTeamID is the team the deprecated unauthenticated webhook routes to:
+// the oldest one, which on an upgraded install is the "Default" team every
+// pre-teams row was moved into.
+func defaultTeamID(ctx context.Context, db *sql.DB) (int64, error) {
+	var id int64
+	err := db.QueryRowContext(ctx, "SELECT id FROM teams ORDER BY id LIMIT 1").Scan(&id)
+	return id, err
+}
+
+// ---------------------------------------------------------------------------
+// A team's dead man's switches
+// ---------------------------------------------------------------------------
+
+// deadmanResponse is the wire shape of a team's switch configuration. The
+// timeout is seconds rather than a duration string, because that is what the
+// column holds and what arithmetic is done on; a client renders it.
+type deadmanResponse struct {
+	TeamID         int64  `json:"team_id"`
+	Matchers       string `json:"matchers"`
+	TimeoutSeconds int64  `json:"timeout_seconds"`
+	Severity       string `json:"severity"`
+}
+
+func handleGetTeamDeadman(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamMember(w, r, teamID) {
+			return
+		}
+
+		out := deadmanResponse{TeamID: teamID, Severity: "critical"}
+		err := db.QueryRowContext(r.Context(),
+			"SELECT matchers, timeout_seconds, severity FROM deadman_configs WHERE team_id = $1",
+			teamID).Scan(&out.Matchers, &out.TimeoutSeconds, &out.Severity)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		// A team with no row watches nothing, which is a configuration and not
+		// an absence: answering 404 would make "off" indistinguishable from
+		// "this server does not do this".
+		respond(w, http.StatusOK, out)
+	}
+}
+
+// handleSetTeamDeadman replaces a team's switch configuration.
+//
+// Validated by parsing: a matcher string that survives ParseDeadmanConfig with
+// nothing usable in it is rejected rather than stored, because a switch that
+// silently watches nothing is the failure this feature exists to prevent.
+func handleSetTeamDeadman(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
+
+		var req struct {
+			Matchers       string `json:"matchers"`
+			TimeoutSeconds int64  `json:"timeout_seconds"`
+			Severity       string `json:"severity"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		req.Matchers = strings.TrimSpace(req.Matchers)
+		if req.Severity == "" {
+			req.Severity = "critical"
+		}
+		if req.TimeoutSeconds < 0 {
+			respond(w, http.StatusBadRequest, errResp("timeout_seconds must not be negative"))
+			return
+		}
+		if req.Matchers != "" {
+			parsed := parseDeadmanQuietly(req.Matchers, time.Duration(req.TimeoutSeconds)*time.Second, req.Severity)
+			if len(parsed.Matchers) == 0 {
+				respond(w, http.StatusBadRequest, errResp(
+					"no usable matchers: each must name an alertname, as in alertname=Watchdog,cluster=prod"))
+				return
+			}
+		}
+
+		if _, err := db.ExecContext(r.Context(), `
+			INSERT INTO deadman_configs (team_id, matchers, timeout_seconds, severity, updated_at)
+			VALUES ($1, $2, $3, $4, `+nowEpoch+`)
+			ON CONFLICT (team_id) DO UPDATE SET
+				matchers        = excluded.matchers,
+				timeout_seconds = excluded.timeout_seconds,
+				severity        = excluded.severity,
+				updated_at      = excluded.updated_at`,
+			teamID, req.Matchers, req.TimeoutSeconds, req.Severity); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		respond(w, http.StatusOK, deadmanResponse{
+			TeamID:         teamID,
+			Matchers:       req.Matchers,
+			TimeoutSeconds: req.TimeoutSeconds,
+			Severity:       req.Severity,
+		})
+	}
+}

internal/api/teams_test.go

@@ -0,0 +1,350 @@
+package api_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"testing"
+)
+
+// The whole point of #4: two teams sharing one server must not see each other's
+// work. These tests build two of them and check the boundary from both sides.
+
+type teamFixture struct {
+	id   int64
+	key  string // integration key: how alerts get in
+	call func(method, path string, body any) *http.Response
+}
+
+// newTeam creates a team with its own member, integration key and API key. The
+// admin does the creating, as an install's first user would.
+func newTeam(t *testing.T, s *ts, name string) teamFixture {
+	t.Helper()
+
+	var team struct {
+		ID int64 `json:"id"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/teams", map[string]string{"name": name}), &team)
+
+	var integration struct {
+		Key string `json:"key"`
+		URL string `json:"url"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/teams/"+id64(team.ID)+"/integrations",
+		map[string]string{"name": name + " alertmanager"}), &integration)
+	if integration.Key == "" {
+		t.Fatalf("%s: integration key was not returned", name)
+	}
+
+	// A member of this team and no other.
+	var user struct {
+		ID int64 `json:"id"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/users",
+		map[string]string{"username": name + "-user", "email": name + "@test.com"}), &user)
+
+	resp := s.req(t, http.MethodPost, "/api/teams/"+id64(team.ID)+"/members",
+		map[string]any{"user_id": user.ID, "role": "owner"})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("%s: add member: %d", name, resp.StatusCode)
+	}
+
+	var key struct {
+		Key string `json:"key"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/users/"+id64(user.ID)+"/api-keys",
+		map[string]string{"name": "test"}), &key)
+
+	return teamFixture{
+		id:  team.ID,
+		key: integration.Key,
+		call: func(method, path string, body any) *http.Response {
+			t.Helper()
+			var r io.Reader
+			if body != nil {
+				data, _ := json.Marshal(body)
+				r = bytes.NewReader(data)
+			}
+			req, _ := http.NewRequest(method, s.URL+path, r)
+			req.Header.Set("Authorization", "Bearer "+key.Key)
+			if body != nil {
+				req.Header.Set("Content-Type", "application/json")
+			}
+			resp, err := http.DefaultClient.Do(req)
+			if err != nil {
+				t.Fatalf("%s %s: %v", method, path, err)
+			}
+			return resp
+		},
+	}
+}
+
+// postToIntegration sends one firing alert on a team's integration key, the way
+// a real Alertmanager receiver would.
+func postToIntegration(t *testing.T, s *ts, key, fingerprint, name string) {
+	t.Helper()
+	payload := map[string]any{
+		"version":     "4",
+		"status":      "firing",
+		"groupKey":    "{}:{alertname=\"" + name + "\"}",
+		"groupLabels": map[string]string{"alertname": name},
+		"alerts": []map[string]any{
+			amAlert(fingerprint, name, "firing", "2026-09-20T10:00:00Z", zeroTime, nil),
+		},
+	}
+	data, _ := json.Marshal(payload)
+	resp, err := http.Post(s.URL+"/api/integrations/"+key+"/alertmanager",
+		"application/json", bytes.NewReader(data))
+	if err != nil {
+		t.Fatalf("post alert: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("post alert: %d", resp.StatusCode)
+	}
+}
+
+func list(t *testing.T, resp *http.Response) []map[string]any {
+	t.Helper()
+	var out []map[string]any
+	decode(t, resp, &out)
+	return out
+}
+
+// An alert posted on one team's key opens an incident in that team and nowhere
+// else, and neither team can read the other's queue.
+func TestTeams_IncidentsAreScopedToTheReceivingTeam(t *testing.T) {
+	s := newTS(t)
+	red := newTeam(t, s, "red")
+	blue := newTeam(t, s, "blue")
+
+	postToIntegration(t, s, red.key, "fp-red", "RedDiskFull")
+	postToIntegration(t, s, blue.key, "fp-blue", "BlueDiskFull")
+
+	redIncidents := list(t, red.call(http.MethodGet, "/api/incidents", nil))
+	if len(redIncidents) != 1 {
+		t.Fatalf("red should see exactly its own incident, saw %d", len(redIncidents))
+	}
+	if title := redIncidents[0]["title"]; title != "RedDiskFull" {
+		t.Errorf("red saw %v", title)
+	}
+	if teamID := int64(redIncidents[0]["team_id"].(float64)); teamID != red.id {
+		t.Errorf("red's incident belongs to team %d, want %d", teamID, red.id)
+	}
+
+	blueIncidents := list(t, blue.call(http.MethodGet, "/api/incidents", nil))
+	if len(blueIncidents) != 1 || blueIncidents[0]["title"] != "BlueDiskFull" {
+		t.Fatalf("blue should see exactly its own incident, saw %v", blueIncidents)
+	}
+
+	// Reading the other team's incident by id is not found rather than
+	// forbidden: its existence is the other team's business.
+	otherID := int64(blueIncidents[0]["id"].(float64))
+	for _, path := range []string{
+		"/api/incidents/" + id64(otherID),
+		"/api/incidents/" + id64(otherID) + "/alerts",
+		"/api/incidents/" + id64(otherID) + "/timeline",
+	} {
+		resp := red.call(http.MethodGet, path, nil)
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusNotFound {
+			t.Errorf("red reading %s: expected 404, got %d", path, resp.StatusCode)
+		}
+	}
+
+	// And cannot act on it either.
+	for _, path := range []string{"/acknowledge", "/resolve", "/archive"} {
+		resp := red.call(http.MethodPost, "/api/incidents/"+id64(otherID)+path, nil)
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusNotFound {
+			t.Errorf("red posting %s: expected 404, got %d", path, resp.StatusCode)
+		}
+	}
+}
+
+// Alerts, the raw signal record, are scoped the same way.
+func TestTeams_AlertsAndStatsAreScoped(t *testing.T) {
+	s := newTS(t)
+	red := newTeam(t, s, "red")
+	blue := newTeam(t, s, "blue")
+
+	postToIntegration(t, s, red.key, "fp-red", "RedDiskFull")
+	postToIntegration(t, s, blue.key, "fp-blue-1", "BlueDiskFull")
+	postToIntegration(t, s, blue.key, "fp-blue-2", "BlueMemory")
+
+	if alerts := list(t, red.call(http.MethodGet, "/api/alerts", nil)); len(alerts) != 1 {
+		t.Errorf("red should see 1 alert, saw %d", len(alerts))
+	}
+	if alerts := list(t, blue.call(http.MethodGet, "/api/alerts", nil)); len(alerts) != 2 {
+		t.Errorf("blue should see 2 alerts, saw %d", len(alerts))
+	}
+
+	// Statistics count your own work only — otherwise a team's volume, and the
+	// names of its alerts, leak through the totals.
+	var stats map[string]any
+	decode(t, red.call(http.MethodGet, "/api/stats/alerts", nil), &stats)
+	if total := stats["total"].(float64); total != 1 {
+		t.Errorf("red's alert stats counted %v alerts, want 1", total)
+	}
+
+	top := list(t, red.call(http.MethodGet, "/api/stats/alerts/top", nil))
+	for _, row := range top {
+		if name := row["name"].(string); name != "RedDiskFull" {
+			t.Errorf("red's top alerts named %q, which is not theirs", name)
+		}
+	}
+}
+
+// The same fingerprint, the same groupKey and the same date are all legitimate
+// in two teams at once: two clusters running the same rules, two rotas.
+func TestTeams_SameFingerprintInTwoTeams(t *testing.T) {
+	s := newTS(t)
+	red := newTeam(t, s, "red")
+	blue := newTeam(t, s, "blue")
+
+	postToIntegration(t, s, red.key, "fp-shared", "DiskFull")
+	postToIntegration(t, s, blue.key, "fp-shared", "DiskFull")
+
+	for _, team := range []struct {
+		name string
+		f    teamFixture
+	}{{"red", red}, {"blue", blue}} {
+		incidents := list(t, team.f.call(http.MethodGet, "/api/incidents", nil))
+		if len(incidents) != 1 {
+			t.Errorf("%s: expected its own incident for the shared fingerprint, saw %d",
+				team.name, len(incidents))
+		}
+	}
+
+	// And both rotas can name somebody for the same day.
+	for _, team := range []struct {
+		name string
+		f    teamFixture
+	}{{"red", red}, {"blue", blue}} {
+		var members []map[string]any
+		decode(t, team.f.call(http.MethodGet, "/api/teams/"+id64(team.f.id)+"/members", nil), &members)
+		userID := int64(members[0]["user_id"].(float64))
+
+		resp := team.f.call(http.MethodPost, "/api/teams/"+id64(team.f.id)+"/schedule",
+			map[string]any{"user_id": userID, "dates": []string{"2026-10-01"}})
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusCreated {
+			t.Errorf("%s: taking 2026-10-01 returned %d", team.name, resp.StatusCode)
+		}
+	}
+}
+
+// An unknown key delivers nothing, and says so rather than accepting silently.
+func TestTeams_UnknownIntegrationKeyIsRejected(t *testing.T) {
+	s := newTS(t)
+	team := newTeam(t, s, "red")
+
+	resp, err := http.Post(s.URL+"/api/integrations/not-a-real-key/alertmanager",
+		"application/json", bytes.NewReader([]byte(`{"version":"4","status":"firing","alerts":[]}`)))
+	if err != nil {
+		t.Fatalf("post: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Errorf("expected 401 for an unknown key, got %d", resp.StatusCode)
+	}
+
+	if incidents := list(t, team.call(http.MethodGet, "/api/incidents", nil)); len(incidents) != 0 {
+		t.Errorf("a rejected payload opened %d incident(s)", len(incidents))
+	}
+}
+
+// Team configuration is an owner's job; working incidents is a member's.
+func TestTeams_MemberCannotConfigureTheTeam(t *testing.T) {
+	s := newTS(t)
+	team := newTeam(t, s, "red")
+
+	// A plain member of the same team.
+	var user struct {
+		ID int64 `json:"id"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/users",
+		map[string]string{"username": "plain", "email": "plain@test.com"}), &user)
+	resp := s.req(t, http.MethodPost, "/api/teams/"+id64(team.id)+"/members",
+		map[string]any{"user_id": user.ID, "role": "member"})
+	resp.Body.Close()
+	var key struct {
+		Key string `json:"key"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/users/"+id64(user.ID)+"/api-keys",
+		map[string]string{"name": "test"}), &key)
+
+	call := func(method, path string, body any) *http.Response {
+		t.Helper()
+		var r io.Reader
+		if body != nil {
+			data, _ := json.Marshal(body)
+			r = bytes.NewReader(data)
+		}
+		req, _ := http.NewRequest(method, s.URL+path, r)
+		req.Header.Set("Authorization", "Bearer "+key.Key)
+		if body != nil {
+			req.Header.Set("Content-Type", "application/json")
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatalf("%s %s: %v", method, path, err)
+		}
+		return resp
+	}
+
+	base := "/api/teams/" + id64(team.id)
+	for _, c := range []struct {
+		name   string
+		method string
+		path   string
+		body   any
+	}{
+		{"mint an integration key", http.MethodPost, base + "/integrations",
+			map[string]string{"name": "mine"}},
+		{"take a shift", http.MethodPost, base + "/schedule",
+			map[string]any{"user_id": user.ID, "dates": []string{"2026-11-01"}}},
+		{"add a member", http.MethodPost, base + "/members",
+			map[string]any{"user_id": 1}},
+		{"delete the team", http.MethodDelete, base, nil},
+	} {
+		resp := call(c.method, c.path, c.body)
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusForbidden {
+			t.Errorf("%s: expected 403, got %d", c.name, resp.StatusCode)
+		}
+	}
+
+	// But they can read what the team is doing.
+	for _, path := range []string{base + "/members", base + "/integrations", base + "/schedule"} {
+		resp := call(http.MethodGet, path, nil)
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			t.Errorf("reading %s: expected 200, got %d", path, resp.StatusCode)
+		}
+	}
+}
+
+// A team is not somewhere an outsider can look, whatever they know about it.
+func TestTeams_OutsiderSeesNothing(t *testing.T) {
+	s := newTS(t)
+	red := newTeam(t, s, "red")
+	blue := newTeam(t, s, "blue")
+
+	base := "/api/teams/" + id64(red.id)
+	for _, path := range []string{base + "/members", base + "/integrations", base + "/schedule"} {
+		resp := blue.call(http.MethodGet, path, nil)
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusNotFound {
+			t.Errorf("blue reading %s: expected 404, got %d", path, resp.StatusCode)
+		}
+	}
+
+	// /api/teams lists your own, never the install's.
+	teams := list(t, blue.call(http.MethodGet, "/api/teams", nil))
+	if len(teams) != 1 || teams[0]["name"] != "blue" {
+		t.Errorf("blue's team list: %v", teams)
+	}
+}

internal/api/testdb_test.go

@@ -0,0 +1,104 @@
+package api_test
+
+import (
+	"database/sql"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/db"
+)
+
+// Tests run against a real Postgres, because the server does. SQLite's
+// ":memory:" gave every test a private database for free; Postgres has no
+// equivalent, so isolation is bought with a schema per test.
+//
+// A schema rather than a database: CREATE DATABASE copies a template on disk and
+// costs a hundred milliseconds or so each time, while CREATE SCHEMA plus the one
+// baseline migration is a few, and the suite runs a few hundred of them. Each
+// test's pool is pinned to its own schema through search_path, so two tests
+// cannot see each other's rows even though they share a server.
+//
+// TERDUT_TEST_DSN must point at a database the test role may create schemas in:
+//
+//	postgres://terdut:terdut@localhost:5432/terdut_test?sslmode=disable
+//
+// `make test-db` starts one locally; ci.yaml runs one as a service container.
+// An unset DSN fails rather than skips, deliberately — a suite that quietly
+// tests nothing is worse than one that does not run.
+const testDSNEnv = "TERDUT_TEST_DSN"
+
+// defaultTeam is the team migration 003 creates and the bootstrap user owns, as
+// a path segment. Every test that does not say otherwise works inside it.
+const defaultTeam = "1"
+
+var schemaSeq int
+
+// newTestDB returns a migrated database private to this test, and drops it
+// afterwards.
+func newTestDB(t *testing.T) *sql.DB {
+	t.Helper()
+
+	dsn := os.Getenv(testDSNEnv)
+	if dsn == "" {
+		t.Fatalf("%s is not set: these tests need Postgres.\n"+
+			"Run `make test-db` for a local one, then\n"+
+			"  export %s=postgres://terdut:terdut@localhost:5432/terdut_test?sslmode=disable",
+			testDSNEnv, testDSNEnv)
+	}
+
+	schemaSeq++
+	schema := fmt.Sprintf("test_%d_%d", os.Getpid(), schemaSeq)
+
+	admin, err := sql.Open("pgx", dsn)
+	if err != nil {
+		t.Fatalf("connect to %s: %v", testDSNEnv, err)
+	}
+	defer admin.Close()
+	if _, err := admin.Exec("CREATE SCHEMA " + schema); err != nil {
+		t.Fatalf("create schema %s: %v", schema, err)
+	}
+
+	database, err := db.Open(withSearchPath(dsn, schema))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.Migrate(database); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	t.Cleanup(func() {
+		database.Close()
+		cleanup, err := sql.Open("pgx", dsn)
+		if err != nil {
+			return
+		}
+		defer cleanup.Close()
+		if _, err := cleanup.Exec("DROP SCHEMA " + schema + " CASCADE"); err != nil {
+			t.Logf("drop schema %s: %v", schema, err)
+		}
+	})
+
+	return database
+}
+
+// withSearchPath pins a DSN to one schema, so every connection the pool opens
+// lands there and nothing has to qualify a table name.
+//
+// Handles both DSN spellings: a postgres:// URL, and libpq's keyword/value form.
+func withSearchPath(dsn, schema string) string {
+	opt := "-csearch_path=" + schema
+
+	if strings.HasPrefix(dsn, "postgres://") || strings.HasPrefix(dsn, "postgresql://") {
+		u, err := url.Parse(dsn)
+		if err == nil {
+			q := u.Query()
+			q.Set("options", opt)
+			u.RawQuery = q.Encode()
+			return u.String()
+		}
+	}
+	return dsn + " options='" + opt + "'"
+}

internal/api/users.go

@@ -56,27 +56,36 @@ func handleBootstrap(db *sql.DB) http.HandlerFunc {
 			return
 		}
 
-		res, err := db.ExecContext(r.Context(),
-			"INSERT INTO users (username, email, password_hash) VALUES (?, ?, ?)",
-			req.Username, req.Email, passwordHash)
-		if err != nil {
+		var userID int64
+		if err := db.QueryRowContext(r.Context(),
+			"INSERT INTO users (username, email, password_hash, is_admin) VALUES ($1, $2, $3, true) RETURNING id",
+			req.Username, req.Email, passwordHash).Scan(&userID); err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
-		userID, _ := res.LastInsertId()
 
 		raw, hash, err := randomToken()
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
-		keyRes, err := db.ExecContext(r.Context(),
-			"INSERT INTO api_keys (user_id, key_hash, name) VALUES (?, ?, ?)", userID, hash, "bootstrap")
-		if err != nil {
+		var keyID int64
+		if err := db.QueryRowContext(r.Context(),
+			"INSERT INTO api_keys (user_id, key_hash, name) VALUES ($1, $2, $3) RETURNING id",
+			userID, hash, "bootstrap").Scan(&keyID); err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
-		keyID, _ := keyRes.LastInsertId()
+
+		// The default team exists from migration 003, on a fresh install too.
+		// Without a membership the first user signs in to a working server with
+		// no queue, no schedule and nowhere for an integration to hang off.
+		if teamID, err := defaultTeamID(r.Context(), db); err == nil {
+			db.ExecContext(r.Context(), //nolint:errcheck
+				"INSERT INTO team_members (team_id, user_id, role) VALUES ($1, $2, $3) "+
+					"ON CONFLICT (team_id, user_id) DO NOTHING",
+				teamID, userID, models.RoleOwner)
+		}
 
 		user, _ := fetchUser(r.Context(), db, userID)
 		key := models.APIKey{ID: keyID, UserID: userID, Name: "bootstrap", Key: raw, CreatedAt: user.CreatedAt}
@@ -87,7 +96,7 @@ func handleBootstrap(db *sql.DB) http.HandlerFunc {
 func handleListUsers(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		rows, err := db.QueryContext(r.Context(),
-			"SELECT id, username, email, created_at, ntfy_topic FROM users ORDER BY id")
+			"SELECT id, username, email, created_at, ntfy_topic, is_admin FROM users ORDER BY id")
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -98,7 +107,7 @@ func handleListUsers(db *sql.DB) http.HandlerFunc {
 		for rows.Next() {
 			var u models.User
 			var ts int64
-			if err := rows.Scan(&u.ID, &u.Username, &u.Email, &ts, &u.NtfyTopic); err != nil {
+			if err := rows.Scan(&u.ID, &u.Username, &u.Email, &ts, &u.NtfyTopic, &u.IsAdmin); err != nil {
 				respond(w, http.StatusInternalServerError, errResp("internal error"))
 				return
 			}
@@ -124,17 +133,17 @@ func handleCreateUser(db *sql.DB) http.HandlerFunc {
 			return
 		}
 
-		res, err := db.ExecContext(r.Context(),
-			"INSERT INTO users (username, email) VALUES (?, ?)", req.Username, req.Email)
-		if err != nil {
-			if strings.Contains(err.Error(), "UNIQUE constraint failed") {
+		var id int64
+		if err := db.QueryRowContext(r.Context(),
+			"INSERT INTO users (username, email) VALUES ($1, $2) RETURNING id",
+			req.Username, req.Email).Scan(&id); err != nil {
+			if isUniqueViolation(err) {
 				respond(w, http.StatusConflict, errResp("username or email already exists"))
 				return
 			}
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
-		id, _ := res.LastInsertId()
 		user, _ := fetchUser(r.Context(), db, id)
 		respond(w, http.StatusCreated, user)
 	}
@@ -151,6 +160,9 @@ func handleSetNotifyTarget(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusBadRequest, errResp("invalid user id"))
 			return
 		}
+		if !requireSelfOrAdmin(w, r, id) {
+			return
+		}
 		var req struct {
 			NtfyTopic string `json:"ntfy_topic"`
 		}
@@ -165,7 +177,7 @@ func handleSetNotifyTarget(db *sql.DB) http.HandlerFunc {
 		}
 
 		res, err := db.ExecContext(r.Context(),
-			"UPDATE users SET ntfy_topic = ? WHERE id = ?", topic, id)
+			"UPDATE users SET ntfy_topic = $1 WHERE id = $2", topic, id)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -191,7 +203,22 @@ func handleDeleteUser(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusBadRequest, errResp("invalid user id"))
 			return
 		}
-		res, err := db.ExecContext(r.Context(), "DELETE FROM users WHERE id = ?", id)
+		// Deleting yourself is how an install ends up with no administrator at
+		// all, and it is never what somebody meant to do.
+		caller, _ := userFromContext(r.Context())
+		if caller.ID == id {
+			respond(w, http.StatusConflict, errResp("cannot delete your own account"))
+			return
+		}
+		if last, err := isLastAdmin(r.Context(), db, id); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		} else if last {
+			respond(w, http.StatusConflict, errResp("cannot delete the last administrator"))
+			return
+		}
+
+		res, err := db.ExecContext(r.Context(), "DELETE FROM users WHERE id = $1", id)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -212,6 +239,9 @@ func handleCreateAPIKey(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusBadRequest, errResp("invalid user id"))
 			return
 		}
+		if !requireSelfOrAdmin(w, r, userID) {
+			return
+		}
 
 		var req struct {
 			Name string `json:"name"`
@@ -226,7 +256,7 @@ func handleCreateAPIKey(db *sql.DB) http.HandlerFunc {
 		}
 
 		var exists int
-		if err := db.QueryRowContext(r.Context(), "SELECT 1 FROM users WHERE id = ?", userID).Scan(&exists); err != nil {
+		if err := db.QueryRowContext(r.Context(), "SELECT 1 FROM users WHERE id = $1", userID).Scan(&exists); err != nil {
 			respond(w, http.StatusNotFound, errResp("user not found"))
 			return
 		}
@@ -236,13 +266,13 @@ func handleCreateAPIKey(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
-		res, err := db.ExecContext(r.Context(),
-			"INSERT INTO api_keys (user_id, key_hash, name) VALUES (?, ?, ?)", userID, hash, req.Name)
-		if err != nil {
+		var keyID int64
+		if err := db.QueryRowContext(r.Context(),
+			"INSERT INTO api_keys (user_id, key_hash, name) VALUES ($1, $2, $3) RETURNING id",
+			userID, hash, req.Name).Scan(&keyID); err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
-		keyID, _ := res.LastInsertId()
 		key := models.APIKey{ID: keyID, UserID: userID, Name: req.Name, Key: raw, CreatedAt: time.Now().UTC()}
 		respond(w, http.StatusCreated, key)
 	}
@@ -255,6 +285,9 @@ func handleDeleteAPIKey(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusBadRequest, errResp("invalid user id"))
 			return
 		}
+		if !requireSelfOrAdmin(w, r, userID) {
+			return
+		}
 		keyID, err := strconv.ParseInt(chi.URLParam(r, "keyID"), 10, 64)
 		if err != nil {
 			respond(w, http.StatusBadRequest, errResp("invalid key id"))
@@ -262,7 +295,7 @@ func handleDeleteAPIKey(db *sql.DB) http.HandlerFunc {
 		}
 
 		res, err := db.ExecContext(r.Context(),
-			"DELETE FROM api_keys WHERE id = ? AND user_id = ?", keyID, userID)
+			"DELETE FROM api_keys WHERE id = $1 AND user_id = $2", keyID, userID)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -293,11 +326,77 @@ func fetchUser(ctx context.Context, db *sql.DB, id int64) (models.User, error) {
 	var u models.User
 	var ts int64
 	err := db.QueryRowContext(ctx,
-		"SELECT id, username, email, created_at, ntfy_topic FROM users WHERE id = ?", id).
-		Scan(&u.ID, &u.Username, &u.Email, &ts, &u.NtfyTopic)
+		"SELECT id, username, email, created_at, ntfy_topic, is_admin FROM users WHERE id = $1", id).
+		Scan(&u.ID, &u.Username, &u.Email, &ts, &u.NtfyTopic, &u.IsAdmin)
 	if err != nil {
 		return u, err
 	}
 	u.CreatedAt = time.Unix(ts, 0).UTC()
 	return u, nil
 }
+
+// handleSetAdmin grants or revokes the system administrator flag.
+//
+// Revoking is guarded twice: an install must keep at least one administrator,
+// and you cannot demote yourself. The first stops the flag being lost
+// altogether; the second stops the likelier accident, where the only admin
+// clears their own flag while tidying up and locks the door behind them.
+func handleSetAdmin(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid user id"))
+			return
+		}
+		var req struct {
+			IsAdmin *bool `json:"is_admin"`
+		}
+		if err := decodeJSON(r, &req); err != nil || req.IsAdmin == nil {
+			respond(w, http.StatusBadRequest, errResp("is_admin is required"))
+			return
+		}
+
+		if !*req.IsAdmin {
+			caller, _ := userFromContext(r.Context())
+			if caller.ID == id {
+				respond(w, http.StatusConflict, errResp("cannot revoke your own administrator access"))
+				return
+			}
+			if last, err := isLastAdmin(r.Context(), db, id); err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			} else if last {
+				respond(w, http.StatusConflict, errResp("cannot revoke the last administrator"))
+				return
+			}
+		}
+
+		res, err := db.ExecContext(r.Context(),
+			"UPDATE users SET is_admin = $1 WHERE id = $2", *req.IsAdmin, id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("user not found"))
+			return
+		}
+
+		user, err := fetchUser(r.Context(), db, id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, user)
+	}
+}
+
+// isLastAdmin reports whether id is an administrator and no other user is one.
+// A non-admin id is never the last one, so removing them is always allowed.
+func isLastAdmin(ctx context.Context, db *sql.DB, id int64) (bool, error) {
+	var last bool
+	err := db.QueryRowContext(ctx, `
+		SELECT EXISTS (SELECT 1 FROM users WHERE id = $1 AND is_admin)
+		   AND NOT EXISTS (SELECT 1 FROM users WHERE id <> $1 AND is_admin)`, id).Scan(&last)
+	return last, err
+}

internal/config/config.go

@@ -7,7 +7,14 @@ import (
 
 type Config struct {
 	Addr string
-	DBPath       string
+
+	// DSN is the Postgres connection string, e.g.
+	// postgres://terdut:secret@host:5432/terdut?sslmode=require. Required:
+	// unlike the SQLite path it replaced there is no sensible default, and a
+	// server that silently came up against the wrong database would be worse
+	// than one that refuses to start.
+	DSN string
+
 	ArchiveAfter time.Duration
 
 	// StaleAfter is how long a firing alert may go without a refreshing webhook
@@ -59,10 +66,6 @@ func Load() Config {
 	if addr == "" {
 		addr = ":8080"
 	}
-	dbPath := os.Getenv("TERDUT_DB_PATH")
-	if dbPath == "" {
-		dbPath = "terdut.db"
-	}
 	deadmanMatchers := os.Getenv("TERDUT_DEADMAN_MATCHERS")
 	if deadmanMatchers == "" {
 		deadmanMatchers = "alertname=Watchdog"
@@ -73,7 +76,7 @@ func Load() Config {
 	}
 	return Config{
 		Addr:         addr,
-		DBPath:       dbPath,
+		DSN:          os.Getenv("TERDUT_DB_DSN"),
 		ArchiveAfter: duration("TERDUT_ARCHIVE_AFTER", 7*24*time.Hour),
 		StaleAfter:   duration("TERDUT_STALE_AFTER", 6*time.Hour),
 

internal/db/db.go

@@ -7,24 +7,32 @@ import (
 	"io/fs"
 	"sort"
 	"strings"
+	"time"
 
-	_ "modernc.org/sqlite"
+	_ "github.com/jackc/pgx/v5/stdlib"
 )
 
 //go:embed migrations
 var migrationsFS embed.FS
 
-func Open(path string) (*sql.DB, error) {
-	db, err := sql.Open("sqlite", path)
+// Open connects to Postgres. dsn is a libpq connection string or URL, e.g.
+// postgres://terdut:secret@localhost:5432/terdut?sslmode=disable.
+//
+// The pool is modest on purpose: this server's concurrency comes from a handful
+// of HTTP handlers plus two background loops, and a cloud-native-pg instance
+// sized for it has a low max_connections. It is still a pool, unlike the single
+// connection SQLite forced, so the notifier no longer blocks a webhook.
+func Open(dsn string) (*sql.DB, error) {
+	if dsn == "" {
+		return nil, fmt.Errorf("empty DSN: set TERDUT_DB_DSN")
+	}
+	db, err := sql.Open("pgx", dsn)
 	if err != nil {
 		return nil, err
 	}
-	// SQLite does not support concurrent writers; a single connection avoids locking errors.
-	db.SetMaxOpenConns(1)
-	if _, err := db.Exec("PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON;"); err != nil {
-		db.Close()
-		return nil, fmt.Errorf("set pragmas: %w", err)
-	}
+	db.SetMaxOpenConns(10)
+	db.SetMaxIdleConns(5)
+	db.SetConnMaxLifetime(time.Hour)
 	if err := db.Ping(); err != nil {
 		db.Close()
 		return nil, fmt.Errorf("ping: %w", err)
@@ -32,10 +40,16 @@ func Open(path string) (*sql.DB, error) {
 	return db, nil
 }
 
+// Migrate applies every embedded migration that has not been applied yet, in
+// filename order, recording each in schema_migrations.
+//
+// Each file runs inside a transaction, which SQLite's version did not do: a
+// migration that failed half way used to leave the schema in whatever state it
+// had reached. Postgres has transactional DDL, so the rollback is real.
 func Migrate(db *sql.DB) error {
 	if _, err := db.Exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
 		version    TEXT PRIMARY KEY,
-		applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		applied_at BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint
 	)`); err != nil {
 		return fmt.Errorf("create schema_migrations: %w", err)
 	}
@@ -55,7 +69,7 @@ func Migrate(db *sql.DB) error {
 
 	for _, name := range files {
 		var count int
-		if err := db.QueryRow("SELECT COUNT(*) FROM schema_migrations WHERE version = ?", name).Scan(&count); err != nil {
+		if err := db.QueryRow("SELECT COUNT(*) FROM schema_migrations WHERE version = $1", name).Scan(&count); err != nil {
 			return fmt.Errorf("check migration %s: %w", name, err)
 		}
 		if count > 0 {
@@ -67,13 +81,28 @@ func Migrate(db *sql.DB) error {
 			return fmt.Errorf("read migration %s: %w", name, err)
 		}
 
-		if _, err := db.Exec(string(data)); err != nil {
-			return fmt.Errorf("apply migration %s: %w", name, err)
-		}
-
-		if _, err := db.Exec("INSERT INTO schema_migrations (version) VALUES (?)", name); err != nil {
-			return fmt.Errorf("record migration %s: %w", name, err)
+		if err := applyMigration(db, name, string(data)); err != nil {
+			return err
 		}
 	}
 	return nil
 }
+
+func applyMigration(db *sql.DB, name, body string) error {
+	tx, err := db.Begin()
+	if err != nil {
+		return fmt.Errorf("begin migration %s: %w", name, err)
+	}
+	defer tx.Rollback()
+
+	if _, err := tx.Exec(body); err != nil {
+		return fmt.Errorf("apply migration %s: %w", name, err)
+	}
+	if _, err := tx.Exec("INSERT INTO schema_migrations (version) VALUES ($1)", name); err != nil {
+		return fmt.Errorf("record migration %s: %w", name, err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit migration %s: %w", name, err)
+	}
+	return nil
+}

internal/db/migrations/001_baseline.sql

@@ -0,0 +1,182 @@
+-- The Postgres baseline: the schema as it stood at the end of the SQLite line,
+-- in one file rather than ten.
+--
+-- The ten SQLite migrations are in git history up to the commit that introduced
+-- this one, and they replay against nothing here: their shape was incremental
+-- (columns added, then dropped again in 008) and 008's backfill rewrote data
+-- that a Postgres install never had. An existing SQLite database is carried over
+-- by scripts/sqlite-to-postgres.go, which copies rows into this schema.
+--
+-- Two conventions inherited deliberately:
+--
+--   * Timestamps are BIGINT unix seconds, not timestamptz. Everything in Go
+--     already speaks epochs, and converting was a second change riding along
+--     with the port. Worth revisiting on its own.
+--
+--   * Ids are GENERATED BY DEFAULT, not ALWAYS, so the migration script can
+--     insert rows with their original ids and keep every foreign key intact.
+--     setval at the end of the copy puts the sequences past them.
+
+CREATE TABLE users (
+    id            BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    username      TEXT   NOT NULL UNIQUE,
+    email         TEXT   NOT NULL UNIQUE,
+    created_at    BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint,
+    -- Where this user's notifications go. NULL means they get none; incidents
+    -- assigned to them fall back to the configured fallback topic.
+    ntfy_topic    TEXT,
+    -- NULL means the user has no password and can only use API keys.
+    password_hash TEXT
+);
+
+CREATE TABLE api_keys (
+    id           BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    user_id      BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    key_hash     TEXT   NOT NULL UNIQUE,
+    name         TEXT   NOT NULL,
+    created_at   BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint,
+    last_used_at BIGINT
+);
+
+-- A session is a browser's credential, the cookie counterpart of an API key:
+-- only the hash of the token is stored. expires_at slides forward while the
+-- session is in use, so an on-call phone stays signed in.
+CREATE TABLE sessions (
+    id           BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    token_hash   TEXT   NOT NULL UNIQUE,
+    user_id      BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at   BIGINT NOT NULL,
+    last_seen_at BIGINT NOT NULL,
+    expires_at   BIGINT NOT NULL,
+    user_agent   TEXT
+);
+
+CREATE INDEX idx_sessions_user ON sessions(user_id);
+
+-- The machine-owned signal record: what Alertmanager says is true right now.
+-- Workflow state lives on incidents, never here, because the webhook upsert owns
+-- these rows and would overwrite it.
+CREATE TABLE alerts (
+    id                BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    fingerprint       TEXT   NOT NULL UNIQUE,
+    name              TEXT   NOT NULL,
+    status            TEXT   NOT NULL CHECK (status IN ('firing', 'resolved')),
+    labels            JSONB  NOT NULL DEFAULT '{}'::jsonb,
+    annotations       JSONB  NOT NULL DEFAULT '{}'::jsonb,
+    starts_at         BIGINT NOT NULL,
+    ends_at           BIGINT,
+    generator_url     TEXT   NOT NULL DEFAULT '',
+    received_at       BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint,
+    archived_at       BIGINT,
+    -- Why the alert left the firing state: 'alertmanager' when a resolved
+    -- webhook set it, 'expiry' when the sweeper inferred it from staleness.
+    resolution_source TEXT
+);
+
+CREATE INDEX alerts_status_idx      ON alerts(status);
+CREATE INDEX alerts_name_idx        ON alerts(name);
+CREATE INDEX alerts_received_at_idx ON alerts(received_at DESC);
+CREATE INDEX alerts_archived_at_idx ON alerts(archived_at);
+
+CREATE TABLE schedule_entries (
+    id         BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    user_id    BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    date       TEXT   NOT NULL UNIQUE,  -- YYYY-MM-DD; one person per day
+    created_at BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint
+);
+
+CREATE INDEX schedule_entries_date_idx ON schedule_entries(date);
+
+-- The human work item: what people acknowledge, assign, snooze, discuss and
+-- resolve. Correlation uses Alertmanager's own groupKey, so incidents follow the
+-- group_by routing tree the operator already tuned.
+CREATE TABLE incidents (
+    id                BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    group_key         TEXT   NOT NULL,                     -- Alertmanager groupKey, opaque
+    title             TEXT   NOT NULL,                     -- rendered from group_labels
+    group_labels      JSONB  NOT NULL DEFAULT '{}'::jsonb,
+    status            TEXT   NOT NULL CHECK (status IN ('triggered', 'acknowledged', 'resolved')),
+    severity          TEXT,                                -- highest `severity` label across firing members
+    triggered_at      BIGINT NOT NULL,
+    acknowledged_by   BIGINT REFERENCES users(id) ON DELETE SET NULL,
+    acknowledged_at   BIGINT,
+    assigned_to       BIGINT REFERENCES users(id) ON DELETE SET NULL,
+    snoozed_until     BIGINT,
+    resolved_at       BIGINT,
+    resolution_source TEXT,                                -- 'alerts' | 'manual'
+    archived_at       BIGINT
+);
+
+-- Load-bearing: at most one OPEN incident per group_key. This is what makes
+-- "resolved incident + a new alert occurrence = a new incident" work, and it is
+-- the constraint the webhook's find-or-open lookup relies on.
+CREATE UNIQUE INDEX incidents_open_group_key_idx ON incidents(group_key) WHERE resolved_at IS NULL;
+CREATE INDEX incidents_status_idx       ON incidents(status);
+CREATE INDEX incidents_triggered_at_idx ON incidents(triggered_at DESC);
+CREATE INDEX incidents_archived_at_idx  ON incidents(archived_at);
+
+-- Membership is historical, not a pointer on alerts: one alert row (one
+-- fingerprint) resolves and re-fires over time and belongs to a different
+-- incident each occurrence.
+CREATE TABLE incident_alerts (
+    incident_id BIGINT NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    alert_id    BIGINT NOT NULL REFERENCES alerts(id)    ON DELETE CASCADE,
+    added_at    BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint,
+    PRIMARY KEY (incident_id, alert_id)
+);
+
+CREATE INDEX incident_alerts_alert_id_idx ON incident_alerts(alert_id);
+
+-- The timeline. Append-only, and the only history this server keeps: alert rows
+-- are mutated in place, so without this there is no record that anything
+-- happened. Notes are events too, so one query renders the whole story.
+CREATE TABLE incident_events (
+    id          BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    incident_id BIGINT NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    -- triggered | alert_added | alert_resolved | acknowledged | unacknowledged
+    -- | assigned | snoozed | unsnoozed | resolved | note | notified | notify_failed
+    type        TEXT   NOT NULL,
+    user_id     BIGINT REFERENCES users(id)  ON DELETE SET NULL, -- NULL = the server acted
+    alert_id    BIGINT REFERENCES alerts(id) ON DELETE SET NULL,
+    detail      TEXT,
+    created_at  BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint
+);
+
+CREATE INDEX incident_events_incident_idx ON incident_events(incident_id, created_at);
+
+-- Delivery is an outbox rather than an inline HTTP call: a POST made while
+-- holding the webhook's transaction would hold a connection open across a
+-- network round trip. The webhook inserts a row; the notifier goroutine
+-- delivers it.
+CREATE TABLE notifications (
+    id          BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    incident_id BIGINT NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    -- Nullable: a notification sent to the fallback topic belongs to nobody,
+    -- because nobody was on call when the incident opened.
+    user_id     BIGINT REFERENCES users(id) ON DELETE SET NULL,
+    topic       TEXT   NOT NULL,            -- resolved at enqueue: who was on call then
+    kind        TEXT   NOT NULL CHECK (kind IN ('triggered', 'reminder', 'resolved')),
+    created_at  BIGINT NOT NULL,
+    send_after  BIGINT NOT NULL,            -- retry backoff watermark
+    attempts    BIGINT NOT NULL DEFAULT 0,
+    sent_at     BIGINT,
+    last_error  TEXT                        -- kept after the last attempt, for debugging
+);
+
+-- The delivery loop's only query: what is due and still unsent.
+CREATE INDEX notifications_pending_idx  ON notifications(send_after) WHERE sent_at IS NULL;
+-- Reminders and resolved notices both look up an incident's newest row.
+CREATE INDEX notifications_incident_idx ON notifications(incident_id, id DESC);
+
+-- A notification body is stored on the ntfy server and cached on the device, so
+-- a real API key must never appear in one. Each delivery mints its own token
+-- instead: one incident, one action, one day.
+CREATE TABLE incident_ack_tokens (
+    token_hash  TEXT   PRIMARY KEY,         -- SHA-256 of the raw token, as with api_keys
+    incident_id BIGINT NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    user_id     BIGINT NOT NULL REFERENCES users(id)     ON DELETE CASCADE,
+    created_at  BIGINT NOT NULL,
+    expires_at  BIGINT NOT NULL
+);
+
+CREATE INDEX incident_ack_tokens_expires_idx ON incident_ack_tokens(expires_at);

internal/db/migrations/001_foundation.sql

@@ -1,2 +0,0 @@
--- Stage 1 foundation. No tables yet; subsequent migrations add schema.
-SELECT 1;

internal/db/migrations/002_admin_role.sql

@@ -0,0 +1,25 @@
+-- A system administrator role, and the first thing in this server that one user
+-- can do and another cannot.
+--
+-- Until now every authenticated caller could create and delete users, set
+-- anybody's password and mint API keys for anybody — auth.go said so in a
+-- comment. That was defensible with one operator and a hand-made account; it is
+-- not once people sign themselves up (see #7).
+--
+-- EVERY EXISTING USER BECOMES AN ADMIN. They already hold these powers, so
+-- this migration changes nobody's access: it names what is already true, and
+-- leaves demotion as a deliberate act somebody performs afterwards. The
+-- alternative — promoting only user 1 — would silently strip the others, and
+-- could leave an install whose only admin is an account nobody has a password
+-- for.
+--
+-- New users are not admins: the column defaults to false, and the only ways to
+-- become one are this backfill, the bootstrap endpoint, or an existing admin
+-- granting it.
+ALTER TABLE users ADD COLUMN is_admin BOOLEAN NOT NULL DEFAULT false;
+
+UPDATE users SET is_admin = true;
+
+-- The queue's assignment dropdown and the on-call schedule read every user, and
+-- the admin screens in #5 will filter on this.
+CREATE INDEX users_is_admin_idx ON users(is_admin) WHERE is_admin;

internal/db/migrations/002_users_api_keys.sql

@@ -1,15 +0,0 @@
-CREATE TABLE users (
-    id         INTEGER PRIMARY KEY AUTOINCREMENT,
-    username   TEXT    NOT NULL UNIQUE,
-    email      TEXT    NOT NULL UNIQUE,
-    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-);
-
-CREATE TABLE api_keys (
-    id           INTEGER PRIMARY KEY AUTOINCREMENT,
-    user_id      INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    key_hash     TEXT    NOT NULL UNIQUE,
-    name         TEXT    NOT NULL,
-    created_at   INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
-    last_used_at INTEGER
-);

internal/db/migrations/003_alerts.sql

@@ -1,16 +0,0 @@
-CREATE TABLE alerts (
-    id            INTEGER PRIMARY KEY AUTOINCREMENT,
-    fingerprint   TEXT    NOT NULL UNIQUE,
-    name          TEXT    NOT NULL,
-    status        TEXT    NOT NULL CHECK(status IN ('firing', 'resolved')),
-    labels        TEXT    NOT NULL DEFAULT '{}',
-    annotations   TEXT    NOT NULL DEFAULT '{}',
-    starts_at     INTEGER NOT NULL,
-    ends_at       INTEGER,
-    generator_url TEXT    NOT NULL DEFAULT '',
-    received_at   INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-);
-
-CREATE INDEX alerts_status_idx     ON alerts(status);
-CREATE INDEX alerts_name_idx       ON alerts(name);
-CREATE INDEX alerts_received_at_idx ON alerts(received_at DESC);

internal/db/migrations/003_teams.sql

@@ -0,0 +1,103 @@
+-- Teams: the unit of tenancy. Everything a person works on now belongs to one.
+--
+-- Until this migration the install was one shared space — every user saw every
+-- alert and every incident, and the Alertmanager webhook was unauthenticated, so
+-- anything that could reach the port could open an incident for everybody.
+--
+-- The shape, in one paragraph: a team owns its incidents, alerts, schedule and
+-- integrations. A user belongs to as many teams as they like, with a role in
+-- each: an `owner` configures the team, a `member` works its incidents. An
+-- integration key is what an alert arrives on, and the key is what says which
+-- team the alert belongs to.
+--
+-- EVERYTHING EXISTING MOVES INTO ONE DEFAULT TEAM, and every existing user
+-- becomes an owner of it. That keeps an upgrade a no-op for the people using it:
+-- the same queue, the same schedule, the same incidents, with a name on them.
+
+CREATE TABLE teams (
+    id         BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    name       TEXT   NOT NULL UNIQUE,
+    created_at BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint
+);
+
+-- role is free text with a CHECK rather than an enum, so adding a third role
+-- later is a migration and not a type rewrite.
+CREATE TABLE team_members (
+    team_id   BIGINT NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+    user_id   BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    role      TEXT   NOT NULL CHECK (role IN ('owner', 'member')),
+    joined_at BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint,
+    PRIMARY KEY (team_id, user_id)
+);
+
+CREATE INDEX team_members_user_idx ON team_members(user_id);
+
+-- How alerts get in, and the only thing that says which team they belong to.
+-- The key is stored as a SHA-256 hash, like api_keys and the ack tokens: a
+-- leaked database gives nobody the ability to post alerts.
+CREATE TABLE integrations (
+    id           BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    team_id      BIGINT NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+    kind         TEXT   NOT NULL CHECK (kind IN ('alertmanager')),
+    name         TEXT   NOT NULL,
+    key_hash     TEXT   NOT NULL UNIQUE,
+    created_at   BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint,
+    last_used_at BIGINT
+);
+
+CREATE INDEX integrations_team_idx ON integrations(team_id);
+
+-- ---------------------------------------------------------------------------
+-- The default team, and everything that already exists moving into it.
+--
+-- Created unconditionally, even on an empty install, so there is always a team
+-- for the bootstrap user to land in and for the first integration to hang off.
+-- ---------------------------------------------------------------------------
+
+INSERT INTO teams (name) VALUES ('Default');
+
+INSERT INTO team_members (team_id, user_id, role)
+SELECT (SELECT id FROM teams WHERE name = 'Default'), id, 'owner' FROM users;
+
+-- ---------------------------------------------------------------------------
+-- team_id on everything a team owns.
+--
+-- Added nullable, backfilled, then made NOT NULL: adding a NOT NULL column with
+-- no default to a table with rows is rejected, and a DEFAULT pointing at the
+-- default team would quietly keep working after the default team is gone.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE alerts            ADD COLUMN team_id BIGINT REFERENCES teams(id) ON DELETE CASCADE;
+ALTER TABLE incidents         ADD COLUMN team_id BIGINT REFERENCES teams(id) ON DELETE CASCADE;
+ALTER TABLE schedule_entries  ADD COLUMN team_id BIGINT REFERENCES teams(id) ON DELETE CASCADE;
+
+UPDATE alerts           SET team_id = (SELECT id FROM teams WHERE name = 'Default');
+UPDATE incidents        SET team_id = (SELECT id FROM teams WHERE name = 'Default');
+UPDATE schedule_entries SET team_id = (SELECT id FROM teams WHERE name = 'Default');
+
+ALTER TABLE alerts           ALTER COLUMN team_id SET NOT NULL;
+ALTER TABLE incidents        ALTER COLUMN team_id SET NOT NULL;
+ALTER TABLE schedule_entries ALTER COLUMN team_id SET NOT NULL;
+
+-- ---------------------------------------------------------------------------
+-- The uniqueness rules were all written for one tenant, and every one of them
+-- is wrong now: two teams monitoring two clusters legitimately see the same
+-- fingerprint, the same groupKey, and want somebody on call on the same day.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE alerts DROP CONSTRAINT alerts_fingerprint_key;
+CREATE UNIQUE INDEX alerts_team_fingerprint_idx ON alerts(team_id, fingerprint);
+
+DROP INDEX incidents_open_group_key_idx;
+-- Still load-bearing, now per team: at most one OPEN incident per group_key
+-- within a team. This is what makes "resolved incident + a new alert occurrence
+-- = a new incident" work, and what the webhook's find-or-open lookup relies on.
+CREATE UNIQUE INDEX incidents_open_group_key_idx
+    ON incidents(team_id, group_key) WHERE resolved_at IS NULL;
+
+ALTER TABLE schedule_entries DROP CONSTRAINT schedule_entries_date_key;
+CREATE UNIQUE INDEX schedule_entries_team_date_idx ON schedule_entries(team_id, date);
+
+-- The list views all filter by team first.
+CREATE INDEX alerts_team_received_idx    ON alerts(team_id, received_at DESC);
+CREATE INDEX incidents_team_triggered_idx ON incidents(team_id, triggered_at DESC);

internal/db/migrations/004_alert_ack_comments.sql

@@ -1,12 +0,0 @@
-ALTER TABLE alerts ADD COLUMN acknowledged_by INTEGER REFERENCES users(id) ON DELETE SET NULL;
-ALTER TABLE alerts ADD COLUMN acknowledged_at INTEGER;
-
-CREATE TABLE alert_comments (
-    id         INTEGER PRIMARY KEY AUTOINCREMENT,
-    alert_id   INTEGER NOT NULL REFERENCES alerts(id)  ON DELETE CASCADE,
-    user_id    INTEGER NOT NULL REFERENCES users(id)   ON DELETE CASCADE,
-    content    TEXT    NOT NULL,
-    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-);
-
-CREATE INDEX alert_comments_alert_id_idx ON alert_comments(alert_id);

internal/db/migrations/004_team_deadman.sql

@@ -0,0 +1,39 @@
+-- Dead man's switches become a team's own configuration.
+--
+-- They were three environment variables — TERDUT_DEADMAN_MATCHERS, _TIMEOUT and
+-- _SEVERITY — which made them one setting for the whole install. That was the
+-- last piece of the alerting path a team could not control: a team could take
+-- its own alerts on its own key and still not say which of them were
+-- heartbeats, or how long a silence had to last before somebody was paged.
+--
+-- One row per team rather than one row per switch. The unit of monitoring is
+-- still the fingerprint, as it always was — two clusters sending the same
+-- heartbeat alertname are two independent switches — and the matcher string
+-- keeps the format the environment variable used, so a value can be moved from
+-- one to the other unchanged.
+--
+-- No rows are seeded here: a migration cannot read the environment. The server
+-- inserts a row per team at startup from its own configuration, and the same
+-- values therefore carry forward into the first team's row without anybody
+-- retyping them. See seedDeadmanConfigs.
+CREATE TABLE deadman_configs (
+    team_id BIGINT PRIMARY KEY REFERENCES teams(id) ON DELETE CASCADE,
+
+    -- ";" separates matchers, "," the label conditions within one, "=" is exact
+    -- equality: `alertname=Watchdog,cluster=prod; alertname=EdgeHeartbeat`.
+    -- Every matcher must name an alertname. Empty watches nothing.
+    matchers TEXT NOT NULL DEFAULT '',
+
+    -- Seconds rather than a Go duration string: the column is compared and
+    -- arithmetic is done on it, and a value that has to be parsed before it can
+    -- be believed is a value that can be stored unparseable. Zero disables the
+    -- team's switches entirely.
+    timeout_seconds BIGINT NOT NULL DEFAULT 0,
+
+    -- The severity these incidents open at. They have no member alerts to
+    -- derive one from, and a heartbeat's own severity label is meaningless —
+    -- Watchdog ships as "none".
+    severity TEXT NOT NULL DEFAULT 'critical',
+
+    updated_at BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint
+);

internal/db/migrations/005_schedule.sql

@@ -1,8 +0,0 @@
-CREATE TABLE schedule_entries (
-    id         INTEGER PRIMARY KEY AUTOINCREMENT,
-    user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    date       TEXT    NOT NULL UNIQUE,  -- YYYY-MM-DD; one person per day
-    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-);
-
-CREATE INDEX schedule_entries_date_idx ON schedule_entries(date);

internal/db/migrations/006_alert_archive.sql

@@ -1,2 +0,0 @@
-ALTER TABLE alerts ADD COLUMN archived_at INTEGER;
-CREATE INDEX alerts_archived_at_idx ON alerts(archived_at);

internal/db/migrations/007_alert_resolution_source.sql

@@ -1,4 +0,0 @@
--- Records why an alert left the firing state: 'alertmanager' when a resolved
--- webhook set it, 'expiry' when the sweeper inferred it from staleness.
--- NULL for firing alerts and for rows that predate this migration.
-ALTER TABLE alerts ADD COLUMN resolution_source TEXT;

internal/db/migrations/008_incidents.sql

@@ -1,123 +0,0 @@
--- Splits the single alerts row into two objects, the way an incident management
--- tool needs them: alerts stay the machine-owned signal record that Alertmanager
--- writes, and incidents become the human work item people acknowledge, assign,
--- snooze, discuss and resolve.
---
--- Correlation uses Alertmanager's own groupKey, so incidents follow the group_by
--- routing tree the operator already tuned rather than a second grouping scheme
--- invented here.
-
-CREATE TABLE incidents (
-    id                INTEGER PRIMARY KEY AUTOINCREMENT,
-    group_key         TEXT    NOT NULL,              -- Alertmanager groupKey, opaque
-    title             TEXT    NOT NULL,              -- rendered from group_labels
-    group_labels      TEXT    NOT NULL DEFAULT '{}', -- JSON
-    status            TEXT    NOT NULL CHECK(status IN ('triggered', 'acknowledged', 'resolved')),
-    severity          TEXT,                          -- highest `severity` label across firing members
-    triggered_at      INTEGER NOT NULL,
-    acknowledged_by   INTEGER REFERENCES users(id) ON DELETE SET NULL,
-    acknowledged_at   INTEGER,
-    assigned_to       INTEGER REFERENCES users(id) ON DELETE SET NULL,
-    snoozed_until     INTEGER,
-    resolved_at       INTEGER,
-    resolution_source TEXT,                          -- 'alerts' | 'manual'
-    archived_at       INTEGER
-);
-
--- Load-bearing: at most one OPEN incident per group_key. This is what makes
--- "resolved incident + a new alert occurrence = a new incident" work, and it is
--- the constraint the webhook's find-or-open lookup relies on.
-CREATE UNIQUE INDEX incidents_open_group_key_idx ON incidents(group_key) WHERE resolved_at IS NULL;
-CREATE INDEX incidents_status_idx       ON incidents(status);
-CREATE INDEX incidents_triggered_at_idx ON incidents(triggered_at DESC);
-CREATE INDEX incidents_archived_at_idx  ON incidents(archived_at);
-
--- Membership is historical, not a pointer on alerts: one alert row (one
--- fingerprint) resolves and re-fires over time and belongs to a different
--- incident each occurrence.
-CREATE TABLE incident_alerts (
-    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
-    alert_id    INTEGER NOT NULL REFERENCES alerts(id)    ON DELETE CASCADE,
-    added_at    INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
-    PRIMARY KEY (incident_id, alert_id)
-);
-
-CREATE INDEX incident_alerts_alert_id_idx ON incident_alerts(alert_id);
-
--- The timeline. Append-only, and the only history this server keeps: alert rows
--- are mutated in place, so without this there is no record that anything
--- happened. Notes are events too, so one query renders the whole story.
-CREATE TABLE incident_events (
-    id          INTEGER PRIMARY KEY AUTOINCREMENT,
-    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
-    -- triggered | alert_added | alert_resolved | acknowledged | unacknowledged
-    -- | assigned | snoozed | unsnoozed | resolved | note
-    type        TEXT    NOT NULL,
-    user_id     INTEGER REFERENCES users(id)  ON DELETE SET NULL, -- NULL = the server acted
-    alert_id    INTEGER REFERENCES alerts(id) ON DELETE SET NULL,
-    detail      TEXT,
-    created_at  INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-);
-
-CREATE INDEX incident_events_incident_idx ON incident_events(incident_id, created_at);
-
--- ---------------------------------------------------------------------------
--- Backfill
---
--- Every pre-existing alert gets its own incident, archived ones included, so no
--- acknowledgement and no comment is orphaned. There is no historical groupKey to
--- correlate on, hence one incident per fingerprint under a 'backfill:' prefix
--- that can never collide with a real Alertmanager groupKey.
--- ---------------------------------------------------------------------------
-
-INSERT INTO incidents (group_key, title, group_labels, status, severity, triggered_at,
-                       acknowledged_by, acknowledged_at, assigned_to,
-                       resolved_at, resolution_source, archived_at)
-SELECT 'backfill:' || a.fingerprint,
-       a.name,
-       json_object('alertname', a.name),
-       CASE WHEN a.status = 'resolved'          THEN 'resolved'
-            WHEN a.acknowledged_by IS NOT NULL  THEN 'acknowledged'
-            ELSE 'triggered' END,
-       json_extract(a.labels, '$.severity'),
-       a.starts_at,
-       a.acknowledged_by,
-       a.acknowledged_at,
-       a.acknowledged_by,
-       CASE WHEN a.status = 'resolved' THEN COALESCE(a.ends_at, a.received_at) END,
-       CASE WHEN a.status = 'resolved' THEN 'alerts' END,
-       a.archived_at
-FROM alerts a;
-
-INSERT INTO incident_alerts (incident_id, alert_id, added_at)
-SELECT i.id, a.id, a.starts_at
-FROM alerts a
-JOIN incidents i ON i.group_key = 'backfill:' || a.fingerprint;
-
-INSERT INTO incident_events (incident_id, type, alert_id, created_at)
-SELECT i.id, 'triggered', ia.alert_id, i.triggered_at
-FROM incidents i JOIN incident_alerts ia ON ia.incident_id = i.id;
-
-INSERT INTO incident_events (incident_id, type, user_id, created_at)
-SELECT i.id, 'acknowledged', i.acknowledged_by, i.acknowledged_at
-FROM incidents i WHERE i.acknowledged_at IS NOT NULL;
-
-INSERT INTO incident_events (incident_id, type, created_at)
-SELECT i.id, 'resolved', i.resolved_at
-FROM incidents i WHERE i.resolved_at IS NOT NULL;
-
-INSERT INTO incident_events (incident_id, type, user_id, alert_id, detail, created_at)
-SELECT ia.incident_id, 'note', c.user_id, c.alert_id, c.content, c.created_at
-FROM alert_comments c
-JOIN incident_alerts ia ON ia.alert_id = c.alert_id;
-
--- ---------------------------------------------------------------------------
--- Workflow state now lives on incidents only. Leaving these behind would keep
--- the bug they caused: the webhook upsert owns the alerts row and never cleared
--- the acknowledgement, so a re-fire days later still read as acknowledged.
--- ---------------------------------------------------------------------------
-
-DROP TABLE alert_comments;
-
-ALTER TABLE alerts DROP COLUMN acknowledged_by;
-ALTER TABLE alerts DROP COLUMN acknowledged_at;

internal/db/migrations/009_notifications.sql

@@ -1,44 +0,0 @@
--- Adds push notification delivery, so an incident reaches the person on call
--- instead of waiting to be discovered.
---
--- Delivery is an outbox rather than an inline HTTP call: the pool is limited to
--- a single connection, so a POST made while holding the webhook's transaction
--- would stall every other request behind it. The webhook inserts a row; the
--- notifier goroutine delivers it.
-
-CREATE TABLE notifications (
-    id          INTEGER PRIMARY KEY AUTOINCREMENT,
-    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
-    -- Nullable: a notification sent to the fallback topic belongs to nobody,
-    -- because nobody was on call when the incident opened.
-    user_id     INTEGER REFERENCES users(id) ON DELETE SET NULL,
-    topic       TEXT    NOT NULL,              -- resolved at enqueue: who was on call then
-    kind        TEXT    NOT NULL CHECK(kind IN ('triggered', 'reminder', 'resolved')),
-    created_at  INTEGER NOT NULL,
-    send_after  INTEGER NOT NULL,              -- retry backoff watermark
-    attempts    INTEGER NOT NULL DEFAULT 0,
-    sent_at     INTEGER,
-    last_error  TEXT                           -- kept after the last attempt, for debugging
-);
-
--- The delivery loop's only query: what is due and still unsent.
-CREATE INDEX notifications_pending_idx  ON notifications(send_after) WHERE sent_at IS NULL;
--- Reminders and resolved notices both look up an incident's newest row.
-CREATE INDEX notifications_incident_idx ON notifications(incident_id, id DESC);
-
--- A notification body is stored on the ntfy server and cached on the device, so
--- a real API key must never appear in one. Each delivery mints its own token
--- instead: one incident, one action, one day.
-CREATE TABLE incident_ack_tokens (
-    token_hash  TEXT    PRIMARY KEY,           -- SHA-256 of the raw token, as with api_keys
-    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
-    user_id     INTEGER NOT NULL REFERENCES users(id)     ON DELETE CASCADE,
-    created_at  INTEGER NOT NULL,
-    expires_at  INTEGER NOT NULL
-);
-
-CREATE INDEX incident_ack_tokens_expires_idx ON incident_ack_tokens(expires_at);
-
--- Where this user's notifications go. NULL means they get none; incidents
--- assigned to them fall back to the configured fallback topic.
-ALTER TABLE users ADD COLUMN ntfy_topic TEXT;

internal/db/migrations/010_web_auth.sql

@@ -1,18 +0,0 @@
--- A password is what lets a person sign in to the web UI. NULL means the user
--- has none and can only use API keys, which is every user created before this.
-ALTER TABLE users ADD COLUMN password_hash TEXT;
-
--- A session is a browser's credential, the cookie counterpart of an API key:
--- only the hash of the token is stored. expires_at slides forward while the
--- session is in use, so an on-call phone stays signed in.
-CREATE TABLE sessions (
-    id           INTEGER PRIMARY KEY AUTOINCREMENT,
-    token_hash   TEXT    NOT NULL UNIQUE,
-    user_id      INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    created_at   INTEGER NOT NULL,
-    last_seen_at INTEGER NOT NULL,
-    expires_at   INTEGER NOT NULL,
-    user_agent   TEXT
-);
-
-CREATE INDEX idx_sessions_user ON sessions(user_id);

internal/models/alert.go

@@ -8,6 +8,12 @@ import "time"
 // Incident an alert belongs to.
 type Alert struct {
 	ID int64 `json:"id"`
+
+	// TeamID is the team whose integration received this alert, and TeamName
+	// rides along so a combined list can label a row without a second request.
+	TeamID   int64  `json:"team_id"`
+	TeamName string `json:"team_name,omitempty"`
+
 	Fingerprint  string            `json:"fingerprint"`
 	Name         string            `json:"name"`
 	Status       string            `json:"status"` // "firing" or "resolved"

internal/models/incident.go

@@ -11,6 +11,12 @@ import "time"
 // the webhook and the sweeper may flip to "resolved" once every member alert has
 // stopped firing.
 type Incident struct {
+	// TeamID is the team that owns this incident, fixed when it opens: an
+	// incident never moves between teams. TeamName rides along so the combined
+	// queue can badge each row without a second request.
+	TeamID   int64  `json:"team_id"`
+	TeamName string `json:"team_name,omitempty"`
+
 	ID          int64             `json:"id"`
 	GroupKey    string            `json:"group_key"`
 	Title       string            `json:"title"`

internal/models/schedule.go

@@ -4,6 +4,13 @@ import "time"
 
 type ScheduleEntry struct {
 	ID int64 `json:"id"`
+
+	// TeamID is whose rota this shift belongs to; TeamName rides along so the
+	// combined "who is on call" view can label each entry without a second
+	// request.
+	TeamID   int64  `json:"team_id"`
+	TeamName string `json:"team_name,omitempty"`
+
 	UserID    int64     `json:"user_id"`
 	Username  string    `json:"username"`
 	Date      string    `json:"date"` // YYYY-MM-DD

internal/models/team.go

@@ -0,0 +1,54 @@
+package models
+
+import "time"
+
+// Team is the unit of tenancy: it owns its incidents, alerts, schedule and
+// integrations, and a user sees exactly the teams they belong to.
+type Team struct {
+	ID        int64     `json:"id"`
+	Name      string    `json:"name"`
+	CreatedAt time.Time `json:"created_at"`
+
+	// Role is the caller's own role in this team, populated when a team is
+	// listed for a particular person. Empty when nobody in particular is
+	// asking, as in the admin listing.
+	Role string `json:"role,omitempty"`
+}
+
+// Team roles. An owner configures the team — its schedule, its integrations and
+// who is in it. A member works its incidents.
+const (
+	RoleOwner  = "owner"
+	RoleMember = "member"
+)
+
+// TeamMember is one person's membership of one team.
+type TeamMember struct {
+	TeamID   int64     `json:"team_id"`
+	UserID   int64     `json:"user_id"`
+	Username string    `json:"username"`
+	Role     string    `json:"role"`
+	JoinedAt time.Time `json:"joined_at"`
+}
+
+// Integration is how alerts get in, and the only thing that says which team an
+// arriving alert belongs to.
+type Integration struct {
+	ID         int64      `json:"id"`
+	TeamID     int64      `json:"team_id"`
+	Kind       string     `json:"kind"`
+	Name       string     `json:"name"`
+	CreatedAt  time.Time  `json:"created_at"`
+	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
+
+	// Key is the raw integration key, shown once when the integration is
+	// created and never stored. URL is the address to point the sender at,
+	// likewise only complete at creation time.
+	Key string `json:"key,omitempty"`
+	URL string `json:"url,omitempty"`
+}
+
+// Integration kinds.
+const (
+	IntegrationAlertmanager = "alertmanager"
+)

internal/models/user.go

@@ -12,6 +12,12 @@ type User struct {
 	// none of their own; incidents assigned to them fall back to the configured
 	// fallback topic instead.
 	NtfyTopic *string `json:"ntfy_topic,omitempty"`
+
+	// IsAdmin is the system administrator flag: managing users and API keys.
+	// Not omitempty — a client has to be able to tell "false" from "this server
+	// is too old to have the field", and the web UI decides what to show from
+	// it.
+	IsAdmin bool `json:"is_admin"`
 }
 
 type APIKey struct {

internal/web/static/app.css

@@ -285,6 +285,16 @@ input:focus, textarea:focus { outline: none; border-color: var(--accent); box-sh
   min-width: 0;
 }
 .row-meta .labels { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; min-width: 0; max-width: 100%; color: var(--faint); }
+/* Which team's queue a row came from. Only rendered for somebody in more than
+   one team, so it never repeats the same word down the whole list. */
+/* Separates the status chips from the team chips in the queue's filter row. */
+.chip-sep { width: 1px; align-self: stretch; background: var(--border); margin: 0 2px; }
+
+.row-team {
+  padding: 1px 6px; border-radius: 4px;
+  background: var(--surface-2); border: 1px solid var(--border);
+  color: var(--muted); font-size: 12px; white-space: nowrap;
+}
 .row.resolved .row-title { color: var(--muted); }
 
 .sev-critical { --sev: var(--crit); }

internal/web/static/js/api.js

@@ -87,12 +87,11 @@ export const deleteNote = (id, eventID) => call('DELETE', `/incidents/${id}/note
 export const alerts = (query, opts) => call('GET', '/alerts', { query, ...opts });
 
 // schedule
-export const schedule = (from, to) => call('GET', '/schedule', { query: { from, to } });
-export async function onCallNow() {
-  try {
-    return await call('GET', '/schedule/current');
-  } catch (err) {
-    if (err instanceof ApiError && err.status === 404) return null;
-    throw err;
-  }
-}
+export const teams = () => call('GET', '/teams');
+export const schedule = (teamID, from, to) =>
+  call('GET', `/teams/${teamID}/schedule`, { query: { from, to } });
+
+// One entry per team the viewer belongs to, for the teams that have somebody
+// scheduled today. An empty array means nobody anywhere, which is a real answer
+// rather than an error — unlike the pre-teams endpoint, which 404ed.
+export const onCallNow = () => call('GET', '/schedule/current');

internal/web/static/js/app.js

@@ -3,7 +3,7 @@
 import * as api from './api.js';
 import * as ui from './ui.js';
 import * as poll from './poll.js';
-import { state, reset } from './state.js';
+import { state, reset, loadTeams } from './state.js';
 import * as queue from './queue.js';
 import * as incident from './incident.js';
 import * as oncall from './oncall.js';
@@ -141,6 +141,7 @@ async function boot() {
 
   try {
     state.me = await api.me();
+    await loadTeams();
     showApp();
   } catch (err) {
     if (err.status === 401) showLogin();

internal/web/static/js/oncall.js

@@ -1,10 +1,14 @@
 // On-call: who is on duty now, the week around it, and your own next shifts.
 // Read-only for now; the TUI edits the schedule.
+//
+// One team's rota at a time — the viewer's first team, since a viewer in one
+// team has nothing to choose between. "On call now" is the exception and shows
+// every team the viewer is in, because somebody on two rotas wants both.
 
 import * as api from './api.js';
 import { h, clear, icon, spinner } from './ui.js';
 import { isoDate, mondayOf, addDays, isoWeek, initial } from './format.js';
-import { myID } from './state.js';
+import { myID, currentTeam } from './state.js';
 
 const view = () => document.getElementById('view-oncall');
 
@@ -24,10 +28,17 @@ export async function refresh() {
   const start = weekStart;
   const today = new Date();
   try {
+    const team = currentTeam();
+    if (!team) {
+      data = { now: [], week: [], upcoming: [] };
+      error = null;
+      render();
+      return;
+    }
     const [now, week, upcoming] = await Promise.all([
       api.onCallNow(),
-      api.schedule(isoDate(start), isoDate(addDays(start, 6))),
-      api.schedule(isoDate(today), isoDate(addDays(today, 60))),
+      api.schedule(team.id, isoDate(start), isoDate(addDays(start, 6))),
+      api.schedule(team.id, isoDate(today), isoDate(addDays(today, 60))),
     ]);
     if (start !== weekStart) return;
     data = { now, week, upcoming };
@@ -60,16 +71,33 @@ function you(userID) {
   return userID === myID() ? h('span', { class: 'you', text: 'you' }) : null;
 }
 
+// One card per team with somebody on call, and a single empty card when there
+// is nobody anywhere. The team's name is shown only when the viewer is in more
+// than one, so the common case reads exactly as it did before teams existed.
 function nowCard() {
-  const n = data.now;
+  const entries = data.now || [];
+  const showTeam = entries.length > 1;
+  if (entries.length === 0) {
     return h('div', { class: 'card now-card' },
-    h('div', { class: `avatar ${n ? '' : 'none'}`, text: n ? initial(n.username) : '–' }),
+      h('div', { class: 'avatar none', text: '–' }),
       h('div', {},
         h('div', { class: 'now-label', text: 'On call now' }),
-      h('div', { class: 'now-name' }, n ? n.username : 'Nobody', n && you(n.user_id)),
+        h('div', { class: 'now-name', text: 'Nobody' }),
       ),
     );
   }
+  return h('div', {}, ...entries.map((n) =>
+    h('div', { class: 'card now-card' },
+      h('div', { class: 'avatar', text: initial(n.username) }),
+      h('div', {},
+        h('div', {
+          class: 'now-label',
+          text: showTeam ? `On call now · ${n.team_name}` : 'On call now',
+        }),
+        h('div', { class: 'now-name' }, n.username, you(n.user_id)),
+      ),
+    )));
+}
 
 function weekCard() {
   const byDate = new Map(data.week.map((e) => [e.date, e]));

internal/web/static/js/queue.js

@@ -26,12 +26,32 @@ const EMPTY = {
 };
 
 let filter = loadFilter();
+let teamFilter = loadTeamFilter(); // '' for every team the viewer is in
 let items = null; // null while loading
 let error = null;
 let selected = null;
 let cursor = -1; // keyboard position in the list
 let built = false;
 
+function loadTeamFilter() {
+  try {
+    return sessionStorage.getItem('terdut.queue.team') || '';
+  } catch {
+    return '';
+  }
+}
+
+function setTeamFilter(id) {
+  teamFilter = id;
+  try {
+    sessionStorage.setItem('terdut.queue.team', id);
+  } catch {
+    /* storage unavailable */
+  }
+  renderChips();
+  refresh({ fresh: true });
+}
+
 function loadFilter() {
   try {
     const f = sessionStorage.getItem('terdut.queue.filter');
@@ -64,7 +84,11 @@ export async function refresh({ fresh = false } = {}) {
   const requested = filter;
   try {
     // The open list is already fetched for the badges; no need to ask twice.
-    const result = filter === 'open' && !fresh ? state.open : await api.incidents(f.query);
+    // The cached open queue covers every team, so it can only be reused when
+    // no team filter is applied.
+    const query = teamFilter ? { ...f.query, team_id: teamFilter } : f.query;
+    const cached = filter === 'open' && !fresh && !teamFilter;
+    const result = cached ? state.open : await api.incidents(query);
     if (requested !== filter) return;
     items = result;
     error = null;
@@ -88,7 +112,7 @@ function setFilter(id) {
 
 function renderChips() {
   const el = document.getElementById('queue-filters');
-  clear(el, FILTERS.map((f) =>
+  const chips = FILTERS.map((f) =>
     h('button', {
       class: 'chip',
       type: 'button',
@@ -97,7 +121,34 @@ function renderChips() {
       onclick: () => setFilter(f.id),
       text: f.label,
     }),
-  ));
+  );
+
+  // Somebody in one team has nothing to choose between, so the row of team
+  // chips appears only when there is more than one. The default is all of
+  // them: the combined queue is the point.
+  if (state.teams.length > 1) {
+    chips.push(h('span', { class: 'chip-sep' }));
+    chips.push(h('button', {
+      class: 'chip',
+      type: 'button',
+      role: 'tab',
+      'aria-selected': String(teamFilter === ''),
+      onclick: () => setTeamFilter(''),
+      text: 'All teams',
+    }));
+    for (const team of state.teams) {
+      chips.push(h('button', {
+        class: 'chip',
+        type: 'button',
+        role: 'tab',
+        'aria-selected': String(teamFilter === String(team.id)),
+        onclick: () => setTeamFilter(String(team.id)),
+        text: team.name,
+      }));
+    }
+  }
+
+  clear(el, chips);
 }
 
 function renderList() {
@@ -142,6 +193,13 @@ function row(inc, index) {
   // The server already puts the group labels in the title; show only the rest.
   const labels = labelSummary(Object.fromEntries(
     Object.entries(inc.group_labels || {}).filter(([k, v]) => !inc.title.includes(`${k}=${v}`))));
+  // The team is shown only to somebody who is in more than one. For everybody
+  // else it is the same word on every row, which is noise rather than
+  // information.
+  const team = state.teams.length > 1 && inc.team_name
+    ? h('span', { class: 'row-team', text: inc.team_name })
+    : null;
+
   return h('a', {
     class: `row ${severityClass(inc.severity)} ${resolved ? 'resolved' : ''} ${index === cursor ? 'kbd-focus' : ''}`,
     href: `/incidents/${inc.id}`,
@@ -153,6 +211,7 @@ function row(inc, index) {
     h('div', { class: 'row-meta' },
       status,
       assignee,
+      team,
       labels && h('span', { class: 'labels', text: labels }),
     ),
   );

internal/web/static/js/state.js

@@ -6,8 +6,15 @@ import * as api from './api.js';
 export const state = {
   me: null, // { user, has_password }
   open: [], // the default queue: open, not snoozed
+  teams: [], // the teams the viewer belongs to, each with their role
 };
 
+// The team whose schedule and settings the views act on. A viewer in one team —
+// which is everybody until somebody makes a second — never has to choose.
+export function currentTeam() {
+  return state.teams[0] || null;
+}
+
 export function myID() {
   return state.me ? state.me.user.id : null;
 }
@@ -24,8 +31,14 @@ export async function users() {
   return usersCache;
 }
 
+export async function loadTeams() {
+  state.teams = await api.teams();
+  return state.teams;
+}
+
 export function reset() {
   state.me = null;
   state.open = [];
+  state.teams = [];
   usersCache = null;
 }

scripts/sqlite-to-postgres.go

@@ -0,0 +1,198 @@
+//go:build migrate
+
+// Command sqlite-to-postgres copies a terdut SQLite database into a freshly
+// migrated Postgres one. It exists for exactly one upgrade — the one that moved
+// this server off SQLite — and should be deleted once the installs that need it
+// have run it. The modernc.org/sqlite dependency goes with it.
+//
+// Build-tagged so the dependency stays out of the server binary and out of a
+// plain `go build ./...`:
+//
+//	go run -tags migrate ./scripts/sqlite-to-postgres.go \
+//	    -sqlite /path/to/terdut.db \
+//	    -dsn 'postgres://terdut:secret@localhost:5432/terdut?sslmode=disable'
+//
+// The Postgres side must already have the schema: start the new server once
+// against an empty database, let it migrate, stop it, then run this. The copy
+// refuses to touch a database that already has rows, so a second run cannot
+// double-insert.
+//
+// Ids are preserved, which is what keeps every foreign key — incident_alerts,
+// incident_events, notifications, the ack tokens — pointing at the same rows it
+// pointed at before. The identity sequences are moved past the copied ids at the
+// end, so the first row the server writes afterwards does not collide.
+package main
+
+import (
+	"database/sql"
+	"flag"
+	"fmt"
+	"log"
+	"strings"
+
+	_ "github.com/jackc/pgx/v5/stdlib"
+	_ "modernc.org/sqlite"
+)
+
+// tables are copied parents first: every foreign key points at a table earlier
+// in this list.
+var tables = []struct {
+	name    string
+	columns []string
+	// jsonb marks columns that were TEXT in SQLite and are jsonb in Postgres,
+	// so the insert can cast them.
+	jsonb []string
+	// sequence is the identity sequence to advance afterwards, empty when the
+	// table has no generated id.
+	sequence string
+}{
+	{name: "users", columns: []string{"id", "username", "email", "created_at", "ntfy_topic", "password_hash"}, sequence: "users_id_seq"},
+	{name: "api_keys", columns: []string{"id", "user_id", "key_hash", "name", "created_at", "last_used_at"}, sequence: "api_keys_id_seq"},
+	{name: "sessions", columns: []string{"id", "token_hash", "user_id", "created_at", "last_seen_at", "expires_at", "user_agent"}, sequence: "sessions_id_seq"},
+	{name: "alerts", columns: []string{"id", "fingerprint", "name", "status", "labels", "annotations", "starts_at", "ends_at", "generator_url", "received_at", "archived_at", "resolution_source"}, jsonb: []string{"labels", "annotations"}, sequence: "alerts_id_seq"},
+	{name: "schedule_entries", columns: []string{"id", "user_id", "date", "created_at"}, sequence: "schedule_entries_id_seq"},
+	{name: "incidents", columns: []string{"id", "group_key", "title", "group_labels", "status", "severity", "triggered_at", "acknowledged_by", "acknowledged_at", "assigned_to", "snoozed_until", "resolved_at", "resolution_source", "archived_at"}, jsonb: []string{"group_labels"}, sequence: "incidents_id_seq"},
+	{name: "incident_alerts", columns: []string{"incident_id", "alert_id", "added_at"}},
+	{name: "incident_events", columns: []string{"id", "incident_id", "type", "user_id", "alert_id", "detail", "created_at"}, sequence: "incident_events_id_seq"},
+	{name: "notifications", columns: []string{"id", "incident_id", "user_id", "topic", "kind", "created_at", "send_after", "attempts", "sent_at", "last_error"}, sequence: "notifications_id_seq"},
+	{name: "incident_ack_tokens", columns: []string{"token_hash", "incident_id", "user_id", "created_at", "expires_at"}},
+}
+
+func main() {
+	sqlitePath := flag.String("sqlite", "", "path to the existing terdut SQLite database")
+	dsn := flag.String("dsn", "", "Postgres DSN of the migrated, empty database")
+	flag.Parse()
+
+	if *sqlitePath == "" || *dsn == "" {
+		log.Fatal("both -sqlite and -dsn are required")
+	}
+
+	src, err := sql.Open("sqlite", *sqlitePath)
+	if err != nil {
+		log.Fatalf("open sqlite: %v", err)
+	}
+	defer src.Close()
+
+	dst, err := sql.Open("pgx", *dsn)
+	if err != nil {
+		log.Fatalf("open postgres: %v", err)
+	}
+	defer dst.Close()
+
+	if err := dst.Ping(); err != nil {
+		log.Fatalf("ping postgres: %v", err)
+	}
+	if err := assertEmpty(dst); err != nil {
+		log.Fatalf("%v", err)
+	}
+
+	// One transaction for the whole copy: a run that dies half way leaves the
+	// target as it found it, rather than a partial database someone has to
+	// recognise as partial.
+	tx, err := dst.Begin()
+	if err != nil {
+		log.Fatalf("begin: %v", err)
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	for _, t := range tables {
+		n, err := copyTable(src, tx, t.name, t.columns, t.jsonb)
+		if err != nil {
+			log.Fatalf("copy %s: %v", t.name, err)
+		}
+		log.Printf("%-20s %d row(s)", t.name, n)
+	}
+
+	for _, t := range tables {
+		if t.sequence == "" {
+			continue
+		}
+		if err := advanceSequence(tx, t.sequence, t.name); err != nil {
+			log.Fatalf("advance %s: %v", t.sequence, err)
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		log.Fatalf("commit: %v", err)
+	}
+	log.Print("done")
+}
+
+// assertEmpty refuses a target that already holds data, so running this twice
+// cannot duplicate anything.
+func assertEmpty(dst *sql.DB) error {
+	for _, t := range tables {
+		var n int64
+		if err := dst.QueryRow("SELECT COUNT(*) FROM " + t.name).Scan(&n); err != nil {
+			return fmt.Errorf("count %s (has the new server migrated this database?): %w", t.name, err)
+		}
+		if n > 0 {
+			return fmt.Errorf("%s already has %d row(s): the target must be empty", t.name, n)
+		}
+	}
+	return nil
+}
+
+func copyTable(src *sql.DB, tx *sql.Tx, table string, columns, jsonb []string) (int64, error) {
+	rows, err := src.Query("SELECT " + strings.Join(columns, ", ") + " FROM " + table)
+	if err != nil {
+		return 0, err
+	}
+	defer rows.Close()
+
+	insert := "INSERT INTO " + table + " (" + strings.Join(columns, ", ") + ") VALUES (" +
+		strings.Join(valuePlaceholders(columns, jsonb), ", ") + ")"
+
+	stmt, err := tx.Prepare(insert)
+	if err != nil {
+		return 0, err
+	}
+	defer stmt.Close()
+
+	var copied int64
+	for rows.Next() {
+		// Scanning into any lets the SQLite driver decide each column's Go type
+		// and hands it straight back to pgx, which is all this needs: the column
+		// types match on both sides, apart from the JSON casts above.
+		values := make([]any, len(columns))
+		targets := make([]any, len(columns))
+		for i := range values {
+			targets[i] = &values[i]
+		}
+		if err := rows.Scan(targets...); err != nil {
+			return copied, err
+		}
+		if _, err := stmt.Exec(values...); err != nil {
+			return copied, fmt.Errorf("insert row %d: %w", copied+1, err)
+		}
+		copied++
+	}
+	return copied, rows.Err()
+}
+
+// valuePlaceholders numbers the placeholders, casting the columns that became
+// jsonb: pgx sends a Go string as text, and Postgres will not assign text to a
+// jsonb column without being told.
+func valuePlaceholders(columns, jsonb []string) []string {
+	isJSON := make(map[string]bool, len(jsonb))
+	for _, c := range jsonb {
+		isJSON[c] = true
+	}
+	out := make([]string, len(columns))
+	for i, c := range columns {
+		out[i] = fmt.Sprintf("$%d", i+1)
+		if isJSON[c] {
+			out[i] += "::jsonb"
+		}
+	}
+	return out
+}
+
+// advanceSequence puts an identity sequence past the largest copied id. Without
+// it the first insert after the migration would reuse id 1.
+func advanceSequence(tx *sql.Tx, sequence, table string) error {
+	_, err := tx.Exec(fmt.Sprintf(
+		`SELECT setval('%s', COALESCE((SELECT MAX(id) FROM %s), 0) + 1, false)`,
+		sequence, table))
+	return err
+}