@de-otio/trellis 0.7.1 → 0.10.0

package/prisma/migrations/20260602162901_research_foundations/migration.sql

@@ -0,0 +1,65 @@
+-- Research foundations (one-way-door): purpose-tagged append-only consent,
+-- a fail-closed age signal, and groundwork for keyed research pseudonyms.
+--
+-- DATA-PRESERVING: the old `cross_region_consent` table is RENAMED to
+-- `consent` (NOT dropped + recreated), so existing cross-region consent rows
+-- survive. New columns are added with backfill-safe defaults.
+
+-- ── 1. ConsentPurpose enum ───────────────────────────────────────────────
+CREATE TYPE "ConsentPurpose" AS ENUM (
+    'CROSS_REGION',
+    'RESEARCH_OBSERVATION',
+    'RESEARCH_PARTICIPATION'
+);
+
+-- ── 2. Rename table cross_region_consent -> consent (data-preserving) ─────
+ALTER TABLE "cross_region_consent" RENAME TO "consent";
+
+-- Rename the carried-over constraints/indexes to the new table name so they
+-- match Prisma's generated names and drift detection stays quiet.
+ALTER TABLE "consent" RENAME CONSTRAINT "cross_region_consent_pkey" TO "consent_pkey";
+ALTER TABLE "consent" RENAME CONSTRAINT "cross_region_consent_user_id_fkey" TO "consent_user_id_fkey";
+ALTER INDEX "cross_region_consent_user_id_idx" RENAME TO "consent_user_id_idx";
+ALTER INDEX "cross_region_consent_consented_idx" RENAME TO "consent_consented_idx";
+ALTER INDEX "cross_region_consent_data_region_access_region_idx" RENAME TO "consent_data_region_access_region_idx";
+
+-- ── 3. Drop the old whole-table cross-region unique constraint ────────────
+-- It is replaced below by a PARTIAL unique index scoped to active CROSS_REGION
+-- rows. The append-only design needs many historical rows per triple, so a
+-- whole-table unique on (user_id, data_region, access_region) no longer holds.
+DROP INDEX "cross_region_consent_user_id_data_region_access_region_key";
+
+-- ── 4. Add new columns ────────────────────────────────────────────────────
+ALTER TABLE "consent"
+    ADD COLUMN "purpose" "ConsentPurpose" NOT NULL DEFAULT 'CROSS_REGION',
+    ADD COLUMN "study_id" TEXT,
+    ADD COLUMN "active" BOOLEAN NOT NULL DEFAULT true,
+    ADD COLUMN "superseded_at" TIMESTAMP(3);
+
+-- ── 5. Make region columns nullable (set only on CROSS_REGION rows) ───────
+ALTER TABLE "consent" ALTER COLUMN "data_region" DROP NOT NULL;
+ALTER TABLE "consent" ALTER COLUMN "access_region" DROP NOT NULL;
+
+-- ── 6. Uniqueness ─────────────────────────────────────────────────────────
+-- 6a. Research rows (study_id non-null). NOTE: Postgres treats NULLs as
+--     DISTINCT, so this composite does NOT constrain CROSS_REGION rows
+--     (study_id is NULL there) — by design.
+CREATE UNIQUE INDEX "consent_user_id_purpose_study_id_key"
+    ON "consent" ("user_id", "purpose", "study_id");
+
+-- 6b. CROSS_REGION rows: a PARTIAL unique index keyed on ACTIVE rows only.
+--     This preserves the pre-existing guarantee of at most one current
+--     cross-region consent per (user, data_region, access_region) without
+--     blocking the append-only history of superseded rows.
+CREATE UNIQUE INDEX "consent_cross_region_key"
+    ON "consent" ("user_id", "data_region", "access_region")
+    WHERE "purpose" = 'CROSS_REGION' AND "active";
+
+-- 6c. Helper index for current-state lookups by (user, purpose).
+CREATE INDEX "consent_user_id_purpose_active_idx"
+    ON "consent" ("user_id", "purpose", "active");
+
+-- ── 7. Fail-CLOSED research age signal on users ───────────────────────────
+-- Defaults false: existing rows are NOT auto age-verified. `ageTier` is never
+-- an includability signal; research/cohort queries gate on age_verified = true.
+ALTER TABLE "users" ADD COLUMN "age_verified" BOOLEAN NOT NULL DEFAULT false;

package/prisma/migrations/20260604130000_surveillance_phase0_enablers/migration.sql

@@ -0,0 +1,107 @@
+-- Surveillance-hardening Phase 0 — schema enablers (P1).
+-- See doc/02-technical/surveillance-threat-model/ and
+-- plans/surveillance-hardening-phase0/01-schema-enablers.md.
+--
+-- Additive except for SecurityEvent.retention_until -> NOT NULL and the
+-- feature_toggles unique-constraint change (single global-unique index
+-- replaced by a (key, tenant_id) unique + a PARTIAL global-unique index).
+-- Nothing is live; this migration assumes no pre-existing rows that would
+-- violate the new NOT NULL / unique constraints.
+
+-- CreateEnum
+CREATE TYPE "SignupMethod" AS ENUM ('COGNITO', 'INVITE', 'MAGIC_LINK');
+
+-- CreateEnum
+CREATE TYPE "ReportType" AS ENUM ('LINK', 'ACCOUNT');
+
+-- AlterEnum
+ALTER TYPE "UserRole" ADD VALUE 'MODERATOR';
+
+-- DropIndex
+DROP INDEX "feature_toggles_key_key";
+
+-- AlterTable
+ALTER TABLE "feature_toggles" ADD COLUMN     "tenant_id" TEXT;
+
+-- AlterTable
+ALTER TABLE "security_events" ALTER COLUMN "retention_until" SET NOT NULL;
+
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN     "invitation_id" TEXT,
+ADD COLUMN     "signup_method" "SignupMethod";
+
+-- CreateTable
+CREATE TABLE "interaction_events" (
+    "id" TEXT NOT NULL,
+    "actor_user_id" TEXT NOT NULL,
+    "target_type" TEXT NOT NULL,
+    "target_id" TEXT NOT NULL,
+    "interaction_type" TEXT NOT NULL,
+    "tenant_id" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "interaction_events_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "reports" (
+    "id" TEXT NOT NULL,
+    "report_type" "ReportType" NOT NULL,
+    "resource_type" TEXT NOT NULL,
+    "resource_id" TEXT NOT NULL,
+    "reporter_user_id" TEXT NOT NULL,
+    "reason" TEXT,
+    "status" TEXT NOT NULL DEFAULT 'pending',
+    "assignee_user_id" TEXT,
+    "resolved_at" TIMESTAMP(3),
+    "resolution" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "reports_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "interaction_events_actor_user_id_created_at_idx" ON "interaction_events"("actor_user_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "interaction_events_target_type_target_id_created_at_idx" ON "interaction_events"("target_type", "target_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "interaction_events_expires_at_idx" ON "interaction_events"("expires_at");
+
+-- CreateIndex
+CREATE INDEX "reports_report_type_status_idx" ON "reports"("report_type", "status");
+
+-- CreateIndex
+CREATE INDEX "reports_resource_type_resource_id_idx" ON "reports"("resource_type", "resource_id");
+
+-- CreateIndex
+CREATE INDEX "reports_reporter_user_id_idx" ON "reports"("reporter_user_id");
+
+-- CreateIndex
+CREATE INDEX "feature_toggles_tenant_id_idx" ON "feature_toggles"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "feature_toggles_key_tenant_id_key" ON "feature_toggles"("key", "tenant_id");
+
+-- CreateIndex (PARTIAL, hand-added — NOT expressible in schema.prisma)
+-- Postgres treats NULLs as DISTINCT, so feature_toggles_key_tenant_id_key
+-- alone would permit duplicate GLOBAL rows (tenant_id IS NULL) for one key.
+-- This partial index enforces "at most one global row per key". Precedent:
+-- 20260602162901_research_foundations ships a partial unique index. Keep the
+-- schema.prisma comment in sync so `prisma migrate dev` never treats this as
+-- drift (the diff tool ignores partial indexes it can't model).
+CREATE UNIQUE INDEX "feature_toggles_key_global" ON "feature_toggles"("key") WHERE "tenant_id" IS NULL;
+
+-- CreateIndex
+CREATE INDEX "users_invitation_id_idx" ON "users"("invitation_id");
+
+-- AddForeignKey
+ALTER TABLE "users" ADD CONSTRAINT "users_invitation_id_fkey" FOREIGN KEY ("invitation_id") REFERENCES "invitations"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "interaction_events" ADD CONSTRAINT "interaction_events_actor_user_id_fkey" FOREIGN KEY ("actor_user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "reports" ADD CONSTRAINT "reports_reporter_user_id_fkey" FOREIGN KEY ("reporter_user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260604140000_fold_link_reports_into_reports/migration.sql

@@ -0,0 +1,23 @@
+-- Surveillance-hardening Phase 0 — fold LinkReport into the generalized Report
+-- model (P4). See plans/surveillance-hardening-phase0/04-report-model-adoption.md.
+--
+-- Nothing is deployed live, so there is NO data migration: link_reports is
+-- dropped outright (no INSERT ... SELECT into reports). The code switch
+-- (routes/link-reports.ts → Report with reportType=LINK) lands in the same PR,
+-- so no release ever writes to the dropped table.
+--
+-- Prisma applies this DML+DDL in a single transaction on Postgres (no
+-- CREATE INDEX CONCURRENTLY here), so there is no window where reports are
+-- half-migrated.
+
+-- DropForeignKey
+ALTER TABLE "link_reports" DROP CONSTRAINT "link_reports_user_id_fkey";
+
+-- AlterTable
+ALTER TABLE "reports" ADD COLUMN     "domain" TEXT;
+
+-- DropTable
+DROP TABLE "link_reports";
+
+-- CreateIndex
+CREATE INDEX "reports_domain_idx" ON "reports"("domain");

package/prisma/migrations/20260604140000_fold_link_reports_into_reports/rollback.reference.sql

@@ -0,0 +1,31 @@
+-- REFERENCE rollback for 20260604140000_fold_link_reports_into_reports.
+--
+-- Prisma migrate is FORWARD-ONLY and will NEVER execute this file. It exists
+-- for a human operating a PRE-RELEASE rollback (revert the code commit, then
+-- run this by hand). After a release ships, roll forward only.
+--
+-- Nothing is live, so there are no LINK reports to restore; this simply
+-- recreates the empty link_reports table at its pre-P4 shape. If LINK reports
+-- ever exist in `reports` at rollback time, restore them with:
+--   INSERT INTO link_reports (id, user_id, link_url, domain, reason, status, created_at)
+--   SELECT id, reporter_user_id, resource_id, COALESCE(domain, ''), reason, status, created_at
+--     FROM reports WHERE report_type = 'LINK';
+
+DROP INDEX IF EXISTS "reports_domain_idx";
+ALTER TABLE "reports" DROP COLUMN IF EXISTS "domain";
+
+CREATE TABLE "link_reports" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "link_url" TEXT NOT NULL,
+    "domain" TEXT NOT NULL,
+    "reason" TEXT,
+    "status" TEXT NOT NULL DEFAULT 'pending',
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "link_reports_pkey" PRIMARY KEY ("id")
+);
+CREATE INDEX "link_reports_domain_idx" ON "link_reports"("domain");
+CREATE INDEX "link_reports_status_idx" ON "link_reports"("status");
+CREATE INDEX "link_reports_user_id_idx" ON "link_reports"("user_id");
+ALTER TABLE "link_reports" ADD CONSTRAINT "link_reports_user_id_fkey"
+  FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260606000000_handle_canonical_identity/migration.sql

@@ -0,0 +1,18 @@
+-- S-CP2: make `handle` the canonical, non-null, globally-unique identifier.
+-- Backfill NULL handles and de-duplicate any pre-existing collisions BEFORE
+-- adding the constraints, so the migration is safe against existing data
+-- (handle previously had no DB-level uniqueness; app-layer checks could race).
+
+-- 1. Backfill NULL handles deterministically from the row id (cuid; unique).
+UPDATE "users" SET "handle" = 'user_' || "id" WHERE "handle" IS NULL;
+
+-- 2. De-duplicate: any handle shared by >1 row gets suffixed with the row id
+--    (id is the PK, so the result is guaranteed unique). Non-colliding handles
+--    are left untouched.
+UPDATE "users" u
+SET "handle" = u."handle" || '_' || u."id"
+WHERE (SELECT count(*) FROM "users" u2 WHERE u2."handle" = u."handle") > 1;
+
+-- 3. Enforce the invariants: non-null + globally unique.
+ALTER TABLE "users" ALTER COLUMN "handle" SET NOT NULL;
+CREATE UNIQUE INDEX "users_handle_key" ON "users"("handle");