@rebasepro/server-postgres 0.9.1-canary.ff338b5 → 0.10.1-canary.a54c057

package/src/auth/ensure-tables.ts

@@ -112,13 +112,87 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             )
         `);
 
+        // ── Migration: auth FK column user_id → uid, phase 1 (expand) ───────
+        // Must run BEFORE the dependent tables below: CREATE TABLE IF NOT
+        // EXISTS never revisits an existing table, so a database provisioned
+        // before this migration still lacks `uid` — and the
+        // CREATE INDEX ... (uid) statements that follow would fail on it.
+        //
+        // Deliberately NOT a plain RENAME. Both Cloud Run and Kubernetes roll
+        // deploys, so old and new pods serve the same database at the same time,
+        // and a rollback puts old code back in front of a migrated database. A
+        // rename breaks every auth query on whichever side is out of step.
+        // Instead: add `uid`, backfill it, drop the NOT NULL on `user_id`, and
+        // keep the two in sync with a trigger, so a backend of either era can
+        // read and write. `scripts/drop-legacy-auth-user-id.sql` removes the
+        // column once no old backend remains (phase 2, contract).
+        //
+        // Idempotent throughout: every step is guarded on catalogue state.
+        await db.execute(sql`
+            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+            BEGIN
+                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                    NEW.uid := NEW.user_id;
+                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                    NEW.user_id := NEW.uid;
+                END IF;
+                RETURN NEW;
+            END $$ LANGUAGE plpgsql
+        `);
+
+        for (const authTable of [
+            "user_identities",
+            "refresh_tokens",
+            "password_reset_tokens",
+            "magic_link_tokens",
+            "mfa_factors",
+            "recovery_codes"
+        ]) {
+            const qualified = `"${authSchema}"."${authTable}"`;
+            await db.execute(sql`
+                DO $$
+                DECLARE
+                    has_legacy boolean;
+                    has_uid    boolean;
+                BEGIN
+                    SELECT
+                        bool_or(column_name = 'user_id'),
+                        bool_or(column_name = 'uid')
+                    INTO has_legacy, has_uid
+                    FROM information_schema.columns
+                    WHERE table_schema = ${sql.raw(`'${authSchema}'`)}
+                      AND table_name = ${sql.raw(`'${authTable}'`)};
+
+                    -- Table absent, or already uid-only (a fresh install, or
+                    -- phase 2 already run): nothing to do.
+                    IF has_legacy IS NOT TRUE THEN
+                        RETURN;
+                    END IF;
+
+                    IF has_uid IS NOT TRUE THEN
+                        EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ADD COLUMN uid ${userIdType} REFERENCES ${usersTableName}(id) ON DELETE CASCADE'`)};
+                        EXECUTE ${sql.raw(`'UPDATE ${qualified} SET uid = user_id WHERE uid IS NULL'`)};
+                        EXECUTE ${sql.raw(`'CREATE INDEX IF NOT EXISTS idx_${authTable}_uid ON ${qualified}(uid)'`)};
+                    END IF;
+
+                    -- New code inserts uid and never user_id, so the legacy
+                    -- column can no longer be NOT NULL. The trigger below
+                    -- backfills it, but the constraint is checked first.
+                    EXECUTE ${sql.raw(`'ALTER TABLE ${qualified} ALTER COLUMN user_id DROP NOT NULL'`)};
+
+                    EXECUTE ${sql.raw(`'DROP TRIGGER IF EXISTS sync_uid_user_id ON ${qualified}'`)};
+                    EXECUTE ${sql.raw(`'CREATE TRIGGER sync_uid_user_id BEFORE INSERT OR UPDATE ON ${qualified} FOR EACH ROW EXECUTE FUNCTION "${authSchema}".sync_uid_user_id()'`)};
+                END $$
+            `);
+        }
+
         // ── Create dependent auth tables (idempotent) ───────────────────
 
         // Create user_identities table
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(userIdentitiesTable)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 provider TEXT NOT NULL,
                 provider_id TEXT NOT NULL,
                 profile_data JSONB,
@@ -131,7 +205,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Create indexes on user_identities
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_user_identities_user 
-            ON ${sql.raw(userIdentitiesTable)}(user_id)
+            ON ${sql.raw(userIdentitiesTable)}(uid)
         `);
 
 
@@ -139,13 +213,13 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (user_id, user_agent, ip_address)
+                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
             )
         `);
 
@@ -155,17 +229,17 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(refreshTokensTableName)}(token_hash)
         `);
 
-        // Create index on user_id for cleanup operations
+        // Create index on uid for cleanup operations
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user 
-            ON ${sql.raw(refreshTokensTableName)}(user_id)
+            ON ${sql.raw(refreshTokensTableName)}(uid)
         `);
 
         // Create password reset tokens table
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(passwordResetTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -179,10 +253,10 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(passwordResetTokensTableName)}(token_hash)
         `);
 
-        // Create index on user_id for password reset cleanup
+        // Create index on uid for password reset cleanup
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user 
-            ON ${sql.raw(passwordResetTokensTableName)}(user_id)
+            ON ${sql.raw(passwordResetTokensTableName)}(uid)
         `);
 
         // Create magic link tokens table
@@ -190,7 +264,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(magicLinkTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
@@ -204,10 +278,10 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(magicLinkTokensTableName)}(token_hash)
         `);
 
-        // Create index on user_id for magic link cleanup
+        // Create index on uid for magic link cleanup
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_magic_link_tokens_user 
-            ON ${sql.raw(magicLinkTokensTableName)}(user_id)
+            ON ${sql.raw(magicLinkTokensTableName)}(uid)
         `);
 
         // Create app config table
@@ -226,9 +300,15 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.transaction(async (tx) => {
             await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
 
+            // Falls back to the pre-rename `app.user_id` so a database that has
+            // taken the new schema but is still served by an older backend keeps
+            // resolving the principal. Keep in sync with AUTH_BOOTSTRAP_SQL.
             await tx.execute(sql`
                 CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT NULLIF(current_setting('app.user_id', true), '');
+                    SELECT COALESCE(
+                        NULLIF(current_setting('app.uid', true), ''),
+                        NULLIF(current_setting('app.user_id', true), '')
+                    );
                 $$ LANGUAGE sql STABLE
             `);
 
@@ -278,6 +358,80 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             `);
         }
 
+        // ── Migration: reconcile refresh_tokens for the device-session upsert ──
+        // The refresh-token rotation does `INSERT ... ON CONFLICT (uid, user_agent,
+        // ip_address) DO UPDATE`, which requires the `unique_device_session`
+        // constraint. `CREATE TABLE IF NOT EXISTS` never adds it to a table that
+        // predates the constraint, so every login on such a database 500s with
+        // `42P10 no unique or exclusion constraint matching the ON CONFLICT`.
+        // Reconcile EVERY table named refresh_tokens, in whatever schema it lives,
+        // rather than only the derived name: a database provisioned by an older
+        // era can carry the table in a different schema than the one this run
+        // derives, and the login upsert then hits a table without the constraint.
+        try {
+            const rtTables = await db.execute(sql`
+                SELECT table_schema, table_name
+                FROM information_schema.tables
+                WHERE table_name = 'refresh_tokens'
+            `);
+            const found = (rtTables.rows as { table_schema: string; table_name: string }[]);
+            logger.info(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map(r => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
+            for (const { table_schema } of found) {
+                const qualified = `"${table_schema}"."refresh_tokens"`;
+                try {
+                    // Old tables may lack these columns entirely.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS user_agent TEXT`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS ip_address TEXT`);
+                    // The upsert relies on '' (not NULL) so a device with no UA/IP collides.
+                    await db.execute(sql`UPDATE ${sql.raw(qualified)} SET user_agent = '' WHERE user_agent IS NULL`);
+                    await db.execute(sql`UPDATE ${sql.raw(qualified)} SET ip_address = '' WHERE ip_address IS NULL`);
+                    // Drop pre-existing duplicates that would block the unique constraint,
+                    // keeping one row per (uid, user_agent, ip_address).
+                    await db.execute(sql`
+                        DELETE FROM ${sql.raw(qualified)} a
+                        USING ${sql.raw(qualified)} b
+                        WHERE a.ctid < b.ctid
+                          AND a.uid = b.uid
+                          AND a.user_agent = b.user_agent
+                          AND a.ip_address = b.ip_address
+                    `);
+                    // Log every unique constraint on the table so drift is visible.
+                    const uniques = await db.execute(sql`
+                        SELECT conname, pg_get_constraintdef(oid) AS def
+                        FROM pg_constraint
+                        WHERE conrelid = ${sql.raw(`'${qualified}'`)}::regclass AND contype = 'u'
+                    `);
+                    for (const u of uniques.rows as { conname: string; def: string }[]) {
+                        logger.info(`   ${qualified} unique: ${u.conname} → ${u.def}`);
+                    }
+                    // Does a usable unique constraint cover EXACTLY (uid, user_agent, ip_address)?
+                    // Checking by name alone is not enough: an older era may carry a
+                    // `unique_device_session` on different columns, which the ON CONFLICT
+                    // cannot infer, so login keeps 500ing with 42P10.
+                    const hasCorrect = (uniques.rows as { def: string }[]).some((u) => {
+                        const cols = (u.def.match(/\(([^)]*)\)/)?.[1] || "")
+                            .split(",").map((c) => c.trim().replace(/"/g, ""));
+                        return cols.length === 3 && cols.includes("uid") && cols.includes("user_agent") && cols.includes("ip_address");
+                    });
+                    if (hasCorrect) {
+                        logger.info(`✓ correct device-session unique already present on ${qualified}`);
+                    } else {
+                        // Remove a wrong-columned constraint squatting on the name, then add the right one.
+                        await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+                        await db.execute(sql`
+                            ALTER TABLE ${sql.raw(qualified)}
+                                ADD CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                        `);
+                        logger.info(`✅ Added correct unique_device_session constraint to ${qualified}`);
+                    }
+                } catch (perTableError: unknown) {
+                    logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
+                }
+            }
+        } catch (migrationError: unknown) {
+            logger.warn(`⚠️  refresh_tokens device-session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+        }
+
         // ── Migration: Copy roles from legacy junction table to inline column ──
         // If the old rebase.user_roles and rebase.roles tables exist, migrate
         // the data into the new TEXT[] column then drop the legacy tables.
@@ -322,7 +476,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(mfaFactorsTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 factor_type TEXT NOT NULL DEFAULT 'totp',
                 secret_encrypted TEXT NOT NULL,
                 friendly_name TEXT,
@@ -335,7 +489,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Create indexes on mfa_factors
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_mfa_factors_user
-            ON ${sql.raw(mfaFactorsTableName)}(user_id)
+            ON ${sql.raw(mfaFactorsTableName)}(uid)
         `);
 
         // Create mfa_challenges table
@@ -360,7 +514,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(recoveryCodesTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                user_id ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
                 code_hash TEXT NOT NULL,
                 used_at TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
@@ -370,7 +524,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Create indexes on recovery_codes
         await db.execute(sql`
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
-            ON ${sql.raw(recoveryCodesTableName)}(user_id)
+            ON ${sql.raw(recoveryCodesTableName)}(uid)
         `);
 
         // ── Migration: clear stale FORCE ROW LEVEL SECURITY (older RLS model) ──