@steve31415/baselib 3.48.3 → 3.49.0

package/dist/db.js

@@ -2,6 +2,7 @@
 // (per-checkout instance — see TESTING.md). Cloud Run: the Cloud SQL Node
 // connector with IAM authentication (CLOUD_SQL_INSTANCE + DB_IAM_USER +
 // DB_NAME env vars) — no database passwords anywhere in the serving path.
+import { createHash } from 'node:crypto';
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import pg from 'pg';
@@ -367,8 +368,10 @@ export async function endPool(pool) {
     await allClosed;
 }
 // Plain-SQL migrations: numbered files (001-*.sql, 002-*.sql, …) applied in
-// order, recorded in schema_migrations, each inside a transaction, guarded by
-// an advisory lock so concurrent boots can't race. Applied at service boot.
+// order, recorded in schema_migrations with their content's sha256, each
+// inside a transaction, guarded by an advisory lock so concurrent boots can't
+// race. Applied at service boot; an applied file whose content has since
+// changed fails the boot.
 // Lock loss (see logPoolErrors): all the work runs on the lock's own client,
 // so a dead connection fails the next statement and the boot aborts — no
 // window in which a migration runs unlocked.
@@ -380,18 +383,48 @@ export async function migrate(pool, migrationsDir, logger) {
         await client.query('select pg_advisory_lock(hashtext($1))', ['baselib_migrate']);
         await client.query(`create table if not exists schema_migrations (
          name text primary key,
-         applied_at timestamptz not null default now()
+         applied_at timestamptz not null default now(),
+         sha256 text
        )`);
-        const { rows } = await client.query('select name from schema_migrations');
-        const done = new Set(rows.map((r) => r.name));
+        await client.query('alter table schema_migrations add column if not exists sha256 text');
+        const { rows } = await client.query('select name, sha256 from schema_migrations');
+        const recorded = new Map(rows.map((r) => [r.name, r.sha256]));
+        const contents = new Map();
         for (const file of files) {
-            if (done.has(file))
-                continue;
             const sql = await readFile(join(migrationsDir, file), 'utf8');
+            contents.set(file, { sql, sha256: createHash('sha256').update(sql).digest('hex') });
+        }
+        // A shipped migration file is never edited (plasticine-way docs/DATABASE.md): the
+        // runner skips a recorded name, so an edit would never reach the database while the
+        // code relying on it ships. Refuse to boot instead, before applying anything, so the
+        // new revision fails its start and the old one keeps serving (people, 2026-11-02).
+        // Rows recorded before hashes were kept get the file's current hash, once.
+        const edited = [];
+        for (const file of files) {
+            if (!recorded.has(file))
+                continue;
+            const { sha256 } = contents.get(file);
+            const was = recorded.get(file);
+            if (was == null) {
+                await client.query('update schema_migrations set sha256 = $2 where name = $1', [file, sha256]);
+            }
+            else if (was !== sha256) {
+                edited.push(file);
+            }
+        }
+        if (edited.length > 0) {
+            throw new Error(`migration ${edited.join(', ')} was edited after it was applied; a shipped migration is never ` +
+                'edited: restore the file and put the change in a new migration (a local database holding an ' +
+                'unshipped draft: drop it and re-run)');
+        }
+        for (const file of files) {
+            if (recorded.has(file))
+                continue;
+            const { sql, sha256 } = contents.get(file);
             try {
                 await client.query('begin');
                 await client.query(sql);
-                await client.query('insert into schema_migrations (name) values ($1)', [file]);
+                await client.query('insert into schema_migrations (name, sha256) values ($1, $2)', [file, sha256]);
                 await client.query('commit');
             }
             catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.48.3",
+  "version": "3.49.0",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",