unoverse 0.1.83 → 0.1.85

package/operator/ansible/playbooks/db-setup.yml

@@ -80,6 +80,37 @@
           See docs/runbooks/02-database.md for details.
       when: ext_result.rc != 0
 
+    # BEFORE MIGRATIONS, OR THEY CANNOT CREATE THEIR OWN BOOKKEEPING TABLE. PostgreSQL 15+
+    # dropped the implicit CREATE on schema public, and DigitalOcean creates every database
+    # owned by its admin user, so the universe user connects fine and then fails on the
+    # first CREATE TABLE. Granting is idempotent and only ever widens this one user's rights
+    # inside its own database — it touches nothing else on a shared cluster.
+    #
+    # no_log because the admin connection string is an argument here. It arrives from
+    # terraform at deploy time and is never written to the server.
+    - name: "[3b/5] Grant the universe user rights on its own schema"
+      command: >
+        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} unoverse node -e
+        "const{Client}=require('pg');
+        const c=new Client({connectionString:process.env.ADMIN_URL,ssl:{rejectUnauthorized:false}});
+        (async()=>{
+          await c.connect();
+          await c.query('GRANT ALL ON SCHEMA public TO \"universe\"');
+          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"universe\"');
+          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"universe\"');
+          await c.end();
+          console.log('granted');
+        })().catch(e=>{console.error(e.message);process.exit(1)})"
+      args:
+        chdir: /opt/gravity
+      when: (pg_admin_url | default('')) | length > 0
+      no_log: true
+      register: grant_result
+
+    - name: "[3b/5] Schema rights"
+      debug:
+        msg: "{{ 'universe may create objects in its database' if (pg_admin_url | default('')) | length > 0 else 'skipped — bring-your-own database, permissions are yours' }}"
+
     # Apply the .sql migrations with node-pg-migrate — same as `./unoverse db-setup`
     # (scripts/lib/db-setup.sh). The old programmatic `require('./dist/db')` table
     # setup is retired: the engine no longer ships a dist, and .sql migrations under
@@ -96,9 +127,33 @@
       register: migrate_result
       ignore_errors: yes
 
+    # THE WHOLE FILE IS NOT THE ANSWER TO "DID IT WORK". This printed every line of the
+    # baseline — several hundred lines of CREATE TABLE nobody asked to read, burying the one
+    # line that says whether anything ran. Keep the names and the verdict.
     - name: "[4/5] Migration output"
       debug:
-        msg: "{{ migrate_result.stdout_lines | default(['No output']) }}"
+        msg: >-
+          {{ (migrate_result.stdout_lines | default([]) | select('match', '^> - ') | list)
+             + (migrate_result.stdout_lines | default([]) | select('search', 'Migrations complete|No migrations') | list)
+             | default(['No output'], true) }}
+
+    # SERVICES BOOTED BEFORE THIS SCHEMA EXISTED. install.yml has to start the containers
+    # first — migrations run THROUGH the unoverse container, so there is nothing to run them
+    # in until it is up. The cost is that every service that touches the database at boot
+    # does so against an empty one: memory logged "permission denied for schema public" and
+    # then 'relation "memories" does not exist', and stayed in that state until something
+    # restarted it. Restarting here is the missing half of that ordering, and it only ever
+    # happens on a first setup.
+    - name: "[4b/5] Restart services against the migrated schema"
+      command: docker compose restart
+      args:
+        chdir: /opt/gravity
+      when: migrate_result.rc | default(1) == 0
+
+    - name: "[4b/5] Settle"
+      pause:
+        seconds: 15
+      when: migrate_result.rc | default(1) == 0
 
     - name: "[5/5] Verify database connectivity"
       uri:

package/operator/ansible/playbooks/test-connectivity.yml

@@ -134,36 +134,38 @@
       register: api_write_check
       ignore_errors: yes
 
-    - name: "[10/14] Check unoverse node catalog loaded"
+    # AN EMPTY CATALOGUE IS NOT A BROKEN ONE. Nodes arrive as rows — installed from the
+    # marketplace or published from Studio — so a universe on its first day has none, and
+    # that is the correct state, not a fault. This used to fail outright on zero and advise
+    # "run deploy.sh rebuild", a command that does not exist, which turned every first
+    # deploy into a red line pointing at nothing.
+    #
+    # What IS worth failing on is the runtime not answering at all: that means the catalogue
+    # could not be read, which is a different fact from it being empty.
+    - name: "[10/13] Check the node catalogue is readable"
       shell: |
         cd /opt/gravity
         # The internal :4106 runtime is Docker-network-only (never published), and the
         # public :4105 routes are JWT-gated — so read the catalog from INSIDE the
         # container. node:20-slim has no curl; use node fetch.
         NODE_COUNT=$(docker compose exec -T unoverse node -e \
-          "fetch('http://127.0.0.1:4106/nodes').then(r=>r.json()).then(d=>console.log((d.nodes||[]).length)).catch(()=>console.log(0))" 2>/dev/null | tr -d ' \r')
+          "fetch('http://127.0.0.1:4106/nodes').then(r=>r.json()).then(d=>console.log((d.nodes||[]).length)).catch(()=>console.log('unreachable'))" 2>/dev/null | tr -d ' \r')
+        if [ "$NODE_COUNT" = "unreachable" ]; then
+          echo "nodes=unreachable"
+          echo "The runtime did not answer on :4106 — the catalogue could not be read"
+          exit 1
+        fi
         echo "nodes=${NODE_COUNT}"
         if [ "${NODE_COUNT:-0}" -eq 0 ] 2>/dev/null; then
-          echo "WARNING: No nodes loaded — run deploy.sh rebuild or unoverse update"
-          exit 1
+          echo "(none installed yet — install from the marketplace or publish from Studio)"
         fi
       register: plugin_check
       ignore_errors: yes
 
-    - name: "[11/14] Check packages directory mounted"
-      shell: |
-        cd /opt/gravity
-        if docker compose exec -T unoverse ls /app/host_packages 2>/dev/null | head -5; then
-          PKG_COUNT=$(docker compose exec -T unoverse ls /app/host_packages 2>/dev/null | wc -l | tr -d ' ')
-          echo "packages_mounted=${PKG_COUNT}"
-          [ "$PKG_COUNT" -gt 0 ]
-        else
-          echo "packages_mounted=0"
-          echo "WARNING: No packages directory — run deploy.sh or unoverse update"
-          exit 1
-        fi
-      register: packages_check
-      ignore_errors: yes
+    # NO PACKAGES CHECK. It looked for /app/host_packages, a bind mount that was retired
+    # when nodes moved to npm at runtime plus the marketplace. Nothing declares
+    # PACKAGES_PATH any more and docker-compose.yml has no such volume, so the check could
+    # only ever report 0 and tell the operator to run a command that would not fix it.
 
     - name: "[12/14] Check for errors in service logs"
       shell: |
@@ -245,11 +247,9 @@
           ── Prompt Blocks (internal :4106) ──
             {{ prompt_blocks_check.stdout_lines[0] | default('(skipped)') }}
 
-          ── Plugins & Packages ──
-          Unoverse: {{ plugin_check.stdout_lines[0] | default('(skipped)') }}
+          ── Node catalogue ──
+          {{ plugin_check.stdout_lines[0] | default('(skipped)') }}
           {{ plugin_check.stdout_lines[1] | default('') }}
-          Packages: {{ packages_check.stdout_lines[0] | default('(skipped)') }}
-          {{ packages_check.stdout_lines[1] | default('') }}
 
           ── Recent Errors in Logs ──
           {{ log_errors.stdout | default('(skipped)') }}

package/operator/infra/digitalocean/outputs.tf

@@ -12,6 +12,19 @@ locals {
   pg_pooled = local.pg_managed ? "postgresql://${digitalocean_database_user.universe[0].name}:${digitalocean_database_user.universe[0].password}@${digitalocean_database_connection_pool.universe[0].private_host}:${digitalocean_database_connection_pool.universe[0].port}/${digitalocean_database_connection_pool.universe[0].name}?sslmode=require&pgbouncer=true" : var.byo_postgres_url
   pg_direct = local.pg_managed ? "postgresql://${digitalocean_database_user.universe[0].name}:${digitalocean_database_user.universe[0].password}@${local.pg_cluster_host}:${local.pg_cluster_port}/${digitalocean_database_db.universe[0].name}?sslmode=require" : var.byo_postgres_url
 
+  # THE ADMIN URL EXISTS FOR EXACTLY ONE STATEMENT. PostgreSQL 15+ no longer grants CREATE
+  # on schema public to PUBLIC, and DigitalOcean owns every database it creates as doadmin.
+  # So the universe user can connect and can create nothing: the first migration dies on
+  # "permission denied for schema public" after the extensions step reports OK, which reads
+  # like the database is fine. Only the cluster's admin can hand over those rights.
+  #
+  # It is a separate output and NOT part of env_production on purpose. The server holds the
+  # universe user's credentials and must never hold the cluster admin's — deploy reads this,
+  # spends it on one GRANT, and it goes no further.
+  pg_admin_user = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].user : (local.provision_pg ? digitalocean_database_cluster.pg[0].user : "")
+  pg_admin_pass = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].password : (local.provision_pg ? digitalocean_database_cluster.pg[0].password : "")
+  pg_admin_url = local.pg_managed ? "postgresql://${local.pg_admin_user}:${local.pg_admin_pass}@${local.pg_cluster_host}:${local.pg_cluster_port}/${digitalocean_database_db.universe[0].name}?sslmode=require" : ""
+
   # Redis is always ours — provisioned above, no BYO branch.
   redis_host     = digitalocean_database_cluster.redis.private_host
   redis_port     = digitalocean_database_cluster.redis.port
@@ -39,6 +52,14 @@ output "api_url" {
   value       = local.has_domain ? "https://${local.api_host}" : "http://${digitalocean_loadbalancer.public.ip}"
 }
 
+# Read by deploy for the one-time schema grant, never written to the server. Empty when
+# the database is BYO: somebody else's cluster, whose permissions are theirs to run.
+output "pg_admin_url" {
+  value       = local.pg_admin_url
+  description = "Cluster admin connection to this universe's database — used once, to grant the universe user rights on schema public"
+  sensitive   = true
+}
+
 output "env_production" {
   sensitive   = true
   description = "Rendered .env.production — complete, write to a file and deploy"

package/operator/lib/deploy.sh

@@ -363,6 +363,13 @@ cmd_deploy() {
 
   _adopted_db_access "$cloud" grant
 
+  # The cluster admin connection, held in this shell and nowhere else. db-setup spends it
+  # on a single GRANT so the universe user can create objects in its own database; it is
+  # never written to the server, and an empty value (BYO database, or a ground without the
+  # output) simply skips that step.
+  local pg_admin_url
+  pg_admin_url=$(terraform -chdir="$ROOT/infra/$cloud" output -raw pg_admin_url 2>/dev/null)
+
 
   # Read the deploy target from the rendered settings
   local deploy_host deploy_user
@@ -476,6 +483,7 @@ EOF
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/db-setup.yml" \
         -e "universe_root=$ROOT" \
+        -e "pg_admin_url=$pg_admin_url" \
         -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "db setup failed — fix and re-run: unoverse deploy db"; exit 1; }
       echo ""
       info "[3/3] Verifying..."
@@ -498,6 +506,7 @@ EOF
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/db-setup.yml" \
         -e "universe_root=$ROOT" \
+        -e "pg_admin_url=$pg_admin_url" \
         -e "env_file=$env_prod"
       ;;
     test|check)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.83",
+  "version": "0.1.85",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",