From 5bf9358dc684d879beab2c4892484035904f7bcd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Sun, 7 Jun 2026 08:48:27 +0200 Subject: [PATCH] fix(db): allow 'public' credential_kind in connected_services check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 0002 migration's allowed list predates the Komoot public-profile connection mode (api.sync.komoot.verify.ts writes credentialKind 'public'). Against production data — which has such a connection — the drop-then-add CHECK failed at ATRewriteTable and blocked every cd-apps deploy since 2026-06-07 06:25 UTC. Also documents 'public' in the schema comment with a pointer to keep the two lists in sync. Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/db/migrations/0002_connected_services.sql | 6 +++++- packages/db/src/schema/journal.ts | 3 +++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/packages/db/migrations/0002_connected_services.sql b/packages/db/migrations/0002_connected_services.sql index 5a02645..20ec004 100644 --- a/packages/db/migrations/0002_connected_services.sql +++ b/packages/db/migrations/0002_connected_services.sql @@ -65,11 +65,15 @@ BEGIN ALTER COLUMN status SET NOT NULL; -- 5. CHECK constraints. Drop-then-add for idempotency. + -- 'public' = credential-less public-profile connection (Komoot public + -- mode, api.sync.komoot.verify.ts). It was missing from the original + -- list, which made this migration fail against production data on + -- 2026-06-07 (a komoot public connection existed) and block cd-apps. ALTER TABLE journal.connected_services DROP CONSTRAINT IF EXISTS connected_services_credential_kind_check; ALTER TABLE journal.connected_services ADD CONSTRAINT connected_services_credential_kind_check - CHECK (credential_kind IN ('oauth', 'web-login', 'device')); + CHECK (credential_kind IN ('oauth', 'web-login', 'device', 'public')); ALTER TABLE journal.connected_services DROP CONSTRAINT IF EXISTS connected_services_status_check; diff --git a/packages/db/src/schema/journal.ts b/packages/db/src/schema/journal.ts index 546de41..3ed696e 100644 --- a/packages/db/src/schema/journal.ts +++ b/packages/db/src/schema/journal.ts @@ -224,6 +224,9 @@ export const oauthTokens = journalSchema.table("oauth_tokens", { // - 'oauth': { access_token, refresh_token, expires_at } // - 'web-login': { email, encrypted_password, session_jar } (Komoot, future) // - 'device': {} (Apple Health, future) +// - 'public': {} credential-less public-profile connection (Komoot public mode) +// Keep this list in sync with the CHECK constraint in +// packages/db/migrations/0002_connected_services.sql. // See docs/adr/0001 and CONTEXT.md (Connected Services). export const connectedServices = journalSchema.table( "connected_services",