trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(db): allow 'public' credential_kind in connected_services check

Browse source 
The 0002 migration's allowed list predates the Komoot public-profile
connection mode (api.sync.komoot.verify.ts writes credentialKind
'public'). Against production data — which has such a connection —
the drop-then-add CHECK failed at ATRewriteTable and blocked every
cd-apps deploy since 2026-06-07 06:25 UTC.

Also documents 'public' in the schema comment with a pointer to keep
the two lists in sync.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-06-07 08:48:27 +02:00
parent b0bfed4d4a
commit 5bf9358dc6
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
packages/db/migrations/0002_connected_services.sql
View file

@ -65,11 +65,15 @@ BEGIN
ALTER COLUMN status SET NOT NULL; ALTER COLUMN status SET NOT NULL;
-- 5. CHECK constraints. Drop-then-add for idempotency. -- 5. CHECK constraints. Drop-then-add for idempotency.
-- 'public' = credential-less public-profile connection (Komoot public
-- mode, api.sync.komoot.verify.ts). It was missing from the original
-- list, which made this migration fail against production data on
-- 2026-06-07 (a komoot public connection existed) and block cd-apps.
ALTER TABLE journal.connected_services ALTER TABLE journal.connected_services
DROP CONSTRAINT IF EXISTS connected_services_credential_kind_check; DROP CONSTRAINT IF EXISTS connected_services_credential_kind_check;
ALTER TABLE journal.connected_services ALTER TABLE journal.connected_services
ADD CONSTRAINT connected_services_credential_kind_check ADD CONSTRAINT connected_services_credential_kind_check
CHECK (credential_kind IN ('oauth', 'web-login', 'device')); CHECK (credential_kind IN ('oauth', 'web-login', 'device', 'public'));
ALTER TABLE journal.connected_services ALTER TABLE journal.connected_services
DROP CONSTRAINT IF EXISTS connected_services_status_check; DROP CONSTRAINT IF EXISTS connected_services_status_check;

3
packages/db/src/schema/journal.ts
View file

@ -224,6 +224,9 @@ export const oauthTokens = journalSchema.table("oauth_tokens", {
// - 'oauth': { access_token, refresh_token, expires_at } // - 'oauth': { access_token, refresh_token, expires_at }
// - 'web-login': { email, encrypted_password, session_jar } (Komoot, future) // - 'web-login': { email, encrypted_password, session_jar } (Komoot, future)
// - 'device': {} (Apple Health, future) // - 'device': {} (Apple Health, future)
// - 'public': {} credential-less public-profile connection (Komoot public mode)
// Keep this list in sync with the CHECK constraint in
// packages/db/migrations/0002_connected_services.sql.
// See docs/adr/0001 and CONTEXT.md (Connected Services). // See docs/adr/0001 and CONTEXT.md (Connected Services).
export const connectedServices = journalSchema.table( export const connectedServices = journalSchema.table(
"connected_services", "connected_services",