feat(drive): start implementation of drive
- add storage.drives
- prepare migration phase
- add created_by and updated_by on storage.folders
This commit is contained in:
Edouard Vanbelle
@@ -0,0 +1,355 @@
|
||||
-- ════════════════════════════════════════════════════════════════════════════
|
||||
-- D0 / M2 — Drive backfill: create drives + stamp drive_id + provenance
|
||||
-- ════════════════════════════════════════════════════════════════════════════
|
||||
-- Second of the D0 migration trio. Half (1) of the §A backfill — the safe,
|
||||
-- focused half:
|
||||
--
|
||||
-- * For every internal user with a root folder, create a Personal drive.
|
||||
-- * The folder literally named `My Folder - <username>` becomes the
|
||||
-- user's default Personal drive (`default_for_user = <uid>`).
|
||||
-- * Any sibling root folders become secondary Personal drives
|
||||
-- (`default_for_user = NULL`, name carried over verbatim).
|
||||
-- * One owner role_grants row per new drive.
|
||||
-- * Every existing folder/file row gets a `drive_id` (cascaded down the
|
||||
-- ltree from the wrapper).
|
||||
-- * Every existing folder/file row gets `created_by` and `updated_by`
|
||||
-- backfilled from the existing `user_id` column.
|
||||
--
|
||||
-- The aggressive half (drop the wrapper folder, rewrite path columns,
|
||||
-- strip the `My Folder - <username>/` prefix from every path/lpath value)
|
||||
-- lands in M2b — kept separate so the tree-shape rewrite can be reviewed
|
||||
-- in isolation.
|
||||
--
|
||||
-- External users (`auth.users.is_external = TRUE`) are intentionally
|
||||
-- skipped — they have no root folder of their own, only role_grants
|
||||
-- against other users' resources.
|
||||
|
||||
-- ── Pre-flight 1: refuse on sibling root literally named 'drives' ──────────
|
||||
-- 'drives' is a reserved URL segment on the native WebDAV surface
|
||||
-- (`/webdav/drives/<uuid>/`). A folder named 'drives' would shadow the
|
||||
-- drive-listing route once D1 ships. Surface the conflict now — operator
|
||||
-- renames before retrying.
|
||||
|
||||
DO $BODY$
|
||||
DECLARE
|
||||
bad_count BIGINT;
|
||||
BEGIN
|
||||
SELECT count(*) INTO bad_count
|
||||
FROM storage.folders f
|
||||
JOIN auth.users u ON u.id = f.user_id
|
||||
WHERE f.parent_id IS NULL
|
||||
AND NOT f.is_trashed
|
||||
AND lower(f.name) = 'drives'
|
||||
AND NOT u.is_external;
|
||||
|
||||
IF bad_count > 0 THEN
|
||||
RAISE EXCEPTION
|
||||
'D0 backfill refused: % root folder(s) literally named ''drives'' '
|
||||
'would collide with the reserved /webdav/drives/<uuid>/ URL segment '
|
||||
'once D1 ships. Rename the offending folders, then retry the '
|
||||
'migration. Query to inspect: SELECT f.id, f.user_id, f.name '
|
||||
'FROM storage.folders f JOIN auth.users u ON u.id = f.user_id '
|
||||
'WHERE f.parent_id IS NULL AND NOT f.is_trashed AND lower(f.name) '
|
||||
'= ''drives'' AND NOT u.is_external;',
|
||||
bad_count;
|
||||
END IF;
|
||||
END $BODY$;
|
||||
|
||||
|
||||
-- ── Pre-flight 2: report sibling-root distribution (informational) ─────────
|
||||
-- Most users have exactly one root (`My Folder - <username>`). Some may
|
||||
-- have SQL-added siblings — those become secondary drives. Surface the
|
||||
-- count so operators can sanity-check before the migration commits.
|
||||
|
||||
DO $BODY$
|
||||
DECLARE
|
||||
extras BIGINT;
|
||||
BEGIN
|
||||
WITH counts AS (
|
||||
SELECT u.id AS user_id, count(*) AS root_count
|
||||
FROM auth.users u
|
||||
JOIN storage.folders f ON f.user_id = u.id
|
||||
WHERE f.parent_id IS NULL
|
||||
AND NOT f.is_trashed
|
||||
AND NOT u.is_external
|
||||
GROUP BY u.id
|
||||
)
|
||||
SELECT count(*) INTO extras FROM counts WHERE root_count > 1;
|
||||
|
||||
IF extras > 0 THEN
|
||||
RAISE NOTICE
|
||||
'D0 backfill: % user(s) have more than one root folder. Their '
|
||||
'siblings will be promoted to secondary Personal drives. Inspect '
|
||||
'with: WITH c AS (SELECT u.id, u.username, count(*) cnt FROM '
|
||||
'auth.users u JOIN storage.folders f ON f.user_id=u.id WHERE '
|
||||
'f.parent_id IS NULL AND NOT f.is_trashed AND NOT u.is_external '
|
||||
'GROUP BY u.id, u.username) SELECT * FROM c WHERE cnt > 1;',
|
||||
extras;
|
||||
END IF;
|
||||
END $BODY$;
|
||||
|
||||
|
||||
-- ── 1. Plan every drive that needs to be created ──────────────────────────
|
||||
-- Temp table is the cleanest way to pre-compute the new UUIDs once and
|
||||
-- reuse them across the INSERT-drives, INSERT-grants, and UPDATE-folders
|
||||
-- steps below. `gen_random_uuid()` in a CTE would re-evaluate on every
|
||||
-- branch.
|
||||
--
|
||||
-- A row joins each existing root folder to its future drive_id. The
|
||||
-- `is_default` flag is computed per-user as a window function so EVERY
|
||||
-- internal user with at least one root folder ends up with exactly one
|
||||
-- default drive — even if the user's wrapper was renamed away from
|
||||
-- `My Folder - <username>` at some point. Preference order:
|
||||
-- 1. The folder literally named `My Folder - <username>` if it exists.
|
||||
-- 2. Otherwise the oldest root by `created_at`, tiebroken by `id`.
|
||||
|
||||
-- `ON COMMIT DROP` would race with the `[init-schema]` CI flow that
|
||||
-- runs migrations via `psql \i` in autocommit mode: the CREATE statement
|
||||
-- commits, the table drops, and the next statement (the DO block) can't
|
||||
-- see it. The plain temp table survives until session end in autocommit
|
||||
-- mode and until our explicit DROP at the bottom under `sqlx migrate`'s
|
||||
-- single-tx mode. Works under both.
|
||||
CREATE TEMPORARY TABLE _drive_plan AS
|
||||
WITH root_folders AS (
|
||||
SELECT
|
||||
u.id AS user_id,
|
||||
u.username AS username,
|
||||
u.storage_quota_bytes AS quota,
|
||||
f.id AS wrapper_id,
|
||||
f.name AS wrapper_name,
|
||||
f.created_at AS created_at,
|
||||
(f.name = 'My Folder - ' || u.username) AS name_matches_default
|
||||
FROM auth.users u
|
||||
JOIN storage.folders f
|
||||
ON f.user_id = u.id
|
||||
AND f.parent_id IS NULL
|
||||
AND NOT f.is_trashed
|
||||
WHERE NOT u.is_external
|
||||
)
|
||||
SELECT
|
||||
user_id,
|
||||
username,
|
||||
quota,
|
||||
wrapper_id,
|
||||
wrapper_name,
|
||||
-- Rank candidates per user: name-matched root wins; otherwise oldest
|
||||
-- by created_at then by id (stable, deterministic). ROW_NUMBER() = 1
|
||||
-- becomes the default drive for that user.
|
||||
(ROW_NUMBER() OVER (
|
||||
PARTITION BY user_id
|
||||
ORDER BY name_matches_default DESC,
|
||||
created_at ASC,
|
||||
wrapper_id ASC
|
||||
) = 1) AS is_default,
|
||||
gen_random_uuid() AS new_drive_id
|
||||
FROM root_folders;
|
||||
|
||||
|
||||
-- ── 1b. Log which users got an auto-picked default (no name match) ────────
|
||||
-- Operational nicety: if a user's default came from oldest-root fallback
|
||||
-- rather than the canonical `My Folder - <username>`, surface it so an
|
||||
-- operator can DM the user and confirm the migration picked the right
|
||||
-- root. Not a failure — just visibility.
|
||||
|
||||
DO $BODY$
|
||||
DECLARE
|
||||
auto_picked BIGINT;
|
||||
BEGIN
|
||||
SELECT count(*) INTO auto_picked
|
||||
FROM _drive_plan p
|
||||
WHERE p.is_default
|
||||
AND p.wrapper_name <> 'My Folder - ' || p.username;
|
||||
|
||||
IF auto_picked > 0 THEN
|
||||
RAISE NOTICE
|
||||
'D0 backfill: % user(s) had no `My Folder - <username>` root; '
|
||||
'the oldest sibling root was auto-picked as their default '
|
||||
'Personal drive. Inspect with: SELECT user_id, username, '
|
||||
'wrapper_name FROM _drive_plan WHERE is_default AND '
|
||||
'wrapper_name <> ''My Folder - '' || username; '
|
||||
'(temp table only exists during the migration transaction.)',
|
||||
auto_picked;
|
||||
END IF;
|
||||
END $BODY$;
|
||||
|
||||
|
||||
-- ── 2. Insert the drive rows ───────────────────────────────────────────────
|
||||
-- Default drives carry the i18n-neutral name 'Personal' (renameable
|
||||
-- later via the drive settings panel). Secondary drives carry their
|
||||
-- original folder name verbatim.
|
||||
|
||||
INSERT INTO storage.drives
|
||||
(id, name, kind, default_for_user, quota_bytes)
|
||||
SELECT
|
||||
p.new_drive_id,
|
||||
CASE WHEN p.is_default THEN 'Personal' ELSE p.wrapper_name END,
|
||||
'personal',
|
||||
CASE WHEN p.is_default THEN p.user_id ELSE NULL END,
|
||||
p.quota
|
||||
FROM _drive_plan p;
|
||||
|
||||
|
||||
-- ── 3. Insert one owner role_grants row per drive ─────────────────────────
|
||||
-- Each user is the sole owner of every drive their wrappers produced.
|
||||
-- The lifecycle hook (D0-9) will do the same for users created post-D0.
|
||||
|
||||
INSERT INTO storage.role_grants
|
||||
(subject_type, subject_id, resource_type, resource_id, role, granted_by)
|
||||
SELECT 'user', p.user_id, 'drive', p.new_drive_id, 'owner', p.user_id
|
||||
FROM _drive_plan p;
|
||||
|
||||
|
||||
-- ── 4. Stamp drive_id on each wrapper folder ──────────────────────────────
|
||||
-- The wrapper still exists as a folder during M2 (the wrapper-drop lives
|
||||
-- in M2b). Setting drive_id on the wrapper lets the cascade in §5 walk
|
||||
-- the ltree subtree without needing a separate index.
|
||||
|
||||
UPDATE storage.folders f
|
||||
SET drive_id = p.new_drive_id
|
||||
FROM _drive_plan p
|
||||
WHERE f.id = p.wrapper_id;
|
||||
|
||||
|
||||
-- ── 5. Cascade drive_id down the folder tree ──────────────────────────────
|
||||
-- For every folder descended from a wrapper, set drive_id to that
|
||||
-- wrapper's. Uses the existing GiST index `idx_folders_lpath` for the
|
||||
-- @> (ancestor-of) lookup. Trashed descendants get a drive_id too —
|
||||
-- soft-deleted folders need a drive_id once M3 makes the column NOT NULL.
|
||||
|
||||
UPDATE storage.folders sub
|
||||
SET drive_id = wrapper.drive_id
|
||||
FROM storage.folders wrapper
|
||||
WHERE wrapper.id IN (SELECT wrapper_id FROM _drive_plan)
|
||||
AND sub.lpath <@ wrapper.lpath
|
||||
AND sub.id != wrapper.id
|
||||
AND sub.drive_id IS NULL;
|
||||
|
||||
|
||||
-- ── 6. Cascade drive_id to files (via their folder) ───────────────────────
|
||||
-- Files inherit drive_id from their containing folder. A NULL folder_id
|
||||
-- file is an orphan — left with NULL drive_id here; M3's NOT NULL
|
||||
-- constraint will refuse the migration if any such orphans remain,
|
||||
-- which is the right outcome (forces operator inspection).
|
||||
|
||||
UPDATE storage.files fi
|
||||
SET drive_id = fo.drive_id
|
||||
FROM storage.folders fo
|
||||
WHERE fi.folder_id = fo.id
|
||||
AND fi.drive_id IS NULL
|
||||
AND fo.drive_id IS NOT NULL;
|
||||
|
||||
|
||||
-- ── 7. Provenance backfill ────────────────────────────────────────────────
|
||||
-- Every pre-Drive row carries authentic provenance from day one: created_by
|
||||
-- and updated_by both default to the user_id that we know created the
|
||||
-- resource (that's exactly what user_id meant pre-D0). New writes during
|
||||
-- the dual-write window populate both columns explicitly.
|
||||
|
||||
UPDATE storage.folders
|
||||
SET created_by = user_id,
|
||||
updated_by = user_id
|
||||
WHERE created_by IS NULL;
|
||||
|
||||
UPDATE storage.files
|
||||
SET created_by = user_id,
|
||||
updated_by = user_id
|
||||
WHERE created_by IS NULL;
|
||||
|
||||
|
||||
-- ── 7b. Drop the planning temp table ──────────────────────────────────────
|
||||
-- Explicit drop since we removed `ON COMMIT DROP` above. Idempotent
|
||||
-- (`IF EXISTS`) so a partial re-run during development doesn't error.
|
||||
|
||||
DROP TABLE IF EXISTS _drive_plan;
|
||||
|
||||
|
||||
-- ── 8. Post-flight consistency check ──────────────────────────────────────
|
||||
-- The checks here REFUSE to commit if any invariant is violated, so a
|
||||
-- successful migration is a verifiable migration.
|
||||
--
|
||||
-- 8a. Every internal user with a root folder has exactly one
|
||||
-- default drive.
|
||||
-- 8b. Every drive has at least one owner role_grants row.
|
||||
-- 8c. No NULL drive_id remains on a folder/file row whose owner is
|
||||
-- a non-external user with a root folder (i.e. every row that
|
||||
-- belongs to a drive must now declare which one).
|
||||
--
|
||||
-- M3 turns drive_id NOT NULL; the check below is a stricter pre-flight
|
||||
-- so the failure mode is "migration refuses" rather than "M3 errors
|
||||
-- with a NOT NULL violation halfway through".
|
||||
|
||||
DO $BODY$
|
||||
DECLARE
|
||||
missing_default BIGINT;
|
||||
grantless_drives BIGINT;
|
||||
null_folder_drive_id BIGINT;
|
||||
null_file_drive_id BIGINT;
|
||||
BEGIN
|
||||
SELECT count(*) INTO missing_default
|
||||
FROM auth.users u
|
||||
WHERE NOT u.is_external
|
||||
AND EXISTS (
|
||||
SELECT 1 FROM storage.folders f
|
||||
WHERE f.user_id = u.id AND f.parent_id IS NULL AND NOT f.is_trashed
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM storage.drives d
|
||||
WHERE d.default_for_user = u.id
|
||||
);
|
||||
IF missing_default > 0 THEN
|
||||
RAISE EXCEPTION
|
||||
'D0 backfill consistency check failed: % internal user(s) with a '
|
||||
'root folder have no default Personal drive. Investigate before '
|
||||
'declaring the migration successful.',
|
||||
missing_default;
|
||||
END IF;
|
||||
|
||||
SELECT count(*) INTO grantless_drives
|
||||
FROM storage.drives d
|
||||
WHERE NOT EXISTS (
|
||||
SELECT 1 FROM storage.role_grants g
|
||||
WHERE g.resource_type = 'drive'
|
||||
AND g.resource_id = d.id
|
||||
AND g.role = 'owner'
|
||||
);
|
||||
IF grantless_drives > 0 THEN
|
||||
RAISE EXCEPTION
|
||||
'D0 backfill consistency check failed: % drive(s) have no owner '
|
||||
'role_grants row. Investigate before declaring the migration '
|
||||
'successful.',
|
||||
grantless_drives;
|
||||
END IF;
|
||||
|
||||
SELECT count(*) INTO null_folder_drive_id
|
||||
FROM storage.folders f
|
||||
WHERE f.drive_id IS NULL
|
||||
AND EXISTS (
|
||||
SELECT 1 FROM auth.users u
|
||||
WHERE u.id = f.user_id AND NOT u.is_external
|
||||
);
|
||||
IF null_folder_drive_id > 0 THEN
|
||||
RAISE EXCEPTION
|
||||
'D0 backfill consistency check failed: % folder(s) belonging to '
|
||||
'an internal user still have NULL drive_id. M3 will refuse to '
|
||||
'add NOT NULL until these are resolved.',
|
||||
null_folder_drive_id;
|
||||
END IF;
|
||||
|
||||
SELECT count(*) INTO null_file_drive_id
|
||||
FROM storage.files fi
|
||||
WHERE fi.drive_id IS NULL
|
||||
AND EXISTS (
|
||||
SELECT 1 FROM auth.users u
|
||||
WHERE u.id = fi.user_id AND NOT u.is_external
|
||||
);
|
||||
IF null_file_drive_id > 0 THEN
|
||||
RAISE EXCEPTION
|
||||
'D0 backfill consistency check failed: % file(s) belonging to an '
|
||||
'internal user still have NULL drive_id (likely orphans — '
|
||||
'folder_id pointing at a missing folder). Inspect with: SELECT '
|
||||
'fi.id, fi.user_id, fi.folder_id FROM storage.files fi JOIN '
|
||||
'auth.users u ON u.id = fi.user_id WHERE fi.drive_id IS NULL '
|
||||
'AND NOT u.is_external;',
|
||||
null_file_drive_id;
|
||||
END IF;
|
||||
END $BODY$;
|
||||
Reference in New Issue
Block a user