- apps/cli/ is now the canonical CLI (was apps/cli-v2/). - apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag 'cli-v0-legacy-final' before deletion; git history preserves it too. - .github/workflows/release-cli.yml paths updated. - pnpm-lock.yaml regenerated. Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities): - 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member. - handleSend in broker fetches recipient grant maps once per send, drops messages silently when sender lacks the required capability. - POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric. - CLI grant/revoke/block now mirror to broker via syncToBroker. Auto-migrate on broker startup: - apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock before the HTTP server binds. Exits non-zero on failure so Coolify healthcheck fails closed. - Dockerfile copies packages/db/migrations into /app/migrations. - postgres 3.4.5 added as direct broker dep. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
60 lines
2.2 KiB
TypeScript
60 lines
2.2 KiB
TypeScript
/**
|
|
* Runtime migrations on broker startup.
|
|
*
|
|
* Runs pending drizzle migrations against DATABASE_URL before the broker
|
|
* listens. Uses pg_advisory_lock so a multi-instance deploy doesn't race.
|
|
* If migrations fail, the process exits non-zero so the orchestrator (Coolify
|
|
* healthcheck) sees the container as broken and doesn't route traffic.
|
|
*/
|
|
|
|
import { drizzle } from "drizzle-orm/postgres-js";
|
|
import { migrate } from "drizzle-orm/postgres-js/migrator";
|
|
import postgres from "postgres";
|
|
import { dirname, join } from "node:path";
|
|
import { existsSync, readdirSync } from "node:fs";
|
|
|
|
const LOCK_ID = 74737_73831; // "cmsh" ascii — stable magic constant
|
|
|
|
export async function runMigrationsOnStartup(): Promise<void> {
|
|
const url = process.env.DATABASE_URL;
|
|
if (!url) {
|
|
console.error("[migrate] DATABASE_URL not set — skipping auto-migrate");
|
|
return;
|
|
}
|
|
|
|
// Resolve the migrations folder — it's shipped inside @turbostarter/db's
|
|
// deploy subset in the runtime image. Dev path also works.
|
|
const candidates = [
|
|
"/app/migrations",
|
|
"/app/node_modules/@turbostarter/db/migrations",
|
|
join(process.cwd(), "..", "..", "packages", "db", "migrations"),
|
|
join(process.cwd(), "packages", "db", "migrations"),
|
|
];
|
|
const migrationsFolder = candidates.find((p) => existsSync(p));
|
|
if (!migrationsFolder) {
|
|
console.error("[migrate] migrations folder not found — skipping. Searched:", candidates);
|
|
return;
|
|
}
|
|
const count = readdirSync(migrationsFolder).filter((f) => f.endsWith(".sql")).length;
|
|
console.log(`[migrate] ${count} migration files at ${migrationsFolder}`);
|
|
|
|
const sql = postgres(url, { max: 1, onnotice: () => { /* quiet */ } });
|
|
try {
|
|
// Advisory lock so parallel instances serialise.
|
|
await sql`SELECT pg_advisory_lock(${LOCK_ID})`;
|
|
try {
|
|
const db = drizzle(sql);
|
|
const start = Date.now();
|
|
await migrate(db, { migrationsFolder });
|
|
console.log(`[migrate] ok (${Date.now() - start}ms)`);
|
|
} finally {
|
|
await sql`SELECT pg_advisory_unlock(${LOCK_ID})`;
|
|
}
|
|
} catch (e) {
|
|
console.error("[migrate] FAILED:", e instanceof Error ? e.message : e);
|
|
process.exit(1);
|
|
} finally {
|
|
await sql.end({ timeout: 5 });
|
|
}
|
|
}
|