Files
warmbly/internal/infrastructure/db/migrations/000083_instance_settings.up.sql
T
Matthew Meszaros 734cb5fe08 feat: make self-hosted onboarding survivable by fixing invite_only, which could not onboard anyone (the accept route is JWT-only, so redeeming the invitation that would create your account required already having one, making the self-host default silently identical to fully closed), threading the invitation token through registration so an invited person lands in the inviting organization instead of a stray workspace, gating SSO just-in-time provisioning behind DISABLE_REGISTRATION (it bypassed the gate entirely, so an instance set to true was still open to anyone the IdP would assert) with SSO_AUTO_PROVISION as the opt-out, correcting the OIDC redirect URL that pointed at /api/v1 against a route at /v1 and 404'd every SSO login, scoping the first-launch exemption so it no longer overrides an explicit lockdown, preserving the remaining TTL when restoring a losing setup token so a public endpoint cannot hold the claim window open forever, replacing a generic 403 with typed registration_invite_only, registration_closed, invitation_invalid, setup_token_invalid and setup_already_complete codes that name the next step, logging why no claim link was issued on an already-claimed instance instead of staying silent, adding a warmblyctl operator CLI (status with health checks and a non-zero exit, reissuable setup-link, user create/list/reset-password/grant-admin/revoke-admin/disable-2fa, hash-password) so a locked-out operator no longer needs hand-written psql, adding read-only instance configuration over 104 environment variables with structural secret redaction and fingerprints, 35 health checks, a database-backed settings tier for the three keys no environment variable owns, hiding the signup form when the config already says invite_only rather than failing the whole form with a toast, and documenting first run, accounts and access, configuration, instance health and troubleshooting alongside the root .env.example the README told operators to write but never shipped (#114)
2026-08-16 05:58:11 +02:00

27 lines
1.2 KiB
SQL

-- Instance settings: the small database-backed configuration tier.
--
-- The environment is authoritative for everything else, so this table holds
-- only keys that NO environment variable owns. That disjointness is the whole
-- design: there is no precedence to resolve, no write-back hazard, and no
-- locked-by-environment form field anywhere in the admin panel.
--
-- The document is jsonb because it is a small, evolving, read-then-apply blob
-- that is never filtered in SQL. It is kept type-safe at the app boundary by
-- internal/app/instancesettings (a Go struct plus clamping on read and write).
--
-- Singleton enforced with the boolean-primary-key idiom: id can only ever be
-- true, so a second row is impossible.
CREATE TABLE IF NOT EXISTS instance_settings (
id boolean PRIMARY KEY DEFAULT true CHECK (id),
doc jsonb NOT NULL DEFAULT '{}'::jsonb,
updated_by uuid REFERENCES users (id) ON DELETE SET NULL,
updated_at timestamptz NOT NULL DEFAULT NOW()
);
-- Seed the row empty. An absent key resolves to its compiled default, so an
-- empty document and a missing row behave identically.
INSERT INTO instance_settings (id, doc)
VALUES (true, '{}'::jsonb)
ON CONFLICT (id) DO NOTHING;