konnosDashboard
0043_tenant_secrets.sql32 lines · main
1-- 0043_tenant_secrets — RE-ISSUE of the orphaned 0041_tenant_secrets.
2--
3-- 0041_tenant_secrets.sql was authored but never added to meta/_journal.json,
4-- so drizzle-kit migrate skipped it forever and the table was never created in
5-- any environment. Slotting 0041 back into the journal would NOT help: the
6-- drizzle migrator only applies entries whose `when` is newer than the newest
7-- already-applied migration, and 0042 (when=1780130000000) has already run in
8-- prod — so anything dated at 0041's slot is treated as "older than last
9-- applied" and skipped again. The only reliable fix is to re-issue the table
10-- builder as a NEW entry dated AFTER 0042 (when=1780200000000). The 0041 file
11-- is deleted alongside this to avoid two builders for the same table.
12--
13-- Backs services/tenant-secret-store.ts (Layer-2 per-tenant secret: HKDF-SHA256
14-- per-tenant key + AES-256-GCM). One row per (project, service, name) secret —
15-- e.g. a project's `google_client_secret` for the `auth` service. The body is
16-- byte-for-byte the orphaned 0041 (all IF NOT EXISTS), so it is a no-op if a
17-- partial create ever ran.
18CREATE TABLE IF NOT EXISTS "tenant_secrets" (
19 "id" text PRIMARY KEY NOT NULL,
20 "project_id" text NOT NULL,
21 "service" text NOT NULL,
22 "name" text NOT NULL,
23 "encrypted_value" text NOT NULL,
24 "created_by" text,
25 "created_at" timestamp with time zone DEFAULT now() NOT NULL,
26 "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
27 CONSTRAINT "tenant_secrets_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action,
28 CONSTRAINT "tenant_secrets_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action
29);
30--> statement-breakpoint
31CREATE UNIQUE INDEX IF NOT EXISTS "tenant_secrets_project_service_name_idx" ON "tenant_secrets" USING btree ("project_id","service","name");--> statement-breakpoint
32CREATE INDEX IF NOT EXISTS "tenant_secrets_project_service_idx" ON "tenant_secrets" USING btree ("project_id","service");