mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-25 03:42:06 +00:00
xarmian
6a63fba188
Wave 1 of PLAN-1933 (email verification). Pure infra — nothing reads the column until Wave 3, so this is behaviourally a no-op and mergeable early. - Migration 070 (SQLite) / 048 (Postgres): add nullable email_verified_at TEXT, mirroring disabled_at. UNCONDITIONALLY backfill every existing row to verified (RFC3339 'Z'-suffixed) so no existing / OAuth / self-host account is write-locked on deploy (inverted vs password_set's conditional backfill). SQLite ALTER without IF NOT EXISTS; Postgres with it. - SAFE default = verified (DR-3): CreateUser / CreateOAuthUser write a verified timestamp unless UserCreate.Unverified is explicitly requested (only the future cloud self-serve branch will set that). A missed call site fails SAFE (verified), not write-locked. - models.User.EmailVerifiedAt + IsEmailVerified() (mirror IsDisabled). - Update userColumns + BOTH scan sites (scanUser AND the inline SearchUsers scan) so the admin user list keeps working. - Expose derived email_verified bool in sessionUserPayload for a later wave. Gates: make check + make test-pg both green (dual-dialect verified). Claude-Session: https://claude.ai/code/session_01HxBkAMiFBtCRJ2tKSCt3ST
25 lines
1.3 KiB
SQL
25 lines
1.3 KiB
SQL
-- Add email_verified_at column for email verification (PLAN-1933 Wave 1 / TASK-1935).
|
|
-- NULL = unverified, non-NULL = the time the email was verified. Mirrors
|
|
-- disabled_at's nullable-timestamp shape. TEXT (not TIMESTAMP) to match the
|
|
-- codebase's RFC3339-string convention for user timestamps. Pure infra —
|
|
-- nothing reads this column until Wave 3.
|
|
--
|
|
-- The SAFE default (verified) is enforced in the application layer
|
|
-- (store.CreateUser / CreateOAuthUser), NOT via a DB DEFAULT, so both dialects
|
|
-- stay symmetric and the fail-safe lives in one testable place.
|
|
ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verified_at TEXT;
|
|
|
|
-- Backfill: UNCONDITIONALLY mark EVERY existing row verified. Existing / OAuth /
|
|
-- self-host accounts predate email verification and must NOT be write-locked on
|
|
-- deploy. This is INVERTED vs password_set's conditional (oauth-aware) backfill.
|
|
-- Emit RFC3339 UTC with a 'Z' suffix so Go's time.Parse(time.RFC3339, …) reads
|
|
-- it back. now() AT TIME ZONE 'UTC' yields a naive UTC timestamp that to_char
|
|
-- formats as-is, and the hardcoded 'Z' labels it UTC regardless of server
|
|
-- locale (the plain ::text cast would be space-separated and un-parseable).
|
|
UPDATE users
|
|
SET email_verified_at = to_char(
|
|
now() AT TIME ZONE 'UTC',
|
|
'YYYY-MM-DD"T"HH24:MI:SS"Z"'
|
|
)
|
|
WHERE email_verified_at IS NULL;
|