dimitar
d5e7a9a0b5
Schema hardening pass. After reading the onboarding/edit forms I
reconsidered the original 'migrate String? -> DateTime?' suggestion:
the bornDate/passedDate placeholders are 'нпр. 1960' and the column
deliberately accepts imprecise values like '1960', 'early 1990s',
'12 May 1960'. Forcing DateTime? would silently break that feature
and require users to enter exact dates they often don't know. The
responsible fix is to keep the free-text semantics but bound the
column length and document the intent in a schema comment. Future
structured-date queries should add a parallel DateTime? column.
Schema changes (prisma/schema.prisma):
- @db.VarChar bounds added to every string column, sized to match
the existing client-side maxLength / app-constant caps:
User.subdomain -> 32, User.title -> 100, User.description -> 2000,
User.bornDate/passedDate -> 50, User.email -> 255, etc.
Image.url/key -> 255, Image.id/userId -> 30.
AdminUser.username -> 50, passwordHash -> 100.
Code.code -> 12, usedByUserId -> 100 (matches Clerk userId scale).
- Image.key: added @@index('Image_key_idx') to support the
/api/image lookup we tightened in Phase 1 (currently a scan).
- updatedAt added to Image, AdminUser, Code (previously only User).
- Inline schema comment on Code.createdById documenting the existing
onDelete: Restrict behaviour (Prisma default) — the migration does
not change it, just makes the audit-trail intent explicit.
Migration:
- 20260802000000_phase6_schema_hardening/migration.sql: explicit
ALTER TABLE ... SET DATA TYPE VARCHAR(N) statements for every
bounded column; ADD COLUMN updatedAt with DEFAULT CURRENT_TIMESTAMP
(so existing rows back-fill immediately); CREATE INDEX for the
Image.key column; a defensive LEFT() truncation UPDATE for any rows
whose bornDate/passedDate exceed 50 chars (the inputs always capped
at 50 on the client side, so this is belt-and-braces). Will be
applied on next deploy via 'prisma migrate deploy'.
Seed:
- prisma/seed.ts: upserts the SUPER_ADMIN row from env
SUPER_ADMIN_USERNAME + SUPER_ADMIN_PASSWORD_HASH. This resolves
the Phase 1 problem where an env-only super-admin had no row in
AdminUser, which meant the Code.createdById FK prevented them from
ever creating codes. The seed is idempotent and safe to run on
every boot (uses upsert).
- package.json: 'prisma.seed' wired to 'tsx prisma/seed.ts'.
- 'db:seed' npm script also added for manual provisioning.
- tsx added as devDependency (executes TypeScript straight from disk
without pre-build).
76 lines
2.4 KiB
Plaintext
76 lines
2.4 KiB
Plaintext
generator client {
|
|
provider = "prisma-client-js"
|
|
binaryTargets = ["native", "linux-musl-openssl-3.0.x"]
|
|
}
|
|
|
|
datasource db {
|
|
provider = "postgresql"
|
|
url = env("DATABASE_URL")
|
|
}
|
|
|
|
model User {
|
|
id String @id @default(cuid()) @db.VarChar(30)
|
|
clerkId String @unique @db.VarChar(100)
|
|
email String? @db.VarChar(255)
|
|
name String? @db.VarChar(100)
|
|
subdomain String @unique @db.VarChar(32)
|
|
templateId Int @default(1)
|
|
title String? @db.VarChar(100)
|
|
description String? @db.VarChar(2000)
|
|
// Free-form text — intentionally accepts imprecise values like "1960"
|
|
// or "early 1990s", not a parseable date. If structured date queries
|
|
// become needed, add a parallel bornDateParsed DateTime? column.
|
|
bornDate String? @db.VarChar(50)
|
|
passedDate String? @db.VarChar(50)
|
|
published Boolean @default(false)
|
|
createdAt DateTime @default(now())
|
|
updatedAt DateTime @updatedAt
|
|
images Image[]
|
|
}
|
|
|
|
model Image {
|
|
id String @id @default(cuid()) @db.VarChar(30)
|
|
url String @db.VarChar(255)
|
|
key String @db.VarChar(255)
|
|
order Int
|
|
userId String @db.VarChar(30)
|
|
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
|
|
createdAt DateTime @default(now())
|
|
updatedAt DateTime @updatedAt
|
|
|
|
@@index([userId])
|
|
@@index([key])
|
|
}
|
|
|
|
enum Role {
|
|
SUPER_ADMIN
|
|
ADMIN
|
|
}
|
|
|
|
model AdminUser {
|
|
id String @id @default(cuid()) @db.VarChar(30)
|
|
username String @unique @db.VarChar(50)
|
|
passwordHash String @db.VarChar(100)
|
|
role Role @default(ADMIN)
|
|
createdAt DateTime @default(now())
|
|
updatedAt DateTime @updatedAt
|
|
createdCodes Code[]
|
|
}
|
|
|
|
model Code {
|
|
id String @id @default(cuid()) @db.VarChar(30)
|
|
code String @unique @db.VarChar(12)
|
|
// onDelete: Restrict (Prisma default) — preventing deletion of an
|
|
// AdminUser that has issued codes is intentional; we don't want
|
|
// orphaned codes with no audit trail of who created them.
|
|
createdById String @db.VarChar(30)
|
|
createdBy AdminUser @relation(fields: [createdById], references: [id])
|
|
usedByUserId String? @db.VarChar(100)
|
|
usedAt DateTime?
|
|
createdAt DateTime @default(now())
|
|
updatedAt DateTime @updatedAt
|
|
|
|
@@index([code])
|
|
@@index([usedByUserId])
|
|
}
|