Grcov report - bootstrap.rs

1

//! One-time global seeding of the admin database.

2

//!

3

//! The seed data (admin user, infra/system config, signing keys) used to live

4

//! in a migration (`9999_default_config.sql`). It was moved out so the shared

5

//! migration set is DDL-only and can be applied to per-user databases without

6

//! replicating secrets. The seed now runs here, against the admin database

7

//! only.

8

//!

9

//! All correctness guarantees live inside `seed.sql` itself: it is a single

10

//! guarded `DO` block that takes a transaction-scoped advisory lock (serializing

11

//! concurrent boots), skips if the `seed_complete` marker is already present

12

//! (idempotent), and runs atomically (a crash rolls back rather than leaving a

13

//! partial seed). So this function only has to ship that script to the admin

14

//! pool — which keeps the future `Send` (no `&mut PgConnection` held across an

15

//! await, unlike an in-Rust transaction) so `boot()` can be spawned.

16

17

use crate::db::{DBError, admin_database_url, execute_raw, get_connection};

18

use rust_i18n::t;

19

use sqlx::Connection;

20

21

const SEED_SQL: &str = include_str!("../seed.sql");

22

23

/// The seeded admin user's id (see `seed.sql`).

24

const ADMIN_USER_ID: &str = "22d36bde-d987-4927-b070-842efdcf9c59";

25

26

/// Seeds the admin database (idempotent, concurrency-safe, atomic — see the

27

/// module docs and `seed.sql`).

28

///

29

/// After seeding, points the admin user's `db_name` at this deployment's admin

30

/// `DATABASE_URL` (the seed leaves it empty rather than hardcoding a

31

/// machine-specific DSN). The update is **unconditional** (compare-and-update on

32

/// every boot) so that if the deployment's DSN later changes while reusing the

33

/// same admin database, the stored value tracks it rather than going stale. The

34

/// `WHERE db_name <> $1` keeps it a no-op write when already correct.

35

///

36

/// # Errors

37

///

38

/// Returns [`DBError`] on a connection failure or if the seed transaction fails.

39

108

pub async fn seed() -> Result<(), DBError> {

40

108

    execute_raw(SEED_SQL).await?;

41

42

108

    let admin_url = admin_database_url()?;

43

108

    let mut conn = get_connection().await?;

44

108

    sqlx::query("UPDATE users SET db_name = $1 WHERE id = $2::uuid AND db_name <> $1")

45

108

        .bind(&admin_url)

46

108

        .bind(ADMIN_USER_ID)

47

108

        .execute(&mut *conn)

48

108

        .await?;

49

50

108

    backfill_admin_keypair(&mut conn).await?;

51

52

108

    log::debug!("{}", t!("Admin database seed checked"));

53

108

    Ok(())

54

108

55

56

/// Advisory-lock key serializing admin-keypair backfill across concurrent boots.

57

const ADMIN_KEY_LOCK: i64 = 0x6E6F_6D69_5F61_6B31;

58

59

/// Generates and stores a signing keypair for the seeded admin user if it has

60

/// none yet. The admin's data lives in the admin DB itself, so both halves are

61

/// written here: the public key into `users.jwt_public_key`, the private key

62

/// into the admin DB's `user_auth_keys`.

63

///

64

/// Concurrency- and partial-failure-safe:

65

/// - A transaction-scoped advisory lock serializes concurrent boots.

66

/// - Idempotency checks BOTH halves — the public key on the admin row AND a

67

///   matching private key in `user_auth_keys` — so a prior run that wrote only

68

///   the public key (then crashed) is repaired rather than treated as done.

69

/// - Both writes happen in one transaction; the private insert replaces any

70

///   prior rows so the stored private key always matches the public key, and a

71

///   crash rolls back rather than leaving a half-written keypair.

72

108

async fn backfill_admin_keypair(conn: &mut sqlx::PgConnection) -> Result<(), DBError> {

73

108

    let mut tx = conn.begin().await?;

74

108

    sqlx::query("SELECT pg_advisory_xact_lock($1)")

75

108

        .bind(ADMIN_KEY_LOCK)

76

108

        .execute(&mut *tx)

77

108

        .await?;

78

79

108

    let public_key: Option<String> =

80

108

        sqlx::query_scalar("SELECT jwt_public_key FROM users WHERE id = $1::uuid")

81

108

            .bind(ADMIN_USER_ID)

82

108

            .fetch_optional(&mut *tx)

83

108

            .await?

84

108

            .flatten();

85

108

    let private_count: i64 = sqlx::query_scalar("SELECT count(*) FROM user_auth_keys")

86

108

        .fetch_one(&mut *tx)

87

108

        .await?;

88

    // Healthy ONLY when both halves are present and there is exactly one private

89

    // key. Anything else (missing public, missing private, or a duplicated row

90

    // left by a pre-fix race) is repaired by rewriting the keypair below.

91

108

    if public_key.is_some() && private_count == 1 {

92

81

        tx.commit().await?;

93

81

        return Ok(());

94

27

95

96

27

    let keypair = crate::auth_keys::generate().await?;

97

27

    sqlx::query("UPDATE users SET jwt_public_key = $1 WHERE id = $2::uuid")

98

27

        .bind(&keypair.public_pem_b64)

99

27

        .bind(ADMIN_USER_ID)

100

27

        .execute(&mut *tx)

101

27

        .await?;

102

    // Clear any prior rows (incl. a duplicated pre-fix state) then insert the

103

    // one key matching the public key just written. The singleton constraint

104

    // (0005) also guarantees at most one row going forward.

105

27

    sqlx::query("DELETE FROM user_auth_keys")

106

27

        .execute(&mut *tx)

107

27

        .await?;

108

27

    sqlx::query("INSERT INTO user_auth_keys (singleton, private_key) VALUES (TRUE, $1)")

109

27

        .bind(&keypair.private_pem_b64)

110

27

        .execute(&mut *tx)

111

27

        .await?;

112

27

    tx.commit().await?;

113

27

    Ok(())

114

108