server/
bootstrap.rs

1//! One-time global seeding of the admin database.
2//!
3//! The seed data (admin user, infra/system config, signing keys) used to live
4//! in a migration (`9999_default_config.sql`). It was moved out so the shared
5//! migration set is DDL-only and can be applied to per-user databases without
6//! replicating secrets. The seed now runs here, against the admin database
7//! only.
8//!
9//! All correctness guarantees live inside `seed.sql` itself: it is a single
10//! guarded `DO` block that takes a transaction-scoped advisory lock (serializing
11//! concurrent boots), skips if the `seed_complete` marker is already present
12//! (idempotent), and runs atomically (a crash rolls back rather than leaving a
13//! partial seed). So this function only has to ship that script to the admin
14//! pool — which keeps the future `Send` (no `&mut PgConnection` held across an
15//! await, unlike an in-Rust transaction) so `boot()` can be spawned.
16
17use crate::db::{DBError, admin_database_url, execute_raw, get_connection};
18use rust_i18n::t;
19use sqlx::Connection;
20
21const SEED_SQL: &str = include_str!("../seed.sql");
22
23/// The seeded admin user's id (see `seed.sql`).
24const ADMIN_USER_ID: &str = "22d36bde-d987-4927-b070-842efdcf9c59";
25
26/// Seeds the admin database (idempotent, concurrency-safe, atomic — see the
27/// module docs and `seed.sql`).
28///
29/// After seeding, points the admin user's `db_name` at this deployment's admin
30/// `DATABASE_URL` (the seed leaves it empty rather than hardcoding a
31/// machine-specific DSN). The update is **unconditional** (compare-and-update on
32/// every boot) so that if the deployment's DSN later changes while reusing the
33/// same admin database, the stored value tracks it rather than going stale. The
34/// `WHERE db_name <> $1` keeps it a no-op write when already correct.
35///
36/// # Errors
37///
38/// Returns [`DBError`] on a connection failure or if the seed transaction fails.
39pub async fn seed() -> Result<(), DBError> {
40    execute_raw(SEED_SQL).await?;
41
42    let admin_url = admin_database_url()?;
43    let mut conn = get_connection().await?;
44    sqlx::query("UPDATE users SET db_name = $1 WHERE id = $2::uuid AND db_name <> $1")
45        .bind(&admin_url)
46        .bind(ADMIN_USER_ID)
47        .execute(&mut *conn)
48        .await?;
49
50    backfill_admin_keypair(&mut conn).await?;
51
52    log::debug!("{}", t!("Admin database seed checked"));
53    Ok(())
54}
55
56/// Advisory-lock key serializing admin-keypair backfill across concurrent boots.
57const ADMIN_KEY_LOCK: i64 = 0x6E6F_6D69_5F61_6B31;
58
59/// Generates and stores a signing keypair for the seeded admin user if it has
60/// none yet. The admin's data lives in the admin DB itself, so both halves are
61/// written here: the public key into `users.jwt_public_key`, the private key
62/// into the admin DB's `user_auth_keys`.
63///
64/// Concurrency- and partial-failure-safe:
65/// - A transaction-scoped advisory lock serializes concurrent boots.
66/// - Idempotency checks BOTH halves — the public key on the admin row AND a
67///   matching private key in `user_auth_keys` — so a prior run that wrote only
68///   the public key (then crashed) is repaired rather than treated as done.
69/// - Both writes happen in one transaction; the private insert replaces any
70///   prior rows so the stored private key always matches the public key, and a
71///   crash rolls back rather than leaving a half-written keypair.
72async fn backfill_admin_keypair(conn: &mut sqlx::PgConnection) -> Result<(), DBError> {
73    let mut tx = conn.begin().await?;
74    sqlx::query("SELECT pg_advisory_xact_lock($1)")
75        .bind(ADMIN_KEY_LOCK)
76        .execute(&mut *tx)
77        .await?;
78
79    let public_key: Option<String> =
80        sqlx::query_scalar("SELECT jwt_public_key FROM users WHERE id = $1::uuid")
81            .bind(ADMIN_USER_ID)
82            .fetch_optional(&mut *tx)
83            .await?
84            .flatten();
85    let private_count: i64 = sqlx::query_scalar("SELECT count(*) FROM user_auth_keys")
86        .fetch_one(&mut *tx)
87        .await?;
88    // Healthy ONLY when both halves are present and there is exactly one private
89    // key. Anything else (missing public, missing private, or a duplicated row
90    // left by a pre-fix race) is repaired by rewriting the keypair below.
91    if public_key.is_some() && private_count == 1 {
92        tx.commit().await?;
93        return Ok(());
94    }
95
96    let keypair = crate::auth_keys::generate().await?;
97    sqlx::query("UPDATE users SET jwt_public_key = $1 WHERE id = $2::uuid")
98        .bind(&keypair.public_pem_b64)
99        .bind(ADMIN_USER_ID)
100        .execute(&mut *tx)
101        .await?;
102    // Clear any prior rows (incl. a duplicated pre-fix state) then insert the
103    // one key matching the public key just written. The singleton constraint
104    // (0005) also guarantees at most one row going forward.
105    sqlx::query("DELETE FROM user_auth_keys")
106        .execute(&mut *tx)
107        .await?;
108    sqlx::query("INSERT INTO user_auth_keys (singleton, private_key) VALUES (TRUE, $1)")
109        .bind(&keypair.private_pem_b64)
110        .execute(&mut *tx)
111        .await?;
112    tx.commit().await?;
113    Ok(())
114}
server/bootstrap.rs

server/
bootstrap.rs
