diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 906791d..49d44fa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,3 +36,45 @@ jobs: - name: Lint run: npm run lint + + # Les migrations s'appliquent-elles sur une base vierge ? C'est la seule + # panne qui transforme une mise à jour automatique en panne totale : une + # migration invalide part sur toutes les instances, l'entrypoint réessaie + # trente fois, abandonne, et le conteneur tourne en boucle de redémarrage. + # Les éprouver ici coûte une minute et referme ce chemin. + migrations: + runs-on: ubuntu-latest + services: + postgres: + image: postgres:16-alpine + env: + POSTGRES_DB: apel_manager + POSTGRES_USER: apel + POSTGRES_PASSWORD: apel-ci + options: >- + --health-cmd "pg_isready -U apel -d apel_manager" + --health-interval 5s + --health-timeout 5s + --health-retries 20 + ports: + - 5432:5432 + env: + DATABASE_URL: postgresql://apel:apel-ci@localhost:5432/apel_manager + steps: + - name: Récupérer les sources + uses: actions/checkout@v4 + + - name: Préparer Node.js + uses: actions/setup-node@v4 + with: + node-version: 20 + cache: npm + + - name: Installer les dépendances + run: npm ci + + - name: Appliquer les migrations sur une base vierge + run: node scripts/migrate.mjs + + - name: Les rejouer, elles doivent rester sans effet + run: node scripts/migrate.mjs diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 817d944..0fd68eb 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -25,8 +25,53 @@ env: IMAGE_NAME: ${{ github.repository }} jobs: + # Les migrations s'appliquent-elles sur une base vierge ? C'est la seule + # panne qui transforme une mise à jour automatique en panne totale : une + # migration invalide part sur toutes les instances, l'entrypoint réessaie + # trente fois, abandonne, et le conteneur tourne en boucle de redémarrage. + # Les éprouver ici coûte une minute et referme ce chemin. + migrations: + runs-on: ubuntu-latest + services: + postgres: + image: postgres:16-alpine + env: + POSTGRES_DB: apel_manager + POSTGRES_USER: apel + POSTGRES_PASSWORD: apel-ci + options: >- + --health-cmd "pg_isready -U apel -d apel_manager" + --health-interval 5s + --health-timeout 5s + --health-retries 20 + ports: + - 5432:5432 + env: + DATABASE_URL: postgresql://apel:apel-ci@localhost:5432/apel_manager + steps: + - name: Récupérer les sources + uses: actions/checkout@v4 + + - name: Préparer Node.js + uses: actions/setup-node@v4 + with: + node-version: 20 + cache: npm + + - name: Installer les dépendances + run: npm ci + + - name: Appliquer les migrations sur une base vierge + run: node scripts/migrate.mjs + + - name: Les rejouer, elles doivent rester sans effet + run: node scripts/migrate.mjs + publish: runs-on: ubuntu-latest + # Rien ne part tant que les migrations n'ont pas été éprouvées : une image + # publiée est installée toute seule sur les instances dans l'heure. + needs: migrations permissions: contents: read packages: write diff --git a/compose.yaml b/compose.yaml index 33fd298..893cc86 100644 --- a/compose.yaml +++ b/compose.yaml @@ -34,6 +34,13 @@ x-app-environment: &app-environment UPDATE_REPOSITORY: ${UPDATE_REPOSITORY:-flocom/APEL-manager} UPDATE_CHANNEL: ${UPDATE_CHANNEL:-main} UPDATE_CHECK_ENABLED: ${UPDATE_CHECK_ENABLED:-true} + # L'image réellement déployée, celle que l'`updater` surveille. C'est elle que + # l'application interroge dans le registre pour savoir s'il y a quelque chose + # à installer : comparer au dernier commit du dépôt reviendrait à annoncer une + # mise à jour pendant les dix minutes de construction, et indéfiniment si la + # publication échoue. Même valeur par défaut que la clé `image` des services, + # pour qu'on ne puisse pas surveiller une autre image que celle qui tourne. + APEL_IMAGE: ${APEL_IMAGE:-ghcr.io/flocom/apel-manager:latest} services: db: diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index f1562cc..bddb76d 100644 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -91,6 +91,14 @@ load_or_create_secret CRON_SECRET cron-secret 32 # aux secrets ci-dessus, le remplacer n'invalide rien — une valeur imposée dans # le `.env` prend simplement la place de celle qui a été générée. updater_token_path="$CONFIG_DIR/updater-token" +# Un fichier présent mais vide — interruption au premier démarrage, volume +# restauré à moitié — n'était jamais réécrit : `ln` échouait sur la cible +# existante et l'application repartait avec un jeton vide, donc sans bouton +# d'installation immédiate, et le conseil affiché (« relancez la pile ») ne +# corrigeait rien puisque le fichier restait là. +if [ -e "$updater_token_path" ] && [ ! -s "$updater_token_path" ]; then + rm -f "$updater_token_path" +fi if [ -n "${WATCHTOWER_HTTP_API_TOKEN:-}" ]; then if [ "$(sed -n '1p' "$updater_token_path" 2>/dev/null || true)" != "$WATCHTOWER_HTTP_API_TOKEN" ]; then mv "$(write_temp_file "$updater_token_path" "$WATCHTOWER_HTTP_API_TOKEN")" \ @@ -121,9 +129,36 @@ if [ "${SKIP_MIGRATIONS:-0}" != "1" ]; then attempt=1 maximum_attempts="${MIGRATION_MAX_ATTEMPTS:-30}" - while ! node scripts/migrate.mjs; do + while true; do + # `if cmd; then …; fi` rend 0 quand la condition échoue sans branche + # `else` : relire $? après le bloc donnerait donc toujours 0 et le code + # fatal ne serait jamais vu. `|| status=$?` capture la vraie valeur, et + # protège la commande de `set -e`. + status=0 + node scripts/migrate.mjs || status=$? + if [ "$status" -eq 0 ]; then + break + fi + + # Code 2 : PostgreSQL a répondu et a refusé la migration. La rejouer + # trente fois donnerait trente fois le même refus, en annonçant une base + # indisponible qui se porte très bien — et en envoyant chercher la panne + # là où elle n'est pas. Mieux vaut s'arrêter en disant quoi faire. + if [ "$status" -eq 2 ]; then + echo "Cette version ne peut pas démarrer : sa migration est refusée par la base." >&2 + echo "Le schéma n'a pas été modifié — la migration est appliquée d'un bloc, donc annulée d'un bloc." >&2 + if [ -s "$CONFIG_DIR/last-good-revision" ]; then + echo "Pour revenir à la version qui tournait avant, sur le serveur :" >&2 + echo " APEL_IMAGE=${UPDATE_IMAGE_REPOSITORY:-ghcr.io/flocom/apel-manager}:sha-$(sed -n '1p' "$CONFIG_DIR/last-good-revision" | cut -c1-7) docker compose up -d" >&2 + else + echo "Revenez à la version précédente en fixant APEL_IMAGE sur son étiquette sha-xxxxxxx." >&2 + fi + echo "Un « docker compose pull && docker compose up -d » réinstallerait la même version." >&2 + exit 2 + fi + if [ "$attempt" -ge "$maximum_attempts" ]; then - echo "Échec des migrations après $attempt tentatives." >&2 + echo "PostgreSQL est resté injoignable après $attempt tentatives." >&2 exit 1 fi @@ -134,4 +169,13 @@ if [ "${SKIP_MIGRATIONS:-0}" != "1" ]; then done fi +# Repère du retour en arrière. Écrit après les migrations, donc seulement par +# une version qui a pu démarrer : quand la suivante échouera, l'étiquette à +# réinstaller sera là, sur le disque, lisible sans l'application. +if [ -n "${APP_REVISION:-}" ] && [ "${SKIP_MIGRATIONS:-0}" != "1" ]; then + printf '%s\n' "$APP_REVISION" > "$CONFIG_DIR/last-good-revision.tmp" 2>/dev/null && + mv "$CONFIG_DIR/last-good-revision.tmp" "$CONFIG_DIR/last-good-revision" 2>/dev/null || + true +fi + exec "$@" diff --git a/docs/DOCKER.md b/docs/DOCKER.md index 8bf0f5c..0dae0dd 100644 --- a/docs/DOCKER.md +++ b/docs/DOCKER.md @@ -323,9 +323,56 @@ curl -s https://apel.example.org/api/health {"status":"ok","database":"up","latencyMs":3,"version":"main-42","revision":"a1b2c3d", ...} ``` -Ces indicateurs reposent sur un appel à l'API publique de GitHub, mis en cache -30 minutes. `UPDATE_CHECK_ENABLED="false"` supprime tout appel sortant : la -mise à jour automatique continue de fonctionner, seul l'indicateur disparaît. +Ces indicateurs reposent sur la lecture de l'image publiée dans le registre — +celle que l'`updater` installerait — et non sur le dernier commit du dépôt : +entre une fusion et la fin de la construction il s'écoule une dizaine de +minutes, pendant lesquelles il n'y a rien à installer. Le résultat est mis en +cache dix minutes. Le dépôt GitHub n'est consulté qu'en appoint, pour signaler +une version fusionnée dont l'image n'est pas encore publiée ; cette +consultation échoue sans conséquence. `UPDATE_CHECK_ENABLED="false"` supprime +tout appel sortant : la mise à jour automatique continue de fonctionner, seul +l'indicateur disparaît. + +L'écran indique aussi si le service `updater` répond réellement. Une mise à +jour automatique annoncée « activée » alors que le conteneur est arrêté +n'installerait jamais rien : la distinction est faite par une sonde, pas +déduite de la configuration. + +### Revenir à la version précédente + +Chaque publication pousse, à côté de `latest`, une étiquette immuable +`sha-xxxxxxx` reprenant les sept premiers caractères de la révision. C'est la +porte de sortie quand une version ne démarre pas. + +L'application écrit dans le volume `app_config` la révision du dernier +démarrage réussi. Pour la lire, même application arrêtée : + +```bash +docker run --rm -v apel-manager_app_config:/config alpine \ + cat /config/last-good-revision +``` + +Puis, dans `.env` : + +```env +APEL_IMAGE="ghcr.io/flocom/apel-manager:sha-2ab04da" +``` + +```bash +docker compose up -d +``` + +Deux points à connaître. D'abord, `docker compose pull && docker compose up -d` +ne répare rien : `latest` désigne justement la version fautive, et la commande +la réinstalle. Ensuite, tant qu'`APEL_IMAGE` désigne une étiquette `sha-`, la +mise à jour automatique est figée — l'`updater` surveille une étiquette qui ne +bouge plus. Remettez `APEL_IMAGE` à `latest` une fois le correctif publié. + +Une migration refusée par PostgreSQL n'abîme pas la base : elle est appliquée +d'un seul bloc, donc annulée d'un seul bloc, et le schéma reste celui de la +version précédente. Le conteneur s'arrête alors immédiatement en écrivant la +commande de retour dans ses journaux (`docker compose logs app`), au lieu de +réessayer en boucle. ### Précautions diff --git a/drizzle/0021_association_headquarters.sql b/drizzle/0021_association_headquarters.sql new file mode 100644 index 0000000..0e07544 --- /dev/null +++ b/drizzle/0021_association_headquarters.sql @@ -0,0 +1 @@ +ALTER TABLE "association_settings" ADD COLUMN "headquarters" text DEFAULT '' NOT NULL; \ No newline at end of file diff --git a/drizzle/meta/0021_snapshot.json b/drizzle/meta/0021_snapshot.json new file mode 100644 index 0000000..a907233 --- /dev/null +++ b/drizzle/meta/0021_snapshot.json @@ -0,0 +1,3587 @@ +{ + "id": "35531e8b-0540-44f3-99b4-438ae842e6ea", + "prevId": "d3c1d65e-8a29-43b1-938d-7cd6a77d722b", + "version": "7", + "dialect": "postgresql", + "tables": { + "public.accounting_categories": { + "name": "accounting_categories", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "type": { + "name": "type", + "type": "accounting_category_type", + "typeSchema": "public", + "primaryKey": false, + "notNull": true + }, + "description": { + "name": "description", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "is_active": { + "name": "is_active", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": true + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "accounting_categories_type_active_idx": { + "name": "accounting_categories_type_active_idx", + "columns": [ + { + "expression": "type", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "is_active", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.accounting_entries": { + "name": "accounting_entries", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "type": { + "name": "type", + "type": "accounting_entry_type", + "typeSchema": "public", + "primaryKey": false, + "notNull": true + }, + "status": { + "name": "status", + "type": "accounting_entry_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'draft'" + }, + "account_id": { + "name": "account_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "category_id": { + "name": "category_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "event_id": { + "name": "event_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "label": { + "name": "label", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "amount_cents": { + "name": "amount_cents", + "type": "integer", + "primaryKey": false, + "notNull": true + }, + "occurred_at": { + "name": "occurred_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true + }, + "counterparty": { + "name": "counterparty", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "payment_method": { + "name": "payment_method", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "reference": { + "name": "reference", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "notes": { + "name": "notes", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "attachment_url": { + "name": "attachment_url", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "created_by": { + "name": "created_by", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "version": { + "name": "version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "accounting_entries_occurred_at_idx": { + "name": "accounting_entries_occurred_at_idx", + "columns": [ + { + "expression": "occurred_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "accounting_entries_status_occurred_at_idx": { + "name": "accounting_entries_status_occurred_at_idx", + "columns": [ + { + "expression": "status", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "occurred_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "accounting_entries_account_idx": { + "name": "accounting_entries_account_idx", + "columns": [ + { + "expression": "account_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "accounting_entries_category_idx": { + "name": "accounting_entries_category_idx", + "columns": [ + { + "expression": "category_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "accounting_entries_event_idx": { + "name": "accounting_entries_event_idx", + "columns": [ + { + "expression": "event_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "accounting_entries_account_id_financial_accounts_id_fk": { + "name": "accounting_entries_account_id_financial_accounts_id_fk", + "tableFrom": "accounting_entries", + "tableTo": "financial_accounts", + "columnsFrom": [ + "account_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + }, + "accounting_entries_category_id_accounting_categories_id_fk": { + "name": "accounting_entries_category_id_accounting_categories_id_fk", + "tableFrom": "accounting_entries", + "tableTo": "accounting_categories", + "columnsFrom": [ + "category_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + }, + "accounting_entries_event_id_events_id_fk": { + "name": "accounting_entries_event_id_events_id_fk", + "tableFrom": "accounting_entries", + "tableTo": "events", + "columnsFrom": [ + "event_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + }, + "accounting_entries_created_by_users_id_fk": { + "name": "accounting_entries_created_by_users_id_fk", + "tableFrom": "accounting_entries", + "tableTo": "users", + "columnsFrom": [ + "created_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": { + "accounting_entries_amount_cents_check": { + "name": "accounting_entries_amount_cents_check", + "value": "\"accounting_entries\".\"amount_cents\" > 0" + } + }, + "isRLSEnabled": false + }, + "public.association_documents": { + "name": "association_documents", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "type": { + "name": "type", + "type": "association_document_type", + "typeSchema": "public", + "primaryKey": false, + "notNull": true + }, + "status": { + "name": "status", + "type": "association_document_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'draft'" + }, + "title": { + "name": "title", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "document_date": { + "name": "document_date", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true + }, + "content": { + "name": "content", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "''" + }, + "member_id": { + "name": "member_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "file_url": { + "name": "file_url", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "created_by": { + "name": "created_by", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "version": { + "name": "version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "association_documents_type_status_date_idx": { + "name": "association_documents_type_status_date_idx", + "columns": [ + { + "expression": "type", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "status", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "document_date", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "association_documents_member_idx": { + "name": "association_documents_member_idx", + "columns": [ + { + "expression": "member_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "association_documents_member_id_association_members_id_fk": { + "name": "association_documents_member_id_association_members_id_fk", + "tableFrom": "association_documents", + "tableTo": "association_members", + "columnsFrom": [ + "member_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + }, + "association_documents_created_by_users_id_fk": { + "name": "association_documents_created_by_users_id_fk", + "tableFrom": "association_documents", + "tableTo": "users", + "columnsFrom": [ + "created_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.association_members": { + "name": "association_members", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "first_name": { + "name": "first_name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "last_name": { + "name": "last_name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "phone": { + "name": "phone", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "address_line_1": { + "name": "address_line_1", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "address_line_2": { + "name": "address_line_2", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "postal_code": { + "name": "postal_code", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "city": { + "name": "city", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "country": { + "name": "country", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "'France'" + }, + "status": { + "name": "status", + "type": "association_member_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'pending'" + }, + "school_year": { + "name": "school_year", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "membership_fee_cents": { + "name": "membership_fee_cents", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "fee_paid_at": { + "name": "fee_paid_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "joined_at": { + "name": "joined_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "notes": { + "name": "notes", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "version": { + "name": "version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "association_members_user_idx": { + "name": "association_members_user_idx", + "columns": [ + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "where": "\"association_members\".\"user_id\" is not null", + "concurrently": false, + "method": "btree", + "with": {} + }, + "association_members_status_school_year_idx": { + "name": "association_members_status_school_year_idx", + "columns": [ + { + "expression": "status", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "school_year", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "association_members_name_idx": { + "name": "association_members_name_idx", + "columns": [ + { + "expression": "last_name", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "first_name", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "association_members_user_id_users_id_fk": { + "name": "association_members_user_id_users_id_fk", + "tableFrom": "association_members", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": { + "association_members_membership_fee_cents_check": { + "name": "association_members_membership_fee_cents_check", + "value": "\"association_members\".\"membership_fee_cents\" >= 0" + } + }, + "isRLSEnabled": false + }, + "public.association_settings": { + "name": "association_settings", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "default": "'default'" + }, + "association_name": { + "name": "association_name", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "'APEL Manager'" + }, + "school_name": { + "name": "school_name", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "'Votre établissement'" + }, + "contact_email": { + "name": "contact_email", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "rna": { + "name": "rna", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "''" + }, + "headquarters": { + "name": "headquarters", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "''" + }, + "logo_url": { + "name": "logo_url", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "task_reminder_window_days": { + "name": "task_reminder_window_days", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 3 + }, + "volunteer_reminder_window_days": { + "name": "volunteer_reminder_window_days", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 2 + }, + "telegram_enabled": { + "name": "telegram_enabled", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": false + }, + "encrypted_telegram_bot_token": { + "name": "encrypted_telegram_bot_token", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "telegram_token_last_four": { + "name": "telegram_token_last_four", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "telegram_bot_username": { + "name": "telegram_bot_username", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "telegram_token_verified_at": { + "name": "telegram_token_verified_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "recaptcha_enabled": { + "name": "recaptcha_enabled", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": false + }, + "recaptcha_site_key": { + "name": "recaptcha_site_key", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "encrypted_recaptcha_secret": { + "name": "encrypted_recaptcha_secret", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "recaptcha_min_score": { + "name": "recaptcha_min_score", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 50 + }, + "whatsapp_group_url": { + "name": "whatsapp_group_url", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "push_vapid_public_key": { + "name": "push_vapid_public_key", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "encrypted_push_vapid_private_key": { + "name": "encrypted_push_vapid_private_key", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "updated_by": { + "name": "updated_by", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": {}, + "foreignKeys": { + "association_settings_updated_by_users_id_fk": { + "name": "association_settings_updated_by_users_id_fk", + "tableFrom": "association_settings", + "tableTo": "users", + "columnsFrom": [ + "updated_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": { + "association_settings_singleton_check": { + "name": "association_settings_singleton_check", + "value": "\"association_settings\".\"id\" = 'default'" + }, + "association_settings_task_reminder_window_check": { + "name": "association_settings_task_reminder_window_check", + "value": "\"association_settings\".\"task_reminder_window_days\" >= 0 and \"association_settings\".\"task_reminder_window_days\" <= 30" + }, + "association_settings_recaptcha_min_score_check": { + "name": "association_settings_recaptcha_min_score_check", + "value": "\"association_settings\".\"recaptcha_min_score\" >= 0 and \"association_settings\".\"recaptcha_min_score\" <= 100" + }, + "association_settings_volunteer_reminder_window_check": { + "name": "association_settings_volunteer_reminder_window_check", + "value": "\"association_settings\".\"volunteer_reminder_window_days\" >= 0 and \"association_settings\".\"volunteer_reminder_window_days\" <= 30" + } + }, + "isRLSEnabled": false + }, + "public.audit_logs": { + "name": "audit_logs", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "actor_user_id": { + "name": "actor_user_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "oauth_client_id": { + "name": "oauth_client_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "action": { + "name": "action", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "entity_type": { + "name": "entity_type", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "entity_id": { + "name": "entity_id", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "source": { + "name": "source", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "'web'" + }, + "ip_address": { + "name": "ip_address", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "details": { + "name": "details", + "type": "jsonb", + "primaryKey": false, + "notNull": true, + "default": "'{}'::jsonb" + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "audit_logs_entity_idx": { + "name": "audit_logs_entity_idx", + "columns": [ + { + "expression": "entity_type", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "entity_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "audit_logs_actor_created_idx": { + "name": "audit_logs_actor_created_idx", + "columns": [ + { + "expression": "actor_user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "created_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "audit_logs_client_created_idx": { + "name": "audit_logs_client_created_idx", + "columns": [ + { + "expression": "oauth_client_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "created_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "audit_logs_created_at_idx": { + "name": "audit_logs_created_at_idx", + "columns": [ + { + "expression": "created_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "audit_logs_actor_user_id_users_id_fk": { + "name": "audit_logs_actor_user_id_users_id_fk", + "tableFrom": "audit_logs", + "tableTo": "users", + "columnsFrom": [ + "actor_user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + }, + "audit_logs_oauth_client_id_oauth_clients_id_fk": { + "name": "audit_logs_oauth_client_id_oauth_clients_id_fk", + "tableFrom": "audit_logs", + "tableTo": "oauth_clients", + "columnsFrom": [ + "oauth_client_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.checklist_templates": { + "name": "checklist_templates", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "description": { + "name": "description", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "tasks": { + "name": "tasks", + "type": "jsonb", + "primaryKey": false, + "notNull": true, + "default": "'[]'::jsonb" + }, + "version": { + "name": "version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": {}, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.event_attachments": { + "name": "event_attachments", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "event_id": { + "name": "event_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "label": { + "name": "label", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "file_url": { + "name": "file_url", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "uploaded_by": { + "name": "uploaded_by", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "event_attachments_event_idx": { + "name": "event_attachments_event_idx", + "columns": [ + { + "expression": "event_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "event_attachments_event_id_events_id_fk": { + "name": "event_attachments_event_id_events_id_fk", + "tableFrom": "event_attachments", + "tableTo": "events", + "columnsFrom": [ + "event_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "event_attachments_uploaded_by_users_id_fk": { + "name": "event_attachments_uploaded_by_users_id_fk", + "tableFrom": "event_attachments", + "tableTo": "users", + "columnsFrom": [ + "uploaded_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.events": { + "name": "events", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "kind": { + "name": "kind", + "type": "event_kind", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'event'" + }, + "title": { + "name": "title", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "description": { + "name": "description", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "public_description": { + "name": "public_description", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "ticketing_url": { + "name": "ticketing_url", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "location": { + "name": "location", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "start_at": { + "name": "start_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true + }, + "end_at": { + "name": "end_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "status": { + "name": "status", + "type": "event_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'draft'" + }, + "version": { + "name": "version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "share_token": { + "name": "share_token", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "created_by": { + "name": "created_by", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "events_status_start_idx": { + "name": "events_status_start_idx", + "columns": [ + { + "expression": "status", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "start_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "events_created_by_users_id_fk": { + "name": "events_created_by_users_id_fk", + "tableFrom": "events", + "tableTo": "users", + "columnsFrom": [ + "created_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": { + "events_share_token_unique": { + "name": "events_share_token_unique", + "nullsNotDistinct": false, + "columns": [ + "share_token" + ] + } + }, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.financial_accounts": { + "name": "financial_accounts", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "type": { + "name": "type", + "type": "financial_account_type", + "typeSchema": "public", + "primaryKey": false, + "notNull": true + }, + "description": { + "name": "description", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "is_active": { + "name": "is_active", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": true + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "financial_accounts_type_active_idx": { + "name": "financial_accounts_type_active_idx", + "columns": [ + { + "expression": "type", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "is_active", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.meeting_attendance": { + "name": "meeting_attendance", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "event_id": { + "name": "event_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "status": { + "name": "status", + "type": "meeting_attendance_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "phone": { + "name": "phone", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "cancel_token": { + "name": "cancel_token", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "note": { + "name": "note", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "meeting_attendance_event_user_unique": { + "name": "meeting_attendance_event_user_unique", + "columns": [ + { + "expression": "event_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "meeting_attendance_event_email_unique": { + "name": "meeting_attendance_event_email_unique", + "columns": [ + { + "expression": "event_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "lower(\"email\")", + "asc": true, + "isExpression": true, + "nulls": "last" + } + ], + "isUnique": true, + "where": "\"meeting_attendance\".\"user_id\" is null and \"meeting_attendance\".\"email\" is not null", + "concurrently": false, + "method": "btree", + "with": {} + }, + "meeting_attendance_cancel_token_idx": { + "name": "meeting_attendance_cancel_token_idx", + "columns": [ + { + "expression": "cancel_token", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "meeting_attendance_event_idx": { + "name": "meeting_attendance_event_idx", + "columns": [ + { + "expression": "event_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "meeting_attendance_event_id_events_id_fk": { + "name": "meeting_attendance_event_id_events_id_fk", + "tableFrom": "meeting_attendance", + "tableTo": "events", + "columnsFrom": [ + "event_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "meeting_attendance_user_id_users_id_fk": { + "name": "meeting_attendance_user_id_users_id_fk", + "tableFrom": "meeting_attendance", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": { + "meeting_attendance_identite": { + "name": "meeting_attendance_identite", + "value": "\"meeting_attendance\".\"user_id\" is not null or \"meeting_attendance\".\"name\" is not null" + } + }, + "isRLSEnabled": false + }, + "public.notifications_log": { + "name": "notifications_log", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "task_id": { + "name": "task_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "kind": { + "name": "kind", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "sent_at": { + "name": "sent_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "notifications_log_task_user_kind_idx": { + "name": "notifications_log_task_user_kind_idx", + "columns": [ + { + "expression": "task_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "kind", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "notifications_log_task_id_tasks_id_fk": { + "name": "notifications_log_task_id_tasks_id_fk", + "tableFrom": "notifications_log", + "tableTo": "tasks", + "columnsFrom": [ + "task_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "notifications_log_user_id_users_id_fk": { + "name": "notifications_log_user_id_users_id_fk", + "tableFrom": "notifications_log", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.oauth_authorization_codes": { + "name": "oauth_authorization_codes", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "code_hash": { + "name": "code_hash", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "oauth_client_id": { + "name": "oauth_client_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "redirect_uri": { + "name": "redirect_uri", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "scopes": { + "name": "scopes", + "type": "jsonb", + "primaryKey": false, + "notNull": true, + "default": "'[]'::jsonb" + }, + "code_challenge": { + "name": "code_challenge", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "code_challenge_method": { + "name": "code_challenge_method", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "'S256'" + }, + "expires_at": { + "name": "expires_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true + }, + "used_at": { + "name": "used_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "oauth_authorization_codes_code_hash_idx": { + "name": "oauth_authorization_codes_code_hash_idx", + "columns": [ + { + "expression": "code_hash", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "oauth_authorization_codes_client_expires_idx": { + "name": "oauth_authorization_codes_client_expires_idx", + "columns": [ + { + "expression": "oauth_client_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "expires_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "oauth_authorization_codes_user_idx": { + "name": "oauth_authorization_codes_user_idx", + "columns": [ + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "oauth_authorization_codes_oauth_client_id_oauth_clients_id_fk": { + "name": "oauth_authorization_codes_oauth_client_id_oauth_clients_id_fk", + "tableFrom": "oauth_authorization_codes", + "tableTo": "oauth_clients", + "columnsFrom": [ + "oauth_client_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "oauth_authorization_codes_user_id_users_id_fk": { + "name": "oauth_authorization_codes_user_id_users_id_fk", + "tableFrom": "oauth_authorization_codes", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.oauth_clients": { + "name": "oauth_clients", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "client_secret_hash": { + "name": "client_secret_hash", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "redirect_uris": { + "name": "redirect_uris", + "type": "jsonb", + "primaryKey": false, + "notNull": true, + "default": "'[]'::jsonb" + }, + "token_endpoint_auth_method": { + "name": "token_endpoint_auth_method", + "type": "text", + "primaryKey": false, + "notNull": true, + "default": "'none'" + }, + "grant_types": { + "name": "grant_types", + "type": "jsonb", + "primaryKey": false, + "notNull": true, + "default": "'[\"authorization_code\",\"refresh_token\"]'::jsonb" + }, + "scopes": { + "name": "scopes", + "type": "jsonb", + "primaryKey": false, + "notNull": true, + "default": "'[]'::jsonb" + }, + "enabled": { + "name": "enabled", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": true + }, + "created_by": { + "name": "created_by", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "oauth_clients_client_id_idx": { + "name": "oauth_clients_client_id_idx", + "columns": [ + { + "expression": "client_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "oauth_clients_enabled_idx": { + "name": "oauth_clients_enabled_idx", + "columns": [ + { + "expression": "enabled", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "oauth_clients_created_by_users_id_fk": { + "name": "oauth_clients_created_by_users_id_fk", + "tableFrom": "oauth_clients", + "tableTo": "users", + "columnsFrom": [ + "created_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.oauth_tokens": { + "name": "oauth_tokens", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "token_hash": { + "name": "token_hash", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "type": { + "name": "type", + "type": "oauth_token_type", + "typeSchema": "public", + "primaryKey": false, + "notNull": true + }, + "oauth_client_id": { + "name": "oauth_client_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "authorization_code_id": { + "name": "authorization_code_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "scopes": { + "name": "scopes", + "type": "jsonb", + "primaryKey": false, + "notNull": true, + "default": "'[]'::jsonb" + }, + "expires_at": { + "name": "expires_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true + }, + "revoked_at": { + "name": "revoked_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "oauth_tokens_token_hash_idx": { + "name": "oauth_tokens_token_hash_idx", + "columns": [ + { + "expression": "token_hash", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "oauth_tokens_client_type_expires_idx": { + "name": "oauth_tokens_client_type_expires_idx", + "columns": [ + { + "expression": "oauth_client_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "type", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "expires_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "oauth_tokens_user_idx": { + "name": "oauth_tokens_user_idx", + "columns": [ + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "oauth_tokens_authorization_code_idx": { + "name": "oauth_tokens_authorization_code_idx", + "columns": [ + { + "expression": "authorization_code_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "oauth_tokens_oauth_client_id_oauth_clients_id_fk": { + "name": "oauth_tokens_oauth_client_id_oauth_clients_id_fk", + "tableFrom": "oauth_tokens", + "tableTo": "oauth_clients", + "columnsFrom": [ + "oauth_client_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "oauth_tokens_user_id_users_id_fk": { + "name": "oauth_tokens_user_id_users_id_fk", + "tableFrom": "oauth_tokens", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "oauth_tokens_authorization_code_id_oauth_authorization_codes_id_fk": { + "name": "oauth_tokens_authorization_code_id_oauth_authorization_codes_id_fk", + "tableFrom": "oauth_tokens", + "tableTo": "oauth_authorization_codes", + "columnsFrom": [ + "authorization_code_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.outbound_mail_settings": { + "name": "outbound_mail_settings", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "default": "'default'" + }, + "provider": { + "name": "provider", + "type": "outbound_mail_provider", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'resend'" + }, + "enabled": { + "name": "enabled", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": false + }, + "from_name": { + "name": "from_name", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "from_email": { + "name": "from_email", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "reply_to": { + "name": "reply_to", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "domain": { + "name": "domain", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "encrypted_api_key": { + "name": "encrypted_api_key", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "key_last_four": { + "name": "key_last_four", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "smtp_host": { + "name": "smtp_host", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "smtp_port": { + "name": "smtp_port", + "type": "integer", + "primaryKey": false, + "notNull": false + }, + "smtp_secure": { + "name": "smtp_secure", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": false + }, + "smtp_username": { + "name": "smtp_username", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "encrypted_smtp_password": { + "name": "encrypted_smtp_password", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "last_tested_at": { + "name": "last_tested_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "last_test_status": { + "name": "last_test_status", + "type": "outbound_mail_test_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'untested'" + }, + "updated_by": { + "name": "updated_by", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "updated_at": { + "name": "updated_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": {}, + "foreignKeys": { + "outbound_mail_settings_updated_by_users_id_fk": { + "name": "outbound_mail_settings_updated_by_users_id_fk", + "tableFrom": "outbound_mail_settings", + "tableTo": "users", + "columnsFrom": [ + "updated_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": { + "outbound_mail_settings_singleton_check": { + "name": "outbound_mail_settings_singleton_check", + "value": "\"outbound_mail_settings\".\"id\" = 'default'" + }, + "outbound_mail_settings_smtp_port_check": { + "name": "outbound_mail_settings_smtp_port_check", + "value": "\"outbound_mail_settings\".\"smtp_port\" is null or (\"outbound_mail_settings\".\"smtp_port\" >= 1 and \"outbound_mail_settings\".\"smtp_port\" <= 65535)" + } + }, + "isRLSEnabled": false + }, + "public.password_reset_tokens": { + "name": "password_reset_tokens", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "token_hash": { + "name": "token_hash", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "expires_at": { + "name": "expires_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true + }, + "used_at": { + "name": "used_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": {}, + "foreignKeys": { + "password_reset_tokens_user_id_users_id_fk": { + "name": "password_reset_tokens_user_id_users_id_fk", + "tableFrom": "password_reset_tokens", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.push_deliveries": { + "name": "push_deliveries", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "notification_id": { + "name": "notification_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "subscription_id": { + "name": "subscription_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "status": { + "name": "status", + "type": "push_delivery_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'queued'" + }, + "ack_token": { + "name": "ack_token", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "error": { + "name": "error", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "sent_at": { + "name": "sent_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "received_at": { + "name": "received_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "opened_at": { + "name": "opened_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + } + }, + "indexes": { + "push_deliveries_notification_idx": { + "name": "push_deliveries_notification_idx", + "columns": [ + { + "expression": "notification_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "push_deliveries_ack_token_idx": { + "name": "push_deliveries_ack_token_idx", + "columns": [ + { + "expression": "ack_token", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "push_deliveries_user_idx": { + "name": "push_deliveries_user_idx", + "columns": [ + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "push_deliveries_notification_id_push_notifications_id_fk": { + "name": "push_deliveries_notification_id_push_notifications_id_fk", + "tableFrom": "push_deliveries", + "tableTo": "push_notifications", + "columnsFrom": [ + "notification_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "push_deliveries_user_id_users_id_fk": { + "name": "push_deliveries_user_id_users_id_fk", + "tableFrom": "push_deliveries", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "push_deliveries_subscription_id_push_subscriptions_id_fk": { + "name": "push_deliveries_subscription_id_push_subscriptions_id_fk", + "tableFrom": "push_deliveries", + "tableTo": "push_subscriptions", + "columnsFrom": [ + "subscription_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.push_notifications": { + "name": "push_notifications", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "sender_id": { + "name": "sender_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "title": { + "name": "title", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "body": { + "name": "body", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "url": { + "name": "url", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "push_notifications_created_at_idx": { + "name": "push_notifications_created_at_idx", + "columns": [ + { + "expression": "created_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "push_notifications_sender_id_users_id_fk": { + "name": "push_notifications_sender_id_users_id_fk", + "tableFrom": "push_notifications", + "tableTo": "users", + "columnsFrom": [ + "sender_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.push_subscriptions": { + "name": "push_subscriptions", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "endpoint": { + "name": "endpoint", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "p256dh": { + "name": "p256dh", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "auth": { + "name": "auth", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "device_label": { + "name": "device_label", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "last_success_at": { + "name": "last_success_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "push_subscriptions_endpoint_idx": { + "name": "push_subscriptions_endpoint_idx", + "columns": [ + { + "expression": "endpoint", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "push_subscriptions_user_idx": { + "name": "push_subscriptions_user_idx", + "columns": [ + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "push_subscriptions_user_id_users_id_fk": { + "name": "push_subscriptions_user_id_users_id_fk", + "tableFrom": "push_subscriptions", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.task_assignees": { + "name": "task_assignees", + "schema": "", + "columns": { + "task_id": { + "name": "task_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + } + }, + "indexes": { + "task_assignees_user_idx": { + "name": "task_assignees_user_idx", + "columns": [ + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "task_assignees_task_id_tasks_id_fk": { + "name": "task_assignees_task_id_tasks_id_fk", + "tableFrom": "task_assignees", + "tableTo": "tasks", + "columnsFrom": [ + "task_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "task_assignees_user_id_users_id_fk": { + "name": "task_assignees_user_id_users_id_fk", + "tableFrom": "task_assignees", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": { + "task_assignees_task_id_user_id_pk": { + "name": "task_assignees_task_id_user_id_pk", + "columns": [ + "task_id", + "user_id" + ] + } + }, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.tasks": { + "name": "tasks", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "event_id": { + "name": "event_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "title": { + "name": "title", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "description": { + "name": "description", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "lead_time_days": { + "name": "lead_time_days", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 7 + }, + "lead_time_value": { + "name": "lead_time_value", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 7 + }, + "lead_time_unit": { + "name": "lead_time_unit", + "type": "task_lead_time_unit", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'days'" + }, + "due_at": { + "name": "due_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true + }, + "status": { + "name": "status", + "type": "task_status", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'todo'" + }, + "position": { + "name": "position", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "version": { + "name": "version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "completed_at": { + "name": "completed_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "tasks_event_idx": { + "name": "tasks_event_idx", + "columns": [ + { + "expression": "event_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "tasks_status_due_idx": { + "name": "tasks_status_due_idx", + "columns": [ + { + "expression": "status", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "due_at", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "tasks_event_id_events_id_fk": { + "name": "tasks_event_id_events_id_fk", + "tableFrom": "tasks", + "tableTo": "events", + "columnsFrom": [ + "event_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": { + "tasks_lead_time_value_check": { + "name": "tasks_lead_time_value_check", + "value": "\"tasks\".\"lead_time_value\" >= 0" + }, + "tasks_lead_time_consistency_check": { + "name": "tasks_lead_time_consistency_check", + "value": "\"tasks\".\"lead_time_days\" = \"tasks\".\"lead_time_value\" * case \"tasks\".\"lead_time_unit\" when 'days' then 1 when 'weeks' then 7 when 'months' then 30 end" + } + }, + "isRLSEnabled": false + }, + "public.users": { + "name": "users", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "password_hash": { + "name": "password_hash", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "role": { + "name": "role", + "type": "role", + "typeSchema": "public", + "primaryKey": false, + "notNull": true, + "default": "'member'" + }, + "telegram_chat_id": { + "name": "telegram_chat_id", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "session_epoch": { + "name": "session_epoch", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 0 + }, + "onboarding_seen_at": { + "name": "onboarding_seen_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "push_enabled": { + "name": "push_enabled", + "type": "boolean", + "primaryKey": false, + "notNull": true, + "default": true + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": {}, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": { + "users_email_unique": { + "name": "users_email_unique", + "nullsNotDistinct": false, + "columns": [ + "email" + ] + } + }, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.volunteer_signups": { + "name": "volunteer_signups", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "slot_id": { + "name": "slot_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "user_id": { + "name": "user_id", + "type": "uuid", + "primaryKey": false, + "notNull": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "phone": { + "name": "phone", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "cancel_token": { + "name": "cancel_token", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "reminded_at": { + "name": "reminded_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "volunteer_signups_slot_idx": { + "name": "volunteer_signups_slot_idx", + "columns": [ + { + "expression": "slot_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "volunteer_signups_user_idx": { + "name": "volunteer_signups_user_idx", + "columns": [ + { + "expression": "user_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + }, + "volunteer_signups_cancel_token_idx": { + "name": "volunteer_signups_cancel_token_idx", + "columns": [ + { + "expression": "cancel_token", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": true, + "concurrently": false, + "method": "btree", + "with": {} + }, + "volunteer_signups_slot_email_idx": { + "name": "volunteer_signups_slot_email_idx", + "columns": [ + { + "expression": "slot_id", + "isExpression": false, + "asc": true, + "nulls": "last" + }, + { + "expression": "lower(\"email\")", + "asc": true, + "isExpression": true, + "nulls": "last" + } + ], + "isUnique": true, + "where": "\"volunteer_signups\".\"email\" is not null", + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "volunteer_signups_slot_id_volunteer_slots_id_fk": { + "name": "volunteer_signups_slot_id_volunteer_slots_id_fk", + "tableFrom": "volunteer_signups", + "tableTo": "volunteer_slots", + "columnsFrom": [ + "slot_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "volunteer_signups_user_id_users_id_fk": { + "name": "volunteer_signups_user_id_users_id_fk", + "tableFrom": "volunteer_signups", + "tableTo": "users", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + }, + "public.volunteer_slots": { + "name": "volunteer_slots", + "schema": "", + "columns": { + "id": { + "name": "id", + "type": "uuid", + "primaryKey": true, + "notNull": true, + "default": "gen_random_uuid()" + }, + "event_id": { + "name": "event_id", + "type": "uuid", + "primaryKey": false, + "notNull": true + }, + "title": { + "name": "title", + "type": "text", + "primaryKey": false, + "notNull": true + }, + "description": { + "name": "description", + "type": "text", + "primaryKey": false, + "notNull": false + }, + "start_at": { + "name": "start_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "end_at": { + "name": "end_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": false + }, + "capacity": { + "name": "capacity", + "type": "integer", + "primaryKey": false, + "notNull": true, + "default": 1 + }, + "created_at": { + "name": "created_at", + "type": "timestamp with time zone", + "primaryKey": false, + "notNull": true, + "default": "now()" + } + }, + "indexes": { + "volunteer_slots_event_idx": { + "name": "volunteer_slots_event_idx", + "columns": [ + { + "expression": "event_id", + "isExpression": false, + "asc": true, + "nulls": "last" + } + ], + "isUnique": false, + "concurrently": false, + "method": "btree", + "with": {} + } + }, + "foreignKeys": { + "volunteer_slots_event_id_events_id_fk": { + "name": "volunteer_slots_event_id_events_id_fk", + "tableFrom": "volunteer_slots", + "tableTo": "events", + "columnsFrom": [ + "event_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "policies": {}, + "checkConstraints": {}, + "isRLSEnabled": false + } + }, + "enums": { + "public.accounting_category_type": { + "name": "accounting_category_type", + "schema": "public", + "values": [ + "income", + "expense" + ] + }, + "public.accounting_entry_status": { + "name": "accounting_entry_status", + "schema": "public", + "values": [ + "draft", + "posted" + ] + }, + "public.accounting_entry_type": { + "name": "accounting_entry_type", + "schema": "public", + "values": [ + "income", + "expense" + ] + }, + "public.association_document_status": { + "name": "association_document_status", + "schema": "public", + "values": [ + "draft", + "final", + "archived" + ] + }, + "public.association_document_type": { + "name": "association_document_type", + "schema": "public", + "values": [ + "ag_minutes", + "attestation", + "statutes", + "internal_rules", + "insurance", + "agreement", + "other" + ] + }, + "public.association_member_status": { + "name": "association_member_status", + "schema": "public", + "values": [ + "active", + "pending", + "inactive" + ] + }, + "public.event_kind": { + "name": "event_kind", + "schema": "public", + "values": [ + "event", + "meeting" + ] + }, + "public.event_status": { + "name": "event_status", + "schema": "public", + "values": [ + "draft", + "published", + "archived" + ] + }, + "public.financial_account_type": { + "name": "financial_account_type", + "schema": "public", + "values": [ + "bank", + "cash" + ] + }, + "public.meeting_attendance_status": { + "name": "meeting_attendance_status", + "schema": "public", + "values": [ + "yes", + "maybe", + "no" + ] + }, + "public.oauth_token_type": { + "name": "oauth_token_type", + "schema": "public", + "values": [ + "access", + "refresh" + ] + }, + "public.outbound_mail_provider": { + "name": "outbound_mail_provider", + "schema": "public", + "values": [ + "resend", + "smtp" + ] + }, + "public.outbound_mail_test_status": { + "name": "outbound_mail_test_status", + "schema": "public", + "values": [ + "untested", + "success", + "failed" + ] + }, + "public.push_delivery_status": { + "name": "push_delivery_status", + "schema": "public", + "values": [ + "queued", + "sent", + "failed", + "received", + "opened" + ] + }, + "public.role": { + "name": "role", + "schema": "public", + "values": [ + "admin", + "manager", + "member" + ] + }, + "public.task_lead_time_unit": { + "name": "task_lead_time_unit", + "schema": "public", + "values": [ + "days", + "weeks", + "months" + ] + }, + "public.task_status": { + "name": "task_status", + "schema": "public", + "values": [ + "todo", + "in_progress", + "done" + ] + } + }, + "schemas": {}, + "sequences": {}, + "roles": {}, + "policies": {}, + "views": {}, + "_meta": { + "columns": {}, + "schemas": {}, + "tables": {} + } +} \ No newline at end of file diff --git a/drizzle/meta/_journal.json b/drizzle/meta/_journal.json index 2ed11fd..73d81a2 100644 --- a/drizzle/meta/_journal.json +++ b/drizzle/meta/_journal.json @@ -148,6 +148,13 @@ "when": 1789051948309, "tag": "0020_public_meeting_attendance", "breakpoints": true + }, + { + "idx": 21, + "version": "7", + "when": 1789629977428, + "tag": "0021_association_headquarters", + "breakpoints": true } ] } \ No newline at end of file diff --git a/scripts/migrate.mjs b/scripts/migrate.mjs index eecde7c..18264ee 100644 --- a/scripts/migrate.mjs +++ b/scripts/migrate.mjs @@ -30,6 +30,44 @@ const client = postgres(databaseUrl, { idle_timeout: 5, }); +/** + * Codes qui signifient « la base n'est pas encore joignable ». Eux seuls + * justifient de réessayer : au démarrage d'une pile, PostgreSQL met quelques + * secondes à accepter les connexions. + * + * Tout le reste — une erreur SQL, un index unique refusé par des doublons + * réels, une contrainte violée par les données en place — se reproduira à + * l'identique trente fois de suite. Les confondre faisait afficher + * « PostgreSQL indisponible » pendant quatre minutes pour une migration + * fautive, et envoyait chercher une panne de base qui n'existait pas. + */ +const CODES_CONNEXION = new Set([ + "ECONNREFUSED", + "ENOTFOUND", + "ETIMEDOUT", + "EHOSTUNREACH", + "ENETUNREACH", + "ECONNRESET", + "EPIPE", + "CONNECT_TIMEOUT", + "CONNECTION_CLOSED", + "CONNECTION_ENDED", + "CONNECTION_DESTROYED", + // PostgreSQL démarre, accepte la connexion et la refuse aussitôt. + "57P03", +]); + +function estPanneDeConnexion(error) { + for (let cause = error; cause; cause = cause.cause) { + if (cause.code && CODES_CONNEXION.has(String(cause.code))) return true; + } + return false; +} + +/** Code 2 : inutile de réessayer. Code 1 : la base n'est pas encore là. */ +const SORTIE_FATALE = 2; +const SORTIE_REESSAYABLE = 1; + let migrationFailed = false; try { @@ -38,14 +76,20 @@ try { console.log("Migrations PostgreSQL appliquées."); } catch (error) { migrationFailed = true; - process.exitCode = 1; - console.error("Échec des migrations PostgreSQL."); + const reessayable = estPanneDeConnexion(error); + process.exitCode = reessayable ? SORTIE_REESSAYABLE : SORTIE_FATALE; + console.error( + reessayable + ? "PostgreSQL n'est pas joignable pour appliquer les migrations." + : "Migration refusée par PostgreSQL : cette version ne peut pas démarrer.", + ); console.error(error instanceof Error ? error.message : error); } finally { try { await client.end({ timeout: 5 }); } catch (error) { - process.exitCode = 1; + // Ne pas écraser un diagnostic fatal par un simple défaut de fermeture. + process.exitCode = process.exitCode || SORTIE_REESSAYABLE; console.error("Impossible de fermer proprement la connexion PostgreSQL."); if (!migrationFailed) { console.error(error instanceof Error ? error.message : error); diff --git a/src/app/dashboard/settings/page.tsx b/src/app/dashboard/settings/page.tsx index 8898329..00ddaf5 100644 --- a/src/app/dashboard/settings/page.tsx +++ b/src/app/dashboard/settings/page.tsx @@ -29,6 +29,7 @@ export default async function SettingsPage() { schoolName: associationStatus.schoolName, contactEmail: associationStatus.contactEmail, rna: associationStatus.rna, + headquarters: associationStatus.headquarters, logoUrl: associationStatus.logoUrl, taskReminderWindowDays: associationStatus.taskReminderWindowDays, volunteerReminderWindowDays: diff --git a/src/components/association-settings-form.tsx b/src/components/association-settings-form.tsx index b383bad..e08b15d 100644 --- a/src/components/association-settings-form.tsx +++ b/src/components/association-settings-form.tsx @@ -24,6 +24,7 @@ export interface AssociationSettingsView { schoolName: string; contactEmail: string | null; rna: string; + headquarters: string; logoUrl: string | null; taskReminderWindowDays: number; volunteerReminderWindowDays: number; @@ -89,6 +90,7 @@ export function AssociationSettingsForm({ schoolName: form.get("schoolName"), contactEmail: form.get("contactEmail") || null, rna: form.get("rna"), + headquarters: form.get("headquarters"), logoUrl: form.get("logoUrl") || null, taskReminderWindowDays: Number( form.get("taskReminderWindowDays"), @@ -219,6 +221,20 @@ export function AssociationSettingsForm({ required /> + + + diff --git a/src/components/update-status-card.tsx b/src/components/update-status-card.tsx index ba44237..25adf00 100644 --- a/src/components/update-status-card.tsx +++ b/src/components/update-status-card.tsx @@ -2,13 +2,15 @@ import { CircleAlert, + Clock, DownloadCloud, + PlugZap, RefreshCw, RotateCw, Rocket, ShieldCheck, } from "lucide-react"; -import { useState } from "react"; +import { useCallback, useEffect, useRef, useState } from "react"; import { ConfirmDialog } from "@/components/confirm-dialog"; import { useToast } from "@/components/toast"; @@ -16,6 +18,10 @@ import { Badge, Button, Card } from "@/components/ui"; import { formatLongDateTime } from "@/lib/dates"; import type { UpdateStatus } from "@/lib/services/updates"; +/** Durée pendant laquelle on attend le retour de l'application après un déclenchement. */ +const SURVEILLANCE_MS = 4 * 60 * 1000; +const INTERVALLE_MS = 3000; + function formatDate(value: string | null) { if (!value) return null; const date = new Date(value); @@ -34,11 +40,17 @@ function formatInterval(seconds: number) { return `toutes les ${seconds} secondes`; } -function StateBadge({ state }: { state: UpdateStatus["state"] }) { +function StateBadge({ + state, + stale, +}: { + state: UpdateStatus["state"]; + stale: boolean; +}) { if (state === "up-to-date") { return ( - - À jour + + {stale ? "À jour, d’après la dernière lecture" : "À jour"} ); } @@ -64,23 +76,74 @@ function Line({ label, value }: { label: string; value: string }) { ); } +/** Encart d'information, neutre ou d'alerte selon le ton. */ +function Encart({ + ton, + icone: Icone, + titre, + children, +}: { + ton: "neutre" | "attention" | "alerte"; + icone: typeof CircleAlert; + titre: string; + children: React.ReactNode; +}) { + const teintes = { + neutre: "border-slate-200 bg-slate-50 text-slate-500", + attention: "border-amber-200 bg-amber-50 text-amber-700", + alerte: "border-coral-300 bg-coral-50 text-coral-700", + }[ton]; + const [bordure, fond, encre] = teintes.split(" "); + return ( +
+
+ ); +} + export function UpdateStatusCard({ status }: { status: UpdateStatus }) { const toast = useToast(); const [current, setCurrent] = useState(status); const [checking, setChecking] = useState(false); const [applying, setApplying] = useState(false); const [confirmApply, setConfirmApply] = useState(false); + /** Compte rendu de ce qui s'est réellement passé après un déclenchement. */ + const [suivi, setSuivi] = useState< + | null + | { etat: "attente"; message: string } + | { etat: "installee" | "inchangee" | "perdue"; message: string } + >(null); + const vivant = useRef(true); + + useEffect(() => { + vivant.current = true; + return () => { + vivant.current = false; + }; + }, []); + + // L'écran est rendu côté serveur : quand la page se rafraîchit, la prop + // apporte un état plus récent que celui gardé en mémoire ici. + useEffect(() => { + setCurrent(status); + }, [status]); + + const recharger = useCallback(async () => { + const response = await fetch("/api/updates?refresh=1", { + cache: "no-store", + }); + if (!response.ok) throw new Error(`réponse ${response.status}`); + return (await response.json()) as UpdateStatus; + }, []); async function check() { setChecking(true); try { - const response = await fetch("/api/updates?refresh=1", { - cache: "no-store", - }); - if (!response.ok) { - throw new Error("Vérification impossible."); - } - const refreshed = (await response.json()) as UpdateStatus; + const refreshed = await recharger(); setCurrent(refreshed); // Un contrôle qui n'a pas abouti ne doit pas s'annoncer comme terminé : // l'état affiché vient alors de la dernière réponse connue. @@ -103,52 +166,148 @@ export function UpdateStatusCard({ status }: { status: UpdateStatus }) { } } - const REDEMARRAGE = - "Mise à jour lancée. L’application redémarre, rechargez la page dans un instant."; + /** + * Après un déclenchement, on ne devine plus : on regarde. L'application est + * interrogée jusqu'à ce qu'elle réponde de nouveau, puis sa révision est + * comparée à celle d'avant. C'est la seule façon de distinguer « installée » + * de « rien n'a bougé » — la requête de déclenchement, elle, meurt avec le + * conteneur qu'elle vient de faire remplacer. + */ + const surveiller = useCallback( + async (revisionAvant: string) => { + const limite = Date.now() + SURVEILLANCE_MS; + let tombee = false; + + setSuivi({ + etat: "attente", + message: + "Demande envoyée. Si une version plus récente existe, l’application redémarre — cet écran dira ce qui a été installé.", + }); + + while (Date.now() < limite) { + await new Promise((r) => setTimeout(r, INTERVALLE_MS)); + if (!vivant.current) return; + + // On interroge le contrôle de santé, et non l'état des mises à jour : + // il répond sans consulter ni registre ni dépôt. Rafraîchir l'état + // complet toutes les trois secondes épuiserait en une minute le quota + // horaire de l'API GitHub et martèlerait le registre pour rien. Ce + // point d'entrée atteste en outre que la base répond : une application + // dont les migrations échouent n'est pas « revenue ». + let sante: { revision: string | null; version: string } | null = null; + try { + const reponse = await fetch("/api/health", { cache: "no-store" }); + if (!reponse.ok) throw new Error(String(reponse.status)); + sante = (await reponse.json()) as { revision: string | null; version: string }; + } catch { + // L'application ne répond plus : c'est le remplacement en cours. + tombee = true; + if (vivant.current) { + setSuivi({ + etat: "attente", + message: + "L’application redémarre… cet écran se met à jour tout seul dès qu’elle répond.", + }); + } + continue; + } + + if (!vivant.current) return; + if (sante.revision && sante.revision !== revisionAvant) { + // Une seule lecture complète, celle qui remet la carte à jour. + try { + setCurrent(await recharger()); + } catch { + // Sans conséquence : le compte rendu ci-dessous suffit. + } + if (!vivant.current) return; + setSuivi({ + etat: "installee", + message: `Mise à jour installée : l’application tourne maintenant en ${sante.version} (${sante.revision}).`, + }); + return; + } + if (tombee) { + setSuivi({ + etat: "inchangee", + message: + "L’application est revenue, toujours dans la même version : le service de mise à jour n’avait rien de plus récent à installer.", + }); + return; + } + } + + if (!vivant.current) return; + setSuivi({ + etat: tombee ? "perdue" : "inchangee", + message: tombee + ? "L’application n’est pas revenue au bout de quatre minutes. Vérifiez sur le serveur : « docker compose ps » puis « docker compose logs app »." + : "Le service de mise à jour n’a rien installé : aucune version plus récente n’est publiée.", + }); + }, + [recharger], + ); async function applyNow() { setConfirmApply(false); setApplying(true); + const revisionAvant = current.current.shortRevision; try { const response = await fetch("/api/updates/apply", { method: "POST" }); if (!response.ok) { const payload = (await response.json().catch(() => null)) as { error?: string; } | null; - if (payload?.error) throw new Error(payload.error); - // Réponse sans explication : c'est le proxy qui parle, pas - // l'application. Une passerelle en défaut pendant que le conteneur est - // justement remplacé annonce la mise à jour, elle ne l'infirme pas. - if (response.status >= 502 && response.status <= 504) { - toast(REDEMARRAGE); + // Réponse sans explication entre 502 et 504 : c'est le proxy qui parle, + // pas l'application. Une passerelle en défaut pendant que le conteneur + // est justement remplacé annonce la mise à jour, elle ne l'infirme pas. + if (!payload?.error && response.status >= 502 && response.status <= 504) { + await surveiller(revisionAvant); return; } throw new Error( - `Mise à jour impossible (réponse ${response.status} du serveur).`, + payload?.error ?? + `Mise à jour impossible (réponse ${response.status} du serveur).`, ); } const { outcome } = (await response.json()) as { - outcome: "started" | "restarting"; + outcome: "no-update" | "restarting"; }; - toast( - outcome === "restarting" - ? REDEMARRAGE - : "Contrôle effectué : aucune version plus récente à installer.", - ); + if (outcome === "restarting") { + await surveiller(revisionAvant); + return; + } + // L'updater a répondu sans nous interrompre : rien n'était à installer. + // On revérifie tout de même, la version publiée a pu changer depuis. + setSuivi({ + etat: "inchangee", + message: + "Le service de mise à jour a contrôlé le registre et rendu la main sans redémarrer l’application : rien n’a été installé.", + }); + try { + setCurrent(await recharger()); + } catch { + // Sans conséquence : l'écran garde l'état qu'il avait. + } } catch (error) { // Le conteneur peut disparaître avant de répondre : la requête échoue // alors côté navigateur alors que la mise à jour est bel et bien partie. - toast( - error instanceof TypeError ? REDEMARRAGE : (error as Error).message, - error instanceof TypeError ? "success" : "error", - ); + if (error instanceof TypeError) { + await surveiller(revisionAvant); + return; + } + setSuivi(null); + toast((error as Error).message, "error"); } finally { - setApplying(false); + if (vivant.current) setApplying(false); } } const buildTime = formatDate(current.current.buildTime); const checkedAt = formatDate(current.checkedAt); + const { autoUpdate } = current; + const injoignable = + autoUpdate.enabled && autoUpdate.reachability === "unreachable"; return ( @@ -166,27 +325,20 @@ export function UpdateStatusCard({ status }: { status: UpdateStatus }) {

- +
{current.current.development && ( -
-
+ + Aucune version n'est estampillée : la comparaison avec la + version publiée n'est pas possible. C'est le cas en + développement local ou après une construction manuelle. + )}
@@ -198,72 +350,141 @@ export function UpdateStatusCard({ status }: { status: UpdateStatus }) { {current.latest && ( )}
+ {/* Ce que le déclenchement a réellement produit : constaté, pas supposé. */} + {suivi && ( + +

{suivi.message}

+ {suivi.etat === "installee" && ( + + )} + + )} + + {injoignable && ( + + Rien ne sera installé automatiquement tant qu'il est arrêté. + Sur le serveur :{" "} + + docker compose ps updater + {" "} + puis{" "} + + docker compose up -d updater + + . + + )} + {current.state === "outdated" && current.latest && ( -
-
+ + {autoUpdate.enabled && !injoignable + ? `Elle sera installée automatiquement lors du prochain contrôle (${formatInterval( + autoUpdate.pollIntervalSeconds, + )}), sans intervention.` + : "La mise à jour automatique n’assure pas l’installation : lancez « docker compose pull && docker compose up -d » sur le serveur."} + + )} + + {/* Fusionné mais pas encore publié : ni « à jour » ni installable. */} + {current.pending && ( + + Le commit{" "} + + {current.pending.shortRevision} + {" "} + {current.pending.committedAt + ? ` a été fusionné le ${formatDate(current.pending.committedAt)} ` + : " est fusionné "} + mais son image n'est pas encore publiée. La construction dure une + dizaine de minutes ; au-delà, vérifiez qu'elle n'a pas échoué. + + )} + + {current.stale && ( + + Le registre n’a pas répondu cette fois : l’état ci-dessus repose sur + la dernière lecture réussie, pas sur celle de maintenant. + )} {current.error && ( -

- {current.error} -

+

{current.error}

)}
@@ -272,24 +493,70 @@ export function UpdateStatusCard({ status }: { status: UpdateStatus }) { ? `Dernière vérification réussie : ${checkedAt}` : "Aucune vérification aboutie."}

- +
+ {/* Disponible dès que l'updater peut être sollicité : c'est + précisément quand l'état est inconnu qu'on veut pouvoir forcer + le contrôle à la main. */} + {autoUpdate.canTriggerNow && ( + + )} + {autoUpdate.enabled && !autoUpdate.canTriggerNow && ( +

+ L’installation immédiate n’est pas disponible : le jeton qui + autorise cette page à demander un redémarrage au service de mise + à jour n’a pas encore été généré. Il l’est tout seul au + démarrage ; relancez la pile sur le serveur avec{" "} + + docker compose pull && docker compose up -d + + . +

+ )} + +
setConfirmApply(false)} diff --git a/src/lib/db/schema.ts b/src/lib/db/schema.ts index f435558..3a5cd7a 100644 --- a/src/lib/db/schema.ts +++ b/src/lib/db/schema.ts @@ -655,6 +655,14 @@ export const associationSettings = pgTable( .default("Votre établissement"), contactEmail: text("contact_email"), rna: text("rna").notNull().default(""), + /** + * Siège social déclaré en préfecture. Un procès-verbal d'assemblée + * générale, une attestation ou un courrier à la banque identifient + * l'association par son nom, son RNA et son siège : sans cette adresse, + * aucun des trois n'est complet. Vide tant qu'elle n'a pas été renseignée + * — les documents le signalent plutôt que d'inventer. + */ + headquarters: text("headquarters").notNull().default(""), /** * Logo affiché sur le site et dans l'espace de travail. Chemin d'un fichier * du scope `branding` ; vide, l'application utilise le logo neutre livré diff --git a/src/lib/mcp/register-association-tools.ts b/src/lib/mcp/register-association-tools.ts index 78d01bd..0244c8c 100644 --- a/src/lib/mcp/register-association-tools.ts +++ b/src/lib/mcp/register-association-tools.ts @@ -762,6 +762,13 @@ export function registerAssociationTools( .string() .regex(/^W\d{9}$/i, "Numéro RNA invalide") .optional(), + headquarters: z + .string() + .max(300) + .optional() + .describe( + "Siège social déclaré en préfecture, repris sur les documents officiels.", + ), taskReminderWindowDays: z.number().int().min(0).max(30).optional(), volunteerReminderWindowDays: z .number() @@ -786,6 +793,7 @@ export function registerAssociationTools( ? current.contactEmail : args.contactEmail, rna: args.rna ?? current.rna, + headquarters: args.headquarters ?? current.headquarters, taskReminderWindowDays: args.taskReminderWindowDays ?? current.taskReminderWindowDays, @@ -794,6 +802,16 @@ export function registerAssociationTools( current.volunteerReminderWindowDays, telegramEnabled: args.telegramEnabled ?? current.telegramEnabled, + // Le schéma remplace tout réglage absent par sa valeur par défaut. + // Sans ces reprises, modifier le nom de l'association par cet outil + // effaçait au passage le logo, le lien du groupe WhatsApp et la clé + // de site reCAPTCHA — donc désactivait la protection des + // formulaires publics sans que personne ne l'ait demandé. + logoUrl: current.logoUrl, + recaptchaEnabled: current.recaptchaEnabled, + recaptchaSiteKey: current.recaptchaSiteKey, + recaptchaMinScore: current.recaptchaMinScore, + whatsappGroupUrl: current.whatsappGroupUrl, }, mcpAuditActor(principal), ); diff --git a/src/lib/services/association-settings.ts b/src/lib/services/association-settings.ts index e2525db..a75abca 100644 --- a/src/lib/services/association-settings.ts +++ b/src/lib/services/association-settings.ts @@ -72,6 +72,7 @@ export async function getAssociationSettings() { schoolName: settings.schoolName, contactEmail: settings.contactEmail, rna: settings.rna, + headquarters: settings.headquarters, logoUrl: settings.logoUrl, taskReminderWindowDays: settings.taskReminderWindowDays, volunteerReminderWindowDays: settings.volunteerReminderWindowDays, @@ -106,6 +107,10 @@ export async function getAssociationSettings() { schoolName: SCHOOL_NAME, contactEmail: CONTACT_EMAIL || null, rna: ASSOCIATION_RNA, + // Le siège social n'a jamais eu de variable d'environnement : sur une + // installation d'avant les réglages en base, il reste vide et les + // documents le signalent. + headquarters: "", logoUrl: null, taskReminderWindowDays: legacyReminderWindow("REMINDER_WINDOW_DAYS", 3), volunteerReminderWindowDays: 2, @@ -250,6 +255,7 @@ export async function saveAssociationSettings( schoolName: data.schoolName, contactEmail: emptyToNull(data.contactEmail), rna: data.rna, + headquarters: data.headquarters, logoUrl: emptyToNull(data.logoUrl), taskReminderWindowDays: data.taskReminderWindowDays, volunteerReminderWindowDays: data.volunteerReminderWindowDays, diff --git a/src/lib/services/documents.ts b/src/lib/services/documents.ts index 0e9e580..7e53858 100644 --- a/src/lib/services/documents.ts +++ b/src/lib/services/documents.ts @@ -292,6 +292,11 @@ export async function renderPrintableDocument(document: { const rnaSuffix = association.rna.trim() ? ` · RNA ${escapeHtml(association.rna.trim())}` : ""; + // L'identité complète — nom, siège, RNA — est ce qui fait qu'une préfecture, + // une banque ou un assureur reconnaissent l'association dans le document. + const siege = association.headquarters.trim() + ? `
Siège social : ${escapeHtml(association.headquarters.trim())}
` + : ""; return ` @@ -314,6 +319,7 @@ export async function renderPrintableDocument(document: {
${escapeHtml(association.associationName)}
${escapeHtml(association.schoolName)}${rnaSuffix}
+ ${siege}

${typeLabel} · ${formatLongDate(document.documentDate)}

diff --git a/src/lib/services/registry.ts b/src/lib/services/registry.ts new file mode 100644 index 0000000..0daec88 --- /dev/null +++ b/src/lib/services/registry.ts @@ -0,0 +1,309 @@ +import "server-only"; + +/** + * Lecture de l'image publiée dans le registre. + * + * C'est l'image — pas le dernier commit — que l'`updater` installe. Interroger + * GitHub revenait à mesurer autre chose que ce qui allait se produire : entre + * la fusion et la fin de la construction multi-architecture il s'écoule une + * dizaine de minutes pendant lesquelles l'écran annonçait une mise à jour que + * personne ne pouvait installer, et si la construction échouait, il l'annonçait + * indéfiniment. + * + * Le protocole est celui de l'API Registry v2, telle que la parlent GHCR, le + * Docker Hub et les registres auto-hébergés : une première requête sans jeton, + * un en-tête `WWW-Authenticate` qui indique où en demander un, puis la même + * requête avec. Les images publiques n'exigent aucun identifiant. + */ + +const MANIFEST_TYPES = [ + "application/vnd.oci.image.index.v1+json", + "application/vnd.docker.distribution.manifest.list.v2+json", + "application/vnd.oci.image.manifest.v1+json", + "application/vnd.docker.distribution.manifest.v2+json", +].join(", "); + +const REQUEST_TIMEOUT_MS = 8000; + +/** Le registre auquel s'adresse le Docker Hub quand aucun hôte n'est indiqué. */ +const DOCKER_HUB = "registry-1.docker.io"; + +export interface PublishedImage { + /** SHA du commit ayant produit l'image, tel que gravé par la publication. */ + revision: string; + /** Nom de version lisible (« main-34 »), quand l'image en porte un. */ + version: string | null; + /** Date de construction déclarée par l'image. */ + createdAt: string | null; + reference: string; +} + +export type RegistryCheck = + | { ok: true; image: PublishedImage } + | { ok: false; error: string }; + +/** Erreur portant le code renvoyé par le registre, pour pouvoir l'expliquer. */ +class RegistryError extends Error { + constructor( + message: string, + readonly status?: number, + ) { + super(message); + this.name = "RegistryError"; + } +} + +interface ImageReference { + registry: string; + repository: string; + tag: string; +} + +/** + * Découpe « ghcr.io/flocom/apel-manager:latest ». + * + * Un premier segment n'est un hôte que s'il contient un point, deux-points, ou + * vaut « localhost » : sans cette règle, « flocom/apel-manager » verrait + * « flocom » pris pour un registre. C'est la convention de Docker. + */ +export function parseImageReference(reference: string): ImageReference | null { + const brut = reference.trim(); + if (!brut || brut.includes("@")) return null; + + const segments = brut.split("/"); + const premier = segments[0]; + const aUnHote = + segments.length > 1 && + (premier.includes(".") || premier.includes(":") || premier === "localhost"); + + const registry = aUnHote ? premier : DOCKER_HUB; + let chemin = aUnHote ? segments.slice(1).join("/") : brut; + // Le Docker Hub range les images sans espace de noms sous « library ». + if (!aUnHote && !chemin.includes("/")) chemin = `library/${chemin}`; + + const separateur = chemin.lastIndexOf(":"); + const tag = separateur === -1 ? "latest" : chemin.slice(separateur + 1); + const repository = separateur === -1 ? chemin : chemin.slice(0, separateur); + + if (!repository || !tag) return null; + return { registry, repository, tag }; +} + +/** Analyse l'en-tête `WWW-Authenticate` d'un registre v2. */ +function defiAuthentification(header: string | null) { + if (!header || !/^bearer/i.test(header)) return null; + const champs = Object.fromEntries( + [...header.matchAll(/(\w+)="([^"]*)"/g)].map((m) => [m[1], m[2]]), + ); + return champs.realm ? champs : null; +} + +export class RegistryClient { + private token: string | null = null; + + constructor(private readonly image: ImageReference) {} + + private get base() { + return `https://${this.image.registry}/v2/${this.image.repository}`; + } + + /** + * Requête authentifiée si nécessaire. Le jeton n'est demandé qu'après un + * premier refus, ce qui laisse fonctionner les registres qui n'en réclament + * pas, et il n'est demandé qu'une fois par vérification. + */ + private async get(url: string, accept?: string): Promise { + const envoyer = () => { + const headers: Record = { + "User-Agent": "apel-manager-update-check", + }; + if (accept) headers.Accept = accept; + if (this.token) headers.Authorization = `Bearer ${this.token}`; + return fetch(url, { + headers, + cache: "no-store", + signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS), + }); + }; + + const premiere = await envoyer(); + if (premiere.status !== 401) return premiere; + + const defi = defiAuthentification(premiere.headers.get("www-authenticate")); + if (!defi) return premiere; + + const demande = new URL(defi.realm); + if (defi.service) demande.searchParams.set("service", defi.service); + demande.searchParams.set( + "scope", + defi.scope ?? `repository:${this.image.repository}:pull`, + ); + + const reponse = await fetch(demande, { + headers: { Accept: "application/json" }, + cache: "no-store", + signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS), + }); + if (!reponse.ok) return premiere; + + const charge = (await reponse.json()) as { + token?: string; + access_token?: string; + }; + this.token = charge.token ?? charge.access_token ?? null; + if (!this.token) return premiere; + + return envoyer(); + } + + /** + * Résout le manifeste d'une plateforme concrète. Une image multi-architecture + * publie un index dont les entrées d'attestation annoncent une plateforme + * « unknown » : les retenir mènerait à un blob qui n'est pas une + * configuration d'image. + */ + private async manifestePlateforme(corps: { + manifests?: { + digest: string; + platform?: { architecture?: string; os?: string }; + }[]; + config?: { digest: string }; + }) { + if (corps.config) return corps; + const entrees = (corps.manifests ?? []).filter( + (m) => + m.platform?.architecture && + m.platform.architecture !== "unknown" && + m.platform.os !== "unknown", + ); + if (entrees.length === 0) return null; + const choisi = + entrees.find( + (m) => + m.platform?.os === "linux" && m.platform?.architecture === "amd64", + ) ?? entrees[0]; + + const reponse = await this.get( + `${this.base}/manifests/${choisi.digest}`, + MANIFEST_TYPES, + ); + if (!reponse.ok) return null; + return (await reponse.json()) as { config?: { digest: string } }; + } + + async lireImagePubliee(): Promise { + const reponse = await this.get( + `${this.base}/manifests/${this.image.tag}`, + MANIFEST_TYPES, + ); + if (!reponse.ok) { + throw new RegistryError("manifeste refusé", reponse.status); + } + + const manifeste = await this.manifestePlateforme(await reponse.json()); + if (!manifeste?.config) return null; + + // Le blob de configuration part vers un stockage signé : `fetch` suit la + // redirection et retire l'en-tête d'autorisation, ce qui est exactement ce + // qu'attend l'URL signée. + const config = await this.get(`${this.base}/blobs/${manifeste.config.digest}`); + if (!config.ok) { + throw new RegistryError("configuration refusée", config.status); + } + + const corps = (await config.json()) as { + config?: { Labels?: Record; Env?: string[] }; + created?: string; + }; + const labels = corps.config?.Labels ?? {}; + const env = Object.fromEntries( + (corps.config?.Env ?? []) + .filter((entree) => entree.startsWith("APP_")) + .map((entree) => { + const coupe = entree.indexOf("="); + return [entree.slice(0, coupe), entree.slice(coupe + 1)]; + }), + ); + + const revision = + labels["org.opencontainers.image.revision"]?.trim() || + env.APP_REVISION?.trim() || + ""; + if (!revision) return null; + + return { + revision, + version: + env.APP_VERSION?.trim() || + labels["org.opencontainers.image.version"]?.trim() || + null, + createdAt: + env.APP_BUILD_TIME?.trim() || + labels["org.opencontainers.image.created"]?.trim() || + corps.created || + null, + reference: `${this.image.registry}/${this.image.repository}:${this.image.tag}`, + }; + } +} + +/** + * Révision de l'image publiée, ou l'explication de l'échec. Ne lève jamais : + * l'écran des mises à jour doit rester lisible quand le registre ne répond pas. + */ +export async function checkPublishedImage( + reference: string, +): Promise { + const image = parseImageReference(reference); + if (!image) { + return { + ok: false, + error: `Référence d'image illisible : « ${reference} ».`, + }; + } + + try { + const publiee = await new RegistryClient(image).lireImagePubliee(); + if (!publiee) { + return { + ok: false, + error: + "L'image publiée ne porte pas de révision : impossible de la comparer à la version installée.", + }; + } + return { ok: true, image: publiee }; + } catch (error) { + if (error instanceof Error && error.name === "TimeoutError") { + return { ok: false, error: "Le registre n'a pas répondu à temps." }; + } + // Un registre qui répond 404 ou 401 n'est pas injoignable : il est joint, + // et il refuse. Les confondre enverrait chercher une panne de réseau là où + // c'est le nom de l'image qui est faux. + if (error instanceof RegistryError && error.status) { + const cible = `${image.registry}/${image.repository}:${image.tag}`; + if (error.status === 404) { + return { + ok: false, + error: `Aucune image « ${cible} » dans le registre. Vérifiez le nom et l'étiquette dans APEL_IMAGE.`, + }; + } + if (error.status === 401 || error.status === 403) { + return { + ok: false, + error: `Le registre refuse l'accès à « ${cible} ». Une image privée ne peut pas être consultée sans identifiants ; une image publique répond ainsi lorsqu'elle n'existe pas.`, + }; + } + return { + ok: false, + error: `Le registre a répondu ${error.status} pour « ${cible} ».`, + }; + } + return { + ok: false, + error: + error instanceof Error + ? `Registre injoignable (${error.message}).` + : "Registre injoignable.", + }; + } +} diff --git a/src/lib/services/updates.ts b/src/lib/services/updates.ts index 5a192d8..02b9a19 100644 --- a/src/lib/services/updates.ts +++ b/src/lib/services/updates.ts @@ -1,7 +1,7 @@ import "server-only"; import { HttpError } from "@/lib/auth/guards"; -import { formatTimeOfDay } from "@/lib/dates"; +import { checkPublishedImage } from "@/lib/services/registry"; import { getRuntimeVersion, shortRevision } from "@/lib/version"; /** @@ -10,18 +10,42 @@ import { getRuntimeVersion, shortRevision } from "@/lib/version"; * `scheduler` dès qu'une nouvelle version est disponible. Les migrations sont * ensuite appliquées par l'entrypoint au démarrage. * - * Ce service ne sert donc qu'à *rendre visible* l'état : version en cours, - * dernière version publiée en amont, et cadence de la surveillance. + * Ce service rend cet état visible — et il le mesure là où il se décide : dans + * le registre. C'est l'image publiée que l'`updater` installe, pas le dernier + * commit du dépôt. Les deux diffèrent pendant toute la construction, et pour + * toujours si elle échoue. + * + * Le dépôt Git reste consulté, mais seulement pour distinguer « à jour » de + * « une version est fusionnée, son image n'est pas encore publiée ». Cette + * consultation est facultative : son échec n'empêche jamais de connaître l'état + * réel ni de déclencher une mise à jour. */ const REPOSITORY = process.env.UPDATE_REPOSITORY?.trim() || "flocom/APEL-manager"; const CHANNEL = process.env.UPDATE_CHANNEL?.trim() || "main"; const CHECK_ENABLED = process.env.UPDATE_CHECK_ENABLED?.trim() !== "false"; -const CACHE_TTL_MS = 30 * 60 * 1000; +/** Image réellement déployée, celle que l'`updater` surveille. */ +const IMAGE = + process.env.UPDATE_IMAGE?.trim() || + process.env.APEL_IMAGE?.trim() || + "ghcr.io/flocom/apel-manager:latest"; +const CACHE_TTL_MS = 10 * 60 * 1000; const REQUEST_TIMEOUT_MS = 5000; +/** Au-delà, la consultation du dépôt est abandonnée : elle n'est qu'un appoint. */ +const HEAD_TTL_MS = 10 * 60 * 1000; +/** + * Passé ce délai sans une seule lecture réussie du registre, la dernière + * réponse connue cesse de valoir état. Garder le cache indéfiniment évite un + * « État inconnu » sur un délai dépassé de cinq secondes, mais afficherait un + * « À jour » vieux de trois semaines avec le même aplomb qu'un « À jour » de + * l'instant. + */ +const STALE_MAX_MS = 24 * 60 * 60 * 1000; /** Une recréation de conteneur dépasse largement le délai d'une vérification. */ const TRIGGER_TIMEOUT_MS = 20_000; +/** Sonde de présence de l'`updater` : il répond sur son réseau, ou pas. */ +const PROBE_TIMEOUT_MS = 2500; /** Cadence de surveillance du conteneur `updater`, en secondes. */ function pollIntervalSeconds() { @@ -65,11 +89,15 @@ export type UpdateState = | "unknown" | "disabled"; +/** Ce que l'application sait de l'`updater`, par observation et non par déduction. */ +export type UpdaterReachability = "reachable" | "unreachable" | "not-configured"; + export interface UpdateStatus { current: ReturnType; latest: { revision: string; shortRevision: string; + version: string | null; committedAt: string | null; url: string; } | null; @@ -79,9 +107,27 @@ export interface UpdateStatus { pollIntervalSeconds: number; /** Vrai quand l'`updater` accepte un déclenchement immédiat. */ canTriggerNow: boolean; + /** Résultat de la sonde : l'`updater` a-t-il répondu ? */ + reachability: UpdaterReachability; }; + /** + * Version fusionnée dont l'image n'est pas encore publiée. Renseignée + * seulement quand le dépôt a pu être consulté et qu'il devance le registre. + */ + pending: { + shortRevision: string; + committedAt: string | null; + url: string; + } | null; + /** + * Vrai quand l'état repose sur une réponse antérieure, le registre n'ayant + * pas répondu cette fois. Un « À jour » calculé sur une lecture d'il y a + * trois semaines n'a pas la même valeur qu'un « À jour » de l'instant. + */ + stale: boolean; repository: string; channel: string; + image: string; checkedAt: string | null; error: string | null; } @@ -98,9 +144,15 @@ interface CachedCheck extends CheckResult { fetchedAt: number; /** Dernière réponse exploitable : c'est elle que l'écran doit dater. */ succeededAt: number | null; + /** Dernier commit connu de la branche, pour situer une image en retard. */ + head: { revision: string; committedAt: string | null; url: string } | null; + /** Dernière tentative de lecture du dépôt, réussie ou non. */ + headFetchedAt: number; } let cache: CachedCheck | null = null; +/** Évite d'empiler les consultations du dépôt lancées en arrière-plan. */ +let headEnCours = false; /** * L'API publique de GitHub tolère 60 requêtes par heure et par adresse IP sans @@ -108,26 +160,27 @@ let cache: CachedCheck | null = null; * Une fois épuisé, elle répond 403 ou 429 en annonçant l'heure de remise à * zéro : la retenir évite d'insister pour rien. */ -function rateLimitError(response: Response): CheckResult | null { +function rateLimitRetryAfter(response: Response): number | null { if (response.status !== 403 && response.status !== 429) return null; if (response.headers.get("x-ratelimit-remaining") !== "0") return null; - const reset = Number(response.headers.get("x-ratelimit-reset")) * 1000; - const known = Number.isFinite(reset) && reset > Date.now(); - return { - latest: null, - error: known - ? `Quota de l'API GitHub épuisé pour cette adresse IP (60 requêtes par heure sans authentification). Prochaine vérification possible à ${formatTimeOfDay(new Date(reset))}.` - : "Quota de l'API GitHub épuisé pour cette adresse IP (60 requêtes par heure sans authentification).", - retryAfter: known ? reset : Date.now() + 15 * 60 * 1000, - }; + return Number.isFinite(reset) && reset > Date.now() + ? reset + : Date.now() + 15 * 60 * 1000; } -async function fetchLatestCommit(): Promise { +/** + * Dernier commit de la branche suivie. Consultation d'appoint : elle ne sert + * qu'à dire qu'une version est fusionnée sans être encore publiée, et son + * échec ne remonte jamais comme une erreur de l'écran. + */ +async function fetchHeadCommit(): Promise<{ + head: CachedCheck["head"]; + retryAfter: number | null; +}> { const url = `https://api.github.com/repos/${REPOSITORY}/commits/${encodeURIComponent( CHANNEL, )}`; - try { const response = await fetch(url, { headers: { @@ -138,113 +191,198 @@ async function fetchLatestCommit(): Promise { cache: "no-store", }); - const limited = rateLimitError(response); - if (limited) return limited; - - if (!response.ok) { - return { - latest: null, - error: `GitHub a répondu ${response.status}.`, - retryAfter: null, - }; - } + const retryAfter = rateLimitRetryAfter(response); + if (retryAfter) return { head: null, retryAfter }; + if (!response.ok) return { head: null, retryAfter: null }; const payload = (await response.json()) as { sha?: string; html_url?: string; commit?: { committer?: { date?: string } }; }; - - if (!payload.sha) { - return { - latest: null, - error: "Réponse GitHub inattendue.", - retryAfter: null, - }; - } + if (!payload.sha) return { head: null, retryAfter: null }; return { - latest: { + head: { revision: payload.sha, - shortRevision: shortRevision(payload.sha), committedAt: payload.commit?.committer?.date ?? null, url: payload.html_url ?? `https://github.com/${REPOSITORY}/commit/${payload.sha}`, }, - error: null, - retryAfter: null, - }; - } catch (error) { - return { - latest: null, - error: - error instanceof Error && error.name === "TimeoutError" - ? "GitHub n'a pas répondu à temps." - : "Vérification impossible (réseau indisponible ?).", retryAfter: null, }; + } catch { + return { head: null, retryAfter: null }; + } +} + +/** + * Consultation du dépôt, lancée sans être attendue. Elle n'alimente qu'un + * encart d'appoint : la faire attendre par le rendu ferait dépendre l'écran + * Configuration tout entier de la disponibilité de GitHub, et d'un quota de + * soixante requêtes par heure partagé avec toute la machine. + */ +function rafraichirHeadEnArrierePlan() { + if (headEnCours) return; + const maintenant = Date.now(); + if (cache && maintenant - cache.headFetchedAt < HEAD_TTL_MS) return; + if (cache?.retryAfter != null && maintenant < cache.retryAfter) return; + + headEnCours = true; + void fetchHeadCommit() + .then(({ head, retryAfter }) => { + if (!cache) return; + cache.headFetchedAt = Date.now(); + cache.retryAfter = retryAfter; + if (head) cache.head = head; + }) + .catch(() => { + if (cache) cache.headFetchedAt = Date.now(); + }) + .finally(() => { + headEnCours = false; + }); +} + +/** Interroge le registre. Lui seul décide de l'état, lui seul est attendu. */ +async function runCheck(precedent: CachedCheck | null): Promise { + const registre = await checkPublishedImage(IMAGE); + + const latest: UpdateStatus["latest"] = registre.ok + ? { + revision: registre.image.revision, + shortRevision: shortRevision(registre.image.revision), + version: registre.image.version, + committedAt: registre.image.createdAt, + url: `https://github.com/${REPOSITORY}/commit/${registre.image.revision}`, + } + : null; + + return { + // Un échec ne doit pas effacer la dernière réponse connue : sans elle + // l'écran retomberait sur « État inconnu » alors qu'il sait encore quelle + // version est publiée. L'erreur est affichée à côté, pas à la place — et + // `stale` dit que ce qu'on lit n'est plus de première main. + latest: latest ?? precedent?.latest ?? null, + error: registre.ok ? null : registre.error, + retryAfter: precedent?.retryAfter ?? null, + head: precedent?.head ?? null, + headFetchedAt: precedent?.headFetchedAt ?? 0, + fetchedAt: Date.now(), + succeededAt: latest ? Date.now() : precedent?.succeededAt ?? null, + }; +} + +/** + * Vérifie que l'`updater` est là. « Activée » sans cette sonde n'était qu'une + * relecture de la configuration : un `updater` arrêté laissait l'écran + * promettre une mise à jour automatique qui n'arrivait jamais. + * + * La sonde interroge la racine, que l'API de Watchtower n'expose pas : une + * réponse HTTP — fût-elle 404 — prouve que le service écoute, sans risquer de + * déclencher quoi que ce soit. + */ +async function probeUpdater(): Promise { + try { + await fetch(`${watchtowerUrl()}/`, { + cache: "no-store", + signal: AbortSignal.timeout(PROBE_TIMEOUT_MS), + }); + return "reachable"; + } catch { + // La sonde tourne même quand le profil n'est pas déclaré : `docker compose + // --profile autoupdate up` active le service en ligne de commande sans que + // COMPOSE_PROFILES n'en garde trace, et l'écran annonçait alors + // « Désactivée » pendant que l'updater faisait son travail. + return autoUpdateEnabled() ? "unreachable" : "not-configured"; } } /** - * Compare la révision embarquée à la dernière révision publiée. Le résultat est - * mis en cache une demi-heure pour ne pas épuiser le quota anonyme de l'API - * GitHub, `force` permet une vérification immédiate depuis l'interface. + * Compare la révision embarquée à celle de l'image publiée. Le résultat est + * mis en cache dix minutes, `force` permet une vérification immédiate depuis + * l'interface. */ export async function getUpdateStatus( { force = false }: { force?: boolean } = {}, ): Promise { const current = getRuntimeVersion(); const enabled = autoUpdateEnabled(); - const autoUpdate = { - enabled, - pollIntervalSeconds: pollIntervalSeconds(), - canTriggerNow: enabled && watchtowerToken().length > 0, - }; if (!CHECK_ENABLED) { + const reachability = await probeUpdater(); + const actif = enabled || reachability === "reachable"; return { current, latest: null, state: "disabled", - autoUpdate, + autoUpdate: { + enabled: actif, + pollIntervalSeconds: pollIntervalSeconds(), + canTriggerNow: actif && watchtowerToken().length > 0, + reachability, + }, + pending: null, + stale: false, repository: REPOSITORY, channel: CHANNEL, + image: IMAGE, checkedAt: null, error: null, }; } const fresh = cache && Date.now() - cache.fetchedAt < CACHE_TTL_MS; - const blocked = cache?.retryAfter != null && Date.now() < cache.retryAfter; - if ((force || !fresh) && !blocked) { - const result = await fetchLatestCommit(); - // Un échec ne doit pas effacer la dernière réponse connue : sans elle - // l'écran retomberait sur « État inconnu » alors qu'il sait encore quelle - // version est publiée. L'erreur est affichée à côté, pas à la place. - cache = { - ...result, - latest: result.latest ?? cache?.latest ?? null, - fetchedAt: Date.now(), - succeededAt: result.latest ? Date.now() : cache?.succeededAt ?? null, - }; - } + const [checked, reachability] = await Promise.all([ + force || !fresh ? runCheck(cache) : Promise.resolve(cache!), + probeUpdater(), + ]); + cache = checked; + // Lancée seulement maintenant : elle écrit dans le cache déjà en place. + rafraichirHeadEnArrierePlan(); + + const perime = + checked.succeededAt === null || + Date.now() - checked.succeededAt > STALE_MAX_MS; - const checked = cache!; let state: UpdateState = "unknown"; - if (checked.latest && current.revision) { + if (checked.latest && current.revision && !perime) { state = checked.latest.revision === current.revision ? "up-to-date" : "outdated"; } + // Une version fusionnée dont l'image n'est pas encore publiée : ni « à jour » + // ni installable. Le dire évite qu'on attende une mise à jour qui n'existe + // pas encore, ou qu'on ignore une publication en échec. + const pending = + checked.head && + checked.latest && + checked.head.revision !== checked.latest.revision && + checked.head.revision !== current.revision + ? { + shortRevision: shortRevision(checked.head.revision), + committedAt: checked.head.committedAt, + url: checked.head.url, + } + : null; + + const actif = enabled || reachability === "reachable"; return { current, latest: checked.latest, state, - autoUpdate, + autoUpdate: { + enabled: actif, + pollIntervalSeconds: pollIntervalSeconds(), + canTriggerNow: actif && watchtowerToken().length > 0, + reachability, + }, + pending, + stale: Boolean(checked.error && checked.latest), repository: REPOSITORY, channel: CHANNEL, + image: IMAGE, checkedAt: checked.succeededAt === null ? null @@ -253,7 +391,7 @@ export async function getUpdateStatus( }; } -export type TriggerOutcome = "started" | "restarting"; +export type TriggerOutcome = "no-update" | "restarting"; /** * `fetch` masque la panne réelle derrière « fetch failed » et range l'erreur @@ -268,6 +406,30 @@ function networkCause(error: unknown): string { return error instanceof Error ? error.message : "cause inconnue"; } +/** + * Une coupure en plein vol est le signe attendu que l'`updater` remplace le + * conteneur qui l'interroge : la requête meurt avec lui. Le délai dépassé n'est + * qu'une des formes que prend cette coupure — la connexion peut aussi être + * réinitialisée ou fermée net, selon le moment où le processus reçoit son + * signal d'arrêt. Ne reconnaître que le délai dépassé faisait passer une mise à + * jour en cours pour un service injoignable. + */ +function estCoupureEnVol(error: unknown): boolean { + if (!(error instanceof Error)) return false; + if (error.name === "TimeoutError" || error.name === "AbortError") return true; + const cause = error.cause; + const code = + cause instanceof Error ? (cause as NodeJS.ErrnoException).code : undefined; + return ( + code === "ECONNRESET" || + code === "UND_ERR_SOCKET" || + code === "EPIPE" || + /socket hang up|other side closed|terminated/i.test( + cause instanceof Error ? cause.message : "", + ) + ); +} + /** * Demande à l'`updater` de contrôler l'image immédiatement au lieu d'attendre * son prochain passage. @@ -296,10 +458,7 @@ export async function triggerUpdateNow(): Promise { cache: "no-store", }); } catch (error) { - if (error instanceof Error && error.name === "TimeoutError") { - // La coupure attendue quand le conteneur est en train d'être remplacé. - return "restarting"; - } + if (estCoupureEnVol(error)) return "restarting"; // Toute autre panne réseau est un vrai défaut de configuration : la dire // plutôt que de laisser remonter « une erreur serveur est survenue ». La // cause système distingue le nom introuvable (conteneur absent ou sur un @@ -322,6 +481,8 @@ export async function triggerUpdateNow(): Promise { `Le service de mise à jour a répondu ${response.status}.`, ); } - // L'updater a répondu : aucune image plus récente à installer. - return "started"; + // L'updater a rendu la main sans que le conteneur soit remplacé : rien n'a + // été installé ici. Ce qu'il a fait d'autre — mettre à jour le planificateur, + // par exemple — n'est pas dans sa réponse, qui n'a pas de corps exploitable. + return "no-update"; } diff --git a/src/lib/validation.ts b/src/lib/validation.ts index 803ecea..ba4e525 100644 --- a/src/lib/validation.ts +++ b/src/lib/validation.ts @@ -454,6 +454,13 @@ export const associationSettingsSchema = z.object({ .trim() .toUpperCase() .regex(/^W\d{9}$/, "Numéro RNA invalide (format attendu : W123456789)"), + /** + * Siège social déclaré en préfecture, repris tel quel sur les documents + * officiels. Facultatif ici, signalé là où il manque : bloquer l'écran de + * configuration sur une adresse que l'administrateur n'a pas sous la main + * l'empêcherait d'enregistrer le reste. + */ + headquarters: z.string().trim().max(300).default(""), taskReminderWindowDays: z.coerce.number().int().min(0).max(30), volunteerReminderWindowDays: z.coerce.number().int().min(0).max(30), telegramEnabled: z.boolean().default(false),