Skip to content

fix(credential) fix credential migration #3896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheodoreSpeaks merged 2 commits into from
Apr 2, 2026
+4 −13
Merged

fix(credential) fix credential migration #3896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b8f3498
fix(credential) fix credential migration
Apr 2, 2026
c8bc11d
Fix lint
Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions packages/db/migrations/0184_fast_photon.sql → .../migrations/0184_stiff_captain_marvel.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
ALTER TYPE "public"."credential_type" ADD VALUE 'service_account';--> statement-breakpoint
ALTER TABLE "credential" ADD COLUMN "encrypted_service_account_key" text;--> statement-breakpoint
CREATE UNIQUE INDEX "credential_workspace_service_account_unique" ON "credential" USING btree ("workspace_id","type","provider_id","display_name") WHERE type = 'service_account';--> statement-breakpoint
ALTER TABLE "credential" ADD CONSTRAINT "credential_service_account_source_check" CHECK ((type <> 'service_account') OR (encrypted_service_account_key IS NOT NULL AND provider_id IS NOT NULL));
CREATE UNIQUE INDEX "credential_workspace_service_account_unique" ON "credential" USING btree ("workspace_id","type","provider_id","display_name") WHERE type = 'service_account';
Comment on lines 1 to +3
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps bot Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Missing DB-level data integrity for service_account credentials

The removed credential_service_account_source_check constraint enforced that any row with type = 'service_account' must have both encrypted_service_account_key IS NOT NULL and provider_id IS NOT NULL. This is consistent with how the other three credential types are guarded:

  • credential_oauth_source_check → enforces account_id and provider_id for oauth
  • credential_workspace_env_source_check → enforces env_key for env_workspace
  • credential_personal_env_source_check → enforces env_key and env_owner_user_id for env_personal

service_account is the only type that has no equivalent constraint in schema.ts (confirmed: lines 2356-2367 of schema.ts define the three constraints above but omit one for service_account). Removing the constraint from the migration brings it in sync with the schema — but it means the database will now permit service_account rows where encrypted_service_account_key or provider_id is NULL.

If dropping this constraint is intentional (e.g., application-layer validation is the sole enforcement path), this is fine. Worth confirming that the application code validates these fields before inserting a service_account credential so there's no silent path to an unencrypted/invalid row.

6 changes: 1 addition & 5 deletions packages/db/migrations/meta/0184_snapshot.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"id": "1c75b73c-f8d0-4b69-b42a-995991f56e35",
"id": "7f097b1f-1207-472e-b1bc-e237bab9528c",
"prevId": "1114a957-9e5b-49fe-b82d-ef3612189345",
"version": "7",
"dialect": "postgresql",
Expand Down Expand Up @@ -3019,10 +3019,6 @@
"credential_personal_env_source_check": {
"name": "credential_personal_env_source_check",
"value": "(type <> 'env_personal') OR (env_key IS NOT NULL AND env_owner_user_id IS NOT NULL)"
},
"credential_service_account_source_check": {
"name": "credential_service_account_source_check",
"value": "(type <> 'service_account') OR (encrypted_service_account_key IS NOT NULL AND provider_id IS NOT NULL)"
}
},
"isRLSEnabled": false
Expand Down
4 changes: 2 additions & 2 deletions packages/db/migrations/meta/_journal.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1286,8 +1286,8 @@
{
"idx": 184,
"version": "7",
"when": 1774986262590,
"tag": "0184_fast_photon",
"when": 1775118314401,
"tag": "0184_stiff_captain_marvel",
"breakpoints": true
}
]
Expand Down
4 changes: 0 additions & 4 deletions packages/db/schema.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2365,10 +2365,6 @@ export const credential = pgTable(
'credential_personal_env_source_check',
sql`(type <> 'env_personal') OR (env_key IS NOT NULL AND env_owner_user_id IS NOT NULL)`
),
serviceAccountSourceConstraint: check(
'credential_service_account_source_check',
sql`(type <> 'service_account') OR (encrypted_service_account_key IS NOT NULL AND provider_id IS NOT NULL)`
),
})
)

Expand Down
Loading