Files
sub2api/backend/migrations
shaw bc3acd6e28 fix(auth): 收紧注册别名查重(根点绕过 / 误拒 / 无界扫描 / 并发竞态)
对 #4814 的审计跟进修复:

- 域名尾随点绕过:user@gmail.com. 的域名不在 gmail 家族名单内,点号折叠与
  googlemail 归一被整体跳过,别名刷号原样可复现。归一化入口统一去掉 FQDN 根点。
- 误拒合法用户:剥 "+后缀" 缺空串守卫,+alice@ 与 +bob@ 都折叠成 @domain,
  该域后续 "+x@" 注册会永久 EMAIL_EXISTS 且无自助恢复。改为仅当 "+" 不在首位时剥离。
- 无界不可索引全表扫描:原实现按 LOWER(email) LIKE '%@domain' 把整域邮箱读进内存,
  且挂在公开未鉴权的 send-verify-code 上。改为按去点邮箱
  REPLACE(LOWER(TRIM(email)), '.', '') 做等值 + "local+%@domain" 前缀探针并带 LIMIT,
  新增同表达式的部分索引(migrations/190)。TRIM 口径与既有精确匹配一致,
  历史带首尾空白的行同样命中;LIKE 元字符转义,% 与 _ 不会扩大匹配面。
- 并发竞态:注册改走 CreateWithEmailAliasGuard,在邮箱唯一性锁上追加收件箱身份锁并在
  锁内复查,避免同一收件箱的多个别名变体同时通过服务层前置查重。管理员建号仍走
  Create,不受别名限制。
- 能力断言静默 fail-open:别名查重方法上提到 UserRepository 端口(编译期强制),
  移除可选接口类型断言与静默降级分支。
- OAuth 邮箱注册的两条建号路径(同样发放注册赠额)纳入同一查重口径;邮箱换绑/绑定
  不纳入,否则用户把邮箱改成自己收件箱的别名会被误拒。
2026-07-25 19:40:53 +08:00
..
2025-12-18 13:50:39 +08:00
2025-12-18 13:50:39 +08:00
2026-02-02 22:13:50 +08:00
2026-02-02 22:13:50 +08:00

Database Migrations

Overview

This directory contains SQL migration files for database schema changes. The migration system uses SHA256 checksums to ensure migration immutability and consistency across environments.

Migration File Naming

Format: NNN_description.sql

  • NNN: Sequential number (e.g., 001, 002, 003)
  • description: Brief description in snake_case

Example: 017_add_gemini_tier_id.sql

_notx.sql 命名与执行语义(并发索引专用)

当迁移包含 CREATE INDEX CONCURRENTLY 或 DROP INDEX CONCURRENTLY 时,必须使用 _notx.sql 后缀,例如:

  • 062_add_accounts_priority_indexes_notx.sql
  • 063_drop_legacy_indexes_notx.sql

运行规则:

  1. *.sql(不带 _notx)按事务执行。
  2. *_notx.sql 按非事务执行,不会包裹在 BEGIN/COMMIT 中。
  3. *_notx.sql 仅允许并发索引语句,不允许混入事务控制语句或其他 DDL/DML。

幂等要求(必须):

  • 创建索引:CREATE INDEX CONCURRENTLY IF NOT EXISTS ...
  • 删除索引:DROP INDEX CONCURRENTLY IF EXISTS ...

这样可以保证灾备重放、重复执行时不会因对象已存在/不存在而失败。

Migration File Structure

This project uses a custom migration runner (internal/repository/migrations_runner.go) that executes the full SQL file content as-is.

  • Regular migrations (*.sql): executed in a transaction.
  • Non-transactional migrations (*_notx.sql): split by statement and executed without transaction (for CONCURRENTLY).
-- Forward-only migration (recommended)
ALTER TABLE usage_logs ADD COLUMN IF NOT EXISTS example_column VARCHAR(100);

⚠️ Do not place executable "Down" SQL in the same file. The runner does not parse goose Up/Down sections and will execute all SQL statements in the file.

Important Rules

⚠️ Immutability Principle

Once a migration is applied to ANY environment (dev, staging, production), it MUST NOT be modified.

Why?

  • Each migration has a SHA256 checksum stored in the schema_migrations table
  • Modifying an applied migration causes checksum mismatch errors
  • Different environments would have inconsistent database states
  • Breaks audit trail and reproducibility

✅ Correct Workflow

  1. Create new migration

    # Create new file with next sequential number
    touch migrations/018_your_change.sql
    
  2. Write forward-only migration SQL

    • Put only the intended schema change in the file
    • If rollback is needed, create a new migration file to revert
  3. Test locally

    # Apply migration
    make migrate-up
    
    # Test rollback
    make migrate-down
    
  4. Commit and deploy

    git add migrations/018_your_change.sql
    git commit -m "feat(db): add your change"
    

❌ What NOT to Do

  • ❌ Modify an already-applied migration file
  • ❌ Delete migration files
  • ❌ Change migration file names
  • ❌ Reorder migration numbers

🔧 If You Accidentally Modified an Applied Migration

Error message:

migration 017_add_gemini_tier_id.sql checksum mismatch (db=abc123... file=def456...)

Solution:

# 1. Find the original version
git log --oneline -- migrations/017_add_gemini_tier_id.sql

# 2. Revert to the commit when it was first applied
git checkout <commit-hash> -- migrations/017_add_gemini_tier_id.sql

# 3. Create a NEW migration for your changes
touch migrations/018_your_new_change.sql

Migration System Details

  • Checksum Algorithm: SHA256 of trimmed file content
  • Tracking Table: schema_migrations (filename, checksum, applied_at)
  • Runner: internal/repository/migrations_runner.go
  • Auto-run: Migrations run automatically on service startup

Best Practices

  1. Keep migrations small and focused

    • One logical change per migration
    • Easier to review and rollback
  2. Write reversible migrations

    • Always provide a working Down migration
    • Test rollback before committing
  3. Use transactions

    • Wrap DDL statements in transactions when possible
    • Ensures atomicity
  4. Add comments

    • Explain WHY the change is needed
    • Document any special considerations
  5. Test in development first

    • Apply migration locally
    • Verify data integrity
    • Test rollback

Example Migration

-- Add tier_id field to Gemini OAuth accounts for quota tracking
UPDATE accounts
SET credentials = jsonb_set(
    credentials,
    '{tier_id}',
    '"LEGACY"',
    true
)
WHERE platform = 'gemini'
  AND type = 'oauth'
  AND credentials->>'tier_id' IS NULL;

Troubleshooting

Checksum Mismatch

See "If You Accidentally Modified an Applied Migration" above.

Migration Failed

# Check migration status
psql -d sub2api -c "SELECT * FROM schema_migrations ORDER BY applied_at DESC;"

# Manually rollback if needed (use with caution)
# Better to fix the migration and create a new one

Need to Skip a Migration (Emergency Only)

-- DANGEROUS: Only use in development or with extreme caution
INSERT INTO schema_migrations (filename, checksum, applied_at)
VALUES ('NNN_migration.sql', 'calculated_checksum', NOW());

References