Closes the pick-a-name convoy. Applies D1-D5 + Risk 4 PRESERVE per
operator gate-1 ratification.
Infrastructure renames:
- lib/rate-limit.js: 5 Redis key prefixes tcgvault:* → deckhearth:* (D5).
One-time per-15-min / per-1-hour counter reset accepted; no user impact
because counter windows are short anyway. Existing rate-limit state in
Upstash will accumulate at the new prefix on first request.
- package.json: name field tcg-vault → deck-hearth (D2)
- package-lock.json: regenerated for the name change; STOP-on-churn
protocol confirmed only the two name lines changed (no dep churn)
- All three test users (admin/alice/bob) renamed to @deckhearth.com (D4)
- One-off migration script scripts/migrations/2026-05-24-rename-admin-
email.js (NEW): ESM, idempotent, UNIQUE-collision-safe. Per the
no-go-zones rule for new migrations. Operator MUST run post-deploy.
- README.md + TESTING_GUIDE.md operator-caveat blockquotes flagged
- pages/login.js demo-credential pre-fill updated
PRESERVED per Risk 4:
- test/lib/permission-middleware.test.js literal admin@tcgvault.com
with 7-line architect-authored "why" comment block. This is the
documented pre-fix-auth-bypass bug shape; the regression-lock
literal stays as historical truth.
Verification:
- npm run lint: 128 problems (baseline preserved)
- npm run test:run: 21/21 pass (preserved literal keeps green)
- Grep across full repo: 0 hits for TCG Vault / tcgvault / tcg-vault
except the explicit preserve in the test file + .convoys/ historical
- lib/rate-limit.js: 5 deckhearth: prefixes, 0 tcgvault: prefixes
- node --check on the new migration script: exit 0
- git diff package-lock.json: only the 2 "name": lines changed (no churn)
Operator post-merge action:
- Run `node scripts/migrations/2026-05-24-rename-admin-email.js` against
the production Neon DB. Order matters: migration FIRST, then any
subsequent `npm run setup-db` invocation. Migration script will refuse
to run if collision detected (means setup-db already ran post-rename).
Architect brief: .convoys/pick-a-name/brief-2-infrastructure-and-email-migration.md
Architect commit: 50ce9ab
Operator gate-1: D1-D5 + Risk 4 PRESERVE ratified.
Co-authored-by: Cursor <cursoragent@cursor.com>
85 lines
2.6 KiB
JavaScript
85 lines
2.6 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
/**
|
|
* Migration: 2026-05-24 — Rename @tcgvault.com user emails to @deckhearth.com
|
|
*
|
|
* Part of the `pick-a-name` convoy. Renames every `users.email` row matching
|
|
* `%@tcgvault.com` to the `@deckhearth.com` equivalent (admin + alice + bob,
|
|
* plus any other accidentally-`@tcgvault.com` users if they exist).
|
|
*
|
|
* Idempotent: re-running after the first run prints "Nothing to migrate."
|
|
*
|
|
* Usage:
|
|
* node scripts/migrations/2026-05-24-rename-admin-email.js
|
|
*
|
|
* Required env: POSTGRES_URL (read from .env.local).
|
|
*
|
|
* Safety: the UPDATE uses REPLACE() so emails like `admin@tcgvault.com`
|
|
* become `admin@deckhearth.com`. The `users.email` UNIQUE constraint will
|
|
* fail loudly if a row with the target email already exists — which is the
|
|
* correct behavior (do NOT silently overwrite). If you see the constraint
|
|
* violation, inspect the DB manually before retrying.
|
|
*/
|
|
|
|
import dotenv from 'dotenv';
|
|
dotenv.config({ path: '.env.local' });
|
|
|
|
import { neon } from '@neondatabase/serverless';
|
|
|
|
async function main() {
|
|
if (!process.env.POSTGRES_URL) {
|
|
console.error('❌ POSTGRES_URL is not set. Set it in .env.local before running this migration.');
|
|
process.exit(1);
|
|
}
|
|
|
|
const sql = neon(process.env.POSTGRES_URL);
|
|
|
|
const { rows: before } = await sql`
|
|
SELECT id, email, role
|
|
FROM users
|
|
WHERE email LIKE '%@tcgvault.com'
|
|
ORDER BY id
|
|
`;
|
|
|
|
if (before.length === 0) {
|
|
console.log('✅ Nothing to migrate. No users with @tcgvault.com emails found.');
|
|
return;
|
|
}
|
|
|
|
console.log(`Found ${before.length} user(s) with @tcgvault.com emails:`);
|
|
for (const r of before) {
|
|
console.log(` id=${r.id} role=${r.role} email=${r.email}`);
|
|
}
|
|
|
|
await sql`
|
|
UPDATE users
|
|
SET email = REPLACE(email, '@tcgvault.com', '@deckhearth.com'),
|
|
updated_at = CURRENT_TIMESTAMP
|
|
WHERE email LIKE '%@tcgvault.com'
|
|
`;
|
|
|
|
const { rows: after } = await sql`
|
|
SELECT id, email, role
|
|
FROM users
|
|
WHERE email LIKE '%@deckhearth.com'
|
|
ORDER BY id
|
|
`;
|
|
|
|
console.log(`✅ Migrated ${before.length} user(s). Post-migration @deckhearth.com rows:`);
|
|
for (const r of after) {
|
|
console.log(` id=${r.id} role=${r.role} email=${r.email}`);
|
|
}
|
|
|
|
const { rows: stragglers } = await sql`
|
|
SELECT COUNT(*)::int AS count FROM users WHERE email LIKE '%@tcgvault.com'
|
|
`;
|
|
if (stragglers[0].count !== 0) {
|
|
console.warn(`⚠️ ${stragglers[0].count} @tcgvault.com row(s) still present after migration — investigate.`);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error('❌ Migration failed:', err);
|
|
process.exit(1);
|
|
});
|