mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-19 13:21:46 +00:00
1f5deeba6c
* fix: clean up dangling FK references before deleting a user Resolves FOREIGN KEY constraint failed (500) on DELETE /api/admin/users/:id and DELETE /api/auth/me when the target user had rows in trip_members.invited_by, share_tokens.created_by, budget_items.paid_by_user_id, journeys.user_id, journey_entries.author_id, journey_contributors.user_id, or journey_share_tokens.created_by — none of which had ON DELETE clauses. Introduces deleteUserCompletely() in userCleanupService.ts which wraps all cleanup and the final DELETE FROM users in a single transaction. Both adminService.deleteUser and authService.deleteAccount now call it instead of the bare DELETE. Tests ADMIN-005b and AUTH-040 cover all reference types including notification sender/recipient and notice dismissals. * test: extend FK deletion tests to cover journeys, files, and photos ADMIN-005b and AUTH-040 now also seed and assert: - owned journey with entries (cascade-deleted via journeys.user_id cleanup) - trip_files.uploaded_by (SET NULL — file survives, attribution cleared) - trek_photos.owner_id (SET NULL — photo record survives, owner cleared) - trip_photos.user_id (CASCADE — photo association removed) * test: extend user deletion tests to cover all FK relationships ADMIN-005b and AUTH-040 now seed and assert every user FK relationship: CASCADE (row deleted): trips, trip_members, tags, mcp_tokens, oauth_tokens, oauth_consents, vacay_plans, vacay_plan_members, bucket_list, visited_countries, visited_regions, packing_templates, invite_tokens, collab_notes, settings, password_reset_tokens, notification_channel_preferences SET NULL (row survives, column nulled): categories, todo_items.assigned_user_id, packing_bags, audit_log Caught and fixed: notification_preferences was dropped in migration 72; correct table is notification_channel_preferences. * fix: preserve URL hash and OIDC redirect target through login flow - Include location.hash in redirect param at all three producer sites (ProtectedRoute, axios 401 interceptor, OAuthAuthorizePage) so hash fragments survive the login bounce - Stash redirectTarget in sessionStorage before any OIDC provider redirect and restore it after the code exchange, since the IdP strips the original ?redirect= param during the roundtrip - Clear sessionStorage on OIDC error to avoid stale state - Add tests covering sessionStorage stash on mount, navigate to saved redirect after OIDC exchange, fallback to /dashboard, and cleanup on error * fix: use day position instead of ID for accommodation date range clamping Math.min/Math.max over raw day IDs breaks the start/end picker when a trip's day IDs are non-monotonic relative to day_number (normal after repeated generateDays extend/shrink cycles). Replaced with findIndex lookups so clamping is always based on positional order. Closes #889 * fix: normalize env var comparisons to be case-insensitive All NODE_ENV, DEMO_MODE, OIDC_ONLY, FORCE_HTTPS, COOKIE_SECURE, and ALLOW_INTERNAL_NETWORK checks now use .toLowerCase() so values like 'Production' or 'True' behave identically to their lowercase forms. Also adds APP_VERSION to the startup banner. * fix: delete surplus days when shortening a trip When shrinking a trip's date range, surplus days are now deleted along with their assignments, notes, and accommodations (cascade). Places remain in the trip pool; reservations keep their day reference nulled by the existing ON DELETE SET NULL constraint (issue #909). Updates TRIP-SVC-011 to reflect the new behaviour; adds TRIP-SVC-016 as a regression test for the empty-day case. * fix: auto-backup retention deletes itself and manual backups on Docker Two bugs in cleanupOldBackups: 1. Filter was .endsWith('.zip') — swept manual backup-*.zip files too. Now restricted to auto-backup-* prefix. 2. Age was derived from stat.birthtimeMs, which is 0 on overlayfs (Docker default), making every backup appear epoch-old and get deleted immediately. Age is now parsed from the filename timestamp and falls back to mtimeMs (reliable on overlayfs). Also converts inline require('./services/auditLog') calls to a static import throughout scheduler.ts, and adds 8 unit tests covering the fixed retention logic including the overlayfs regression case. * test: update TRIP-024 to match delete behavior on trip shrink * feat: add bypass-branch-check label to skip branch enforcement
139 lines
3.8 KiB
TypeScript
139 lines
3.8 KiB
TypeScript
import Database from 'better-sqlite3';
|
|
import path from 'path';
|
|
import fs from 'fs';
|
|
import { createTables } from './schema';
|
|
import { runMigrations } from './migrations';
|
|
import { runSeeds } from './seeds';
|
|
import { Place, Tag } from '../types';
|
|
|
|
const dataDir = path.join(__dirname, '../../data');
|
|
if (!fs.existsSync(dataDir)) {
|
|
fs.mkdirSync(dataDir, { recursive: true });
|
|
}
|
|
|
|
const dbPath = path.join(dataDir, 'travel.db');
|
|
|
|
let _db: Database.Database | null = null;
|
|
|
|
function initDb(): void {
|
|
if (_db) {
|
|
try { _db.exec('PRAGMA wal_checkpoint(TRUNCATE)'); } catch (e) {}
|
|
try { _db.close(); } catch (e) {}
|
|
_db = null;
|
|
}
|
|
|
|
_db = new Database(dbPath);
|
|
_db.exec('PRAGMA journal_mode = WAL');
|
|
_db.exec('PRAGMA busy_timeout = 5000');
|
|
_db.exec('PRAGMA foreign_keys = ON');
|
|
|
|
createTables(_db);
|
|
runMigrations(_db);
|
|
|
|
runSeeds(_db);
|
|
}
|
|
|
|
initDb();
|
|
|
|
const db = new Proxy({} as Database.Database, {
|
|
get(_, prop: string | symbol) {
|
|
if (!_db) throw new Error('Database connection is not available (restore in progress?)');
|
|
const val = (_db as unknown as Record<string | symbol, unknown>)[prop];
|
|
return typeof val === 'function' ? val.bind(_db) : val;
|
|
},
|
|
set(_, prop: string | symbol, val: unknown) {
|
|
(_db as unknown as Record<string | symbol, unknown>)[prop] = val;
|
|
return true;
|
|
},
|
|
});
|
|
|
|
if (process.env.DEMO_MODE?.toLowerCase() === 'true') {
|
|
try {
|
|
const { seedDemoData } = require('../demo/demo-seed');
|
|
seedDemoData(_db);
|
|
} catch (err: unknown) {
|
|
console.error('[Demo] Seed error:', err instanceof Error ? err.message : err);
|
|
}
|
|
}
|
|
|
|
function closeDb(): void {
|
|
if (_db) {
|
|
try { _db.exec('PRAGMA wal_checkpoint(TRUNCATE)'); } catch (e) {}
|
|
try { _db.close(); } catch (e) {}
|
|
_db = null;
|
|
console.log('[DB] Database connection closed');
|
|
}
|
|
}
|
|
|
|
function reinitialize(): void {
|
|
console.log('[DB] Reinitializing database connection after restore...');
|
|
if (_db) closeDb();
|
|
initDb();
|
|
console.log('[DB] Database reinitialized successfully');
|
|
}
|
|
|
|
interface PlaceWithCategory extends Place {
|
|
category_name: string | null;
|
|
category_color: string | null;
|
|
category_icon: string | null;
|
|
}
|
|
|
|
interface PlaceWithTags extends Place {
|
|
category: { id: number; name: string; color: string; icon: string } | null;
|
|
tags: Tag[];
|
|
}
|
|
|
|
function getPlaceWithTags(placeId: number | string): PlaceWithTags | null {
|
|
const place = db.prepare(`
|
|
SELECT p.*, c.name as category_name, c.color as category_color, c.icon as category_icon
|
|
FROM places p
|
|
LEFT JOIN categories c ON p.category_id = c.id
|
|
WHERE p.id = ?
|
|
`).get(placeId) as PlaceWithCategory | undefined;
|
|
|
|
if (!place) return null;
|
|
|
|
const tags = db.prepare(`
|
|
SELECT t.* FROM tags t
|
|
JOIN place_tags pt ON t.id = pt.tag_id
|
|
WHERE pt.place_id = ?
|
|
`).all(placeId) as Tag[];
|
|
|
|
return {
|
|
...place,
|
|
category: place.category_id ? {
|
|
id: place.category_id,
|
|
name: place.category_name!,
|
|
color: place.category_color!,
|
|
icon: place.category_icon!,
|
|
} : null,
|
|
tags,
|
|
};
|
|
}
|
|
|
|
interface TripAccess {
|
|
id: number;
|
|
user_id: number;
|
|
}
|
|
|
|
function canAccessTrip(tripId: number | string, userId: number): TripAccess | undefined {
|
|
return db.prepare(`
|
|
SELECT t.id, t.user_id FROM trips t
|
|
LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ?
|
|
WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)
|
|
`).get(userId, tripId, userId) as TripAccess | undefined;
|
|
}
|
|
|
|
function isOwner(tripId: number | string, userId: number): boolean {
|
|
return !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId);
|
|
}
|
|
|
|
try {
|
|
const { backfillFlightEndpoints } = require('../services/airportService');
|
|
backfillFlightEndpoints();
|
|
} catch (err) {
|
|
console.error('[DB] Flight endpoint backfill failed:', err);
|
|
}
|
|
|
|
export { db, closeDb, reinitialize, getPlaceWithTags, canAccessTrip, isOwner };
|