|
| 1 | +-- Pure expand: every new column is nullable, and no managed_mcp row can predate this migration. |
| 2 | +-- Every pre-COMMIT statement is replay-safe because a concurrent index failure leaves this file |
| 3 | +-- unjournaled while preserving the committed schema changes. |
| 4 | +ALTER TYPE "public"."credential_type" ADD VALUE IF NOT EXISTS 'managed_mcp' BEFORE 'env_workspace';--> statement-breakpoint |
| 5 | +ALTER TABLE "credential" ADD COLUMN IF NOT EXISTS "mcp_server_id" text;--> statement-breakpoint |
| 6 | +ALTER TABLE "credential" ADD COLUMN IF NOT EXISTS "mcp_tools" jsonb;--> statement-breakpoint |
| 7 | +ALTER TABLE "credential" ADD COLUMN IF NOT EXISTS "mcp_tools_refreshed_at" timestamp;--> statement-breakpoint |
| 8 | +ALTER TABLE "mcp_servers" ADD COLUMN IF NOT EXISTS "credential_group_id" text;--> statement-breakpoint |
| 9 | + |
| 10 | +-- PostgreSQL has no ADD CONSTRAINT IF NOT EXISTS, so replay guards are scoped to each table. |
| 11 | +-- NOT VALID keeps foreign-key installation to a metadata change before validation. |
| 12 | +DO $$ BEGIN |
| 13 | + IF NOT EXISTS ( |
| 14 | + SELECT 1 FROM "pg_constraint" |
| 15 | + WHERE "conname" = 'credential_mcp_server_id_mcp_servers_id_fk' |
| 16 | + AND "conrelid" = '"credential"'::regclass |
| 17 | + ) THEN |
| 18 | + ALTER TABLE "credential" ADD CONSTRAINT "credential_mcp_server_id_mcp_servers_id_fk" FOREIGN KEY ("mcp_server_id") REFERENCES "public"."mcp_servers"("id") ON DELETE cascade ON UPDATE no action NOT VALID; |
| 19 | + END IF; |
| 20 | +END $$;--> statement-breakpoint |
| 21 | +ALTER TABLE "credential" VALIDATE CONSTRAINT "credential_mcp_server_id_mcp_servers_id_fk";--> statement-breakpoint |
| 22 | +DO $$ BEGIN |
| 23 | + IF NOT EXISTS ( |
| 24 | + SELECT 1 FROM "pg_constraint" |
| 25 | + WHERE "conname" = 'mcp_servers_credential_group_id_credential_group_id_fk' |
| 26 | + AND "conrelid" = '"mcp_servers"'::regclass |
| 27 | + ) THEN |
| 28 | + ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_credential_group_id_credential_group_id_fk" FOREIGN KEY ("credential_group_id") REFERENCES "public"."credential_group"("id") ON DELETE set null ON UPDATE no action NOT VALID; |
| 29 | + END IF; |
| 30 | +END $$;--> statement-breakpoint |
| 31 | +ALTER TABLE "mcp_servers" VALIDATE CONSTRAINT "mcp_servers_credential_group_id_credential_group_id_fk";--> statement-breakpoint |
| 32 | + |
| 33 | +DO $$ BEGIN |
| 34 | + IF NOT EXISTS ( |
| 35 | + SELECT 1 FROM "pg_constraint" |
| 36 | + WHERE "conname" = 'credential_managed_mcp_source_check' |
| 37 | + AND "conrelid" = '"credential"'::regclass |
| 38 | + ) THEN |
| 39 | + ALTER TABLE "credential" ADD CONSTRAINT "credential_managed_mcp_source_check" CHECK ((type::text <> 'managed_mcp') OR ( |
| 40 | + id LIKE 'mcp-cg-%' |
| 41 | + AND account_id IS NULL |
| 42 | + AND provider_id IS NULL |
| 43 | + AND authorization_app_id IS NULL |
| 44 | + AND credential_group_enrollment_id IS NOT NULL |
| 45 | + AND credential_group_option_id IS NULL |
| 46 | + AND mcp_server_id IS NOT NULL |
| 47 | + AND managed_oauth_status IS NOT NULL |
| 48 | + AND (managed_oauth_status <> 'active' OR ( |
| 49 | + encrypted_oauth_token_set IS NOT NULL |
| 50 | + AND mcp_tools IS NOT NULL |
| 51 | + )) |
| 52 | + AND granted_at IS NOT NULL |
| 53 | + AND managed_oauth_scope_version IS NULL |
| 54 | + AND provider_subject_id IS NULL |
| 55 | + AND provider_tenant_id IS NULL |
| 56 | + AND granted_scopes IS NULL |
| 57 | + AND provider_metadata IS NULL |
| 58 | + AND created_by IS NULL |
| 59 | + AND env_key IS NULL |
| 60 | + AND env_owner_user_id IS NULL |
| 61 | + AND encrypted_service_account_key IS NULL |
| 62 | + AND unredacted = false |
| 63 | + )) NOT VALID; |
| 64 | + END IF; |
| 65 | +END $$;--> statement-breakpoint |
| 66 | +ALTER TABLE "credential" VALIDATE CONSTRAINT "credential_managed_mcp_source_check";--> statement-breakpoint |
| 67 | +DO $$ BEGIN |
| 68 | + IF NOT EXISTS ( |
| 69 | + SELECT 1 FROM "pg_constraint" |
| 70 | + WHERE "conname" = 'credential_creator_source_check' |
| 71 | + AND "conrelid" = '"credential"'::regclass |
| 72 | + ) THEN |
| 73 | + ALTER TABLE "credential" ADD CONSTRAINT "credential_creator_source_check" CHECK ((type::text = 'managed_mcp') OR created_by IS NOT NULL) NOT VALID; |
| 74 | + END IF; |
| 75 | +END $$;--> statement-breakpoint |
| 76 | +ALTER TABLE "credential" VALIDATE CONSTRAINT "credential_creator_source_check";--> statement-breakpoint |
| 77 | +ALTER TABLE "credential" ALTER COLUMN "created_by" DROP NOT NULL;--> statement-breakpoint |
| 78 | + |
| 79 | +-- The commit makes the new enum label visible and moves index builds outside the migration |
| 80 | +-- runner's transaction, as required by PostgreSQL for the partial and concurrent indexes. |
| 81 | +COMMIT;--> statement-breakpoint |
| 82 | +SET lock_timeout = 0;--> statement-breakpoint |
| 83 | +-- A failed concurrent build leaves an invalid index behind, so each replay removes it first. |
| 84 | +DROP INDEX CONCURRENTLY IF EXISTS "credential_mcp_server_idx";--> statement-breakpoint |
| 85 | +CREATE INDEX CONCURRENTLY IF NOT EXISTS "credential_mcp_server_idx" ON "credential" USING btree ("mcp_server_id");--> statement-breakpoint |
| 86 | +DROP INDEX CONCURRENTLY IF EXISTS "credential_managed_mcp_enrollment_server_unique";--> statement-breakpoint |
| 87 | +CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS "credential_managed_mcp_enrollment_server_unique" ON "credential" USING btree ("credential_group_enrollment_id","mcp_server_id") WHERE "credential"."type" = 'managed_mcp';--> statement-breakpoint |
| 88 | +DROP INDEX CONCURRENTLY IF EXISTS "mcp_servers_credential_group_idx";--> statement-breakpoint |
| 89 | +CREATE INDEX CONCURRENTLY IF NOT EXISTS "mcp_servers_credential_group_idx" ON "mcp_servers" USING btree ("credential_group_id");--> statement-breakpoint |
| 90 | +SET lock_timeout = '5s'; |
0 commit comments