Files
Hartmut 5bc7cace26 fix(auth): make active-session check fail-open; add missing DB migration
The active_sessions table was never migrated to production — the model
was added to the Prisma schema via db push only. prisma migrate deploy
was a no-op because no migration directories existed.

Without the table, prisma.activeSession.findUnique() throws P2021,
crashing the tRPC handler with 500 on every authenticated request.
This silently emptied all admin pages (users, system-roles, etc.).

Changes:
- Wrap the jti ActiveSession lookup in try-catch so the tRPC handler
  degrades gracefully (fail-open) if the table is temporarily missing
- Add packages/db/prisma/migrations/20260401000000_active_sessions/
  so prisma migrate deploy creates the table on next production deploy
  (idempotent via IF NOT EXISTS — safe if table already exists)

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-04-01 18:38:05 +02:00

37 lines
1.2 KiB
SQL

-- CreateTable: active_sessions (JWT session registry)
-- Supports concurrent-session limits and manual session revocation.
-- Using IF NOT EXISTS guards for idempotency when table was pre-created via db push.
CREATE TABLE IF NOT EXISTS "active_sessions" (
"id" TEXT NOT NULL,
"userId" TEXT NOT NULL,
"jti" TEXT NOT NULL,
"createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"lastSeenAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"userAgent" TEXT,
"ipAddress" TEXT,
CONSTRAINT "active_sessions_pkey" PRIMARY KEY ("id")
);
-- CreateIndex
CREATE UNIQUE INDEX IF NOT EXISTS "active_sessions_jti_key" ON "active_sessions"("jti");
-- CreateIndex
CREATE INDEX IF NOT EXISTS "active_sessions_userId_createdAt_idx" ON "active_sessions"("userId", "createdAt");
-- AddForeignKey (skip if already exists)
DO $$
BEGIN
IF NOT EXISTS (
SELECT 1 FROM information_schema.table_constraints
WHERE constraint_name = 'active_sessions_userId_fkey'
AND table_name = 'active_sessions'
) THEN
ALTER TABLE "active_sessions"
ADD CONSTRAINT "active_sessions_userId_fkey"
FOREIGN KEY ("userId") REFERENCES "users"("id")
ON DELETE CASCADE ON UPDATE CASCADE;
END IF;
END $$;