tickets

7.2 KB

1. // tools/migrate-short-ids.hl — ONE-OFF MIGRATION (mission 039, ident#23): ident answers every identity's public
2. // 5-character SHORT ID (e.g. `a68sz`) instead of the old per-app id (32 hex). tickets.worldapi.org keeps ident ids in ONE place:
3. // users.db `identity` (lib/users.hl usersTable, unique index) — and the env TICKETS_CREATOR_IDENTITY (.env on Byrodin), for
4. // which this tool prints the new value. events/links `user`, tokens.db `user`, assignees are the users @id.
5. // Everything else points at the users @id, which does not change — sessions (`user = { id = <users @id> }`) stay signed in.
6. //
7. // What it does: POST <ident>/api/migrate-ids {key, secret} (NEVER `finish` — that is a separate, later step, runbook
8. // antcolony-docs/docs/short-id-switch.md) → { ids: { <old id>: <short id> } }, then for every user:
9. // * old id in the map → `identity` rewritten to the short id (MAPPED)
10. // * already a short id → left alone (ALREADY) — so a second run changes nothing (idempotent)
11. // * old id NOT in the map → left alone (UNMAPPED): an identity deleted in ident since; nobody can log in as it
12. // * the short id is already another user's `identity` → left alone (CONFLICT; cannot happen while the app was
13. // stopped between the ident switch and this run — needs a human, runbook "Conflicts"; the tool then exits non-zero)
14. // Prints counts; the key/secret are read from the environment and never printed. Exit is non-zero on any refusal.
15. //
16. // RUN IT WITH THE APP STOPPED (the server holds the tables), after ident#23 is live, storage backed up:
17. // TICKETS_STORAGE=$PWD/storage/mpackdb IDENT_API_KEY=… IDENT_API_SECRET=… IDENT_EXCHANGE_URL=<ident> bin/hybriel tools/migrate-short-ids.hl
18. // On Byrodin (the key/secret come from the app's .env through docker's --env-file; hybriel itself only loads a .env
19. // beside the ENTRY script, i.e. tools/.env, which does not exist):
20. // docker run --rm --network host --env-file .env -e TICKETS_STORAGE=/home/tickets/storage/mpackdb \
21. // -e IDENT_EXCHANGE_URL=http://127.0.0.1:45002 -v $PWD:/home/tickets -w /home/tickets \
22. // worldapi-hybriel-runtime:debian12 ./bin/hybriel tools/migrate-short-ids.hl
23. // TICKETS_STORAGE must be ABSOLUTE: Hybriel resolves a relative path against the entry script's folder (tools/).
24. // Test: tests/short-id-switch.mjs (old ident → data → new ident → this tool twice → the same user logs in again).
25. import { env } from 'hl:proc'
26. import { fetch } from 'hl:fetch'
27. import { usersTable, identKey, identSecret, identExchangeUrl } from '../lib/users.hl'
28. import { countOf, first } from '../lib/util.hl'
30. storage = env('TICKETS_STORAGE')
31. if (storage == null || !storage.startsWith('/')) {
32. hlError('set TICKETS_STORAGE to the ABSOLUTE table directory, e.g. TICKETS_STORAGE=$PWD/storage/mpackdb')
33. }
34. if (identKey == '' || identSecret == '') {
35. hlError('IDENT_API_KEY / IDENT_API_SECRET are not set (on Byrodin: docker run --env-file .env …)')
36. }
38. // the characters of an id, as ident#23 makes them: 5+ of 2-9 and a-z without i, l, o (lower case)
39. static isShortId = (s) => {
40. if (s == null || hlTypeName(s) != 'String' || s.length < 5 || s.length > 16) { return false }
41. let i = 0
42. while (i < s.length) {
43. let c = s.charCodeAt(i)
44. let digit = c >= 50 && c <= 57
45. let letter = c >= 97 && c <= 122 && c != 105 && c != 108 && c != 111
46. if (!digit && !letter) { return false }
47. i = i + 1
48. }
49. return true
50. }
51. // the old per-app id: exactly 32 lowercase hex
52. static isOldId = (s) => {
53. if (s == null || hlTypeName(s) != 'String' || s.length != 32) { return false }
54. let i = 0
55. while (i < s.length) {
56. let c = s.charCodeAt(i)
57. if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102))) { return false }
58. i = i + 1
59. }
60. return true
61. }
62. // every field of the record, `identity` replaced (hl:mpackdb wants the whole @id record, its `id` included)
63. static withIdentity = (rec, identity) => {
64. out = {}
65. for (k of rec.keys()) { out[k] = rec[k] }
66. out.identity = identity
67. return out
68. }
70. console.log('migrate-short-ids: asking ' + identExchangeUrl + '/api/migrate-ids (storage ' + storage + ')')
71. r = fetch(identExchangeUrl + '/api/migrate-ids', { method = 'POST' json = { key = identKey secret = identSecret } headers = { 'user-agent' = 'tickets.worldapi.org (migrate-short-ids)' } timeoutMs = 30000 })
72. if (r == null || r.status == null || r.status == 0) { hlError('ident did not answer at ' + identExchangeUrl) }
73. if (r.status != 200) {
74. e = r.json()
75. hlError('ident refused migrate-ids (' + r.status + (e != null && e.error != null ? ': ' + e.error : '') + ') — is ident#23 live? right key/secret?')
76. }
77. j = r.json()
78. if (j == null || j.ids == null || hlTypeName(j.ids) != 'Hybrid') { hlError('ident answered no id map: ' + JSON.stringify(j)) }
79. ids = j.ids
80. console.log('ident: ' + j.count + ' old ids in the map, finished = ' + j.finished)
82. seen = 0
83. mapped = 0
84. already = 0
85. unmapped = 0
86. conflicts = 0
87. failed = 0
88. all = usersTable.find(null, null)
89. if (countOf(all) > 0) {
90. for (u of all) {
91. seen = seen + 1
92. let old = u.identity
93. let sid = isOldId(old) ? ids[old] : null
94. if (sid != null && isShortId(sid)) {
95. let other = first(usersTable.find('identity', sid))
96. if (other != null && other.id != u.id) {
97. conflicts = conflicts + 1
98. console.log('CONFLICT user ' + u.id + ': its short id ' + sid + ' is already user ' + other.id + ' — left alone')
99. } else {
100. usersTable.update(u.id, withIdentity(u, sid))
101. let after = usersTable.fetch(u.id)
102. if (after != null && after.identity == sid && first(usersTable.find('identity', sid)) != null && countOf(usersTable.find('identity', old)) == 0) {
103. mapped = mapped + 1
104. console.log('MAPPED user ' + u.id + ' → ' + sid)
105. } else {
106. failed = failed + 1
107. console.log('FAILED user ' + u.id + ': ' + usersTable.lastError())
108. }
109. }
110. } else if (isShortId(old) && !isOldId(old)) {
111. already = already + 1
112. } else {
113. unmapped = unmapped + 1
114. console.log('UNMAPPED user ' + u.id + ' (ident does not know its old id any more — deleted identity?)')
115. }
116. }
117. }
118. // TICKETS_CREATOR_IDENTITY (users.hl isCreator compares it with users.identity): its new value, to put into .env
119. creatorOld = env('TICKETS_CREATOR_IDENTITY')
120. if (creatorOld == null || creatorOld.trim() == '') {
121. console.log('TICKETS_CREATOR_IDENTITY: not set — nothing to do')
122. } else if (isOldId(creatorOld.trim()) && ids[creatorOld.trim()] != null) {
123. console.log('TICKETS_CREATOR_IDENTITY: an old id → set TICKETS_CREATOR_IDENTITY=' + ids[creatorOld.trim()] + ' in .env BEFORE tickets starts again')
124. } else if (isShortId(creatorOld.trim()) && !isOldId(creatorOld.trim())) {
125. console.log('TICKETS_CREATOR_IDENTITY: already a short id — nothing to do')
126. } else {
127. console.log('TICKETS_CREATOR_IDENTITY: ident has no short id for it (never logged in to tickets?) — the creator logs in, reads the id on /you, set it by hand')
128. }
129. console.log('migrate-short-ids: users seen ' + seen + ', mapped ' + mapped + ', already short ' + already + ', unmapped ' + unmapped + ', conflicts ' + conflicts + ', failed ' + failed)
130. if (failed > 0) { hlError('some users could not be written — restore the backup and look') }
131. if (conflicts > 0) { hlError('CONFLICTS: the app made a new user for a short id before this ran (it was not stopped?) — the old user keeps its old id; see the runbook "Conflicts"') }