WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

migrations/versioned/000046_org_owner_tenant_id.up.sql

@@ -0,0 +1,78 @@
+-- Migration: 000046_org_owner_tenant_id
+--
+-- Plan 3 follow-up to #1303: pin the org's "owning tenant" in the
+-- organizations table itself instead of recomputing it on every
+-- permission check from the owner user's *current* tenant. The old
+-- `isOwnerTenant(org, t) == (owner.user.TenantID == t)` rule breaks
+-- silently when the owner user moves to a different tenant: the
+-- formerly-protected owning tenant becomes removable, and the new
+-- tenant the owner moved to (which probably isn't even in OTM) starts
+-- being treated as untouchable. Storing owner_tenant_id at create time
+-- and never changing it post-hoc gives us a single source of truth.
+--
+-- Backfill strategy:
+--   1. derive from the owner user's current tenant (works for the
+--      vast majority of orgs);
+--   2. for orgs whose owner user is gone, fall back to the earliest
+--      Admin tenant in OTM — deterministic across re-runs;
+--   3. anything still NULL means the org is genuinely orphaned (no
+--      owner user, no admin tenant) — abort the migration with a loud
+--      RAISE EXCEPTION so the operator deals with it manually.
+--      We refuse to silently ship an unconstrained NOT NULL since it
+--      would mean some org rows are unreachable.
+
+DO $$ BEGIN RAISE NOTICE '[Migration 000046] Adding organizations.owner_tenant_id'; END $$;
+
+ALTER TABLE organizations
+    ADD COLUMN IF NOT EXISTS owner_tenant_id BIGINT;
+
+-- Pass 1: owner user still exists.
+UPDATE organizations o
+   SET owner_tenant_id = u.tenant_id
+  FROM users u
+ WHERE o.owner_id        = u.id
+   AND o.owner_tenant_id IS NULL;
+
+-- Pass 2: orphan owner — pick the earliest Admin tenant in OTM.
+UPDATE organizations o
+   SET owner_tenant_id = sub.tenant_id
+  FROM (
+        SELECT DISTINCT ON (otm.organization_id)
+               otm.organization_id,
+               otm.tenant_id
+          FROM organization_tenant_members otm
+         WHERE otm.role = 'admin'
+         ORDER BY otm.organization_id, otm.created_at ASC, otm.tenant_id ASC
+       ) sub
+ WHERE sub.organization_id = o.id
+   AND o.owner_tenant_id   IS NULL;
+
+-- Surface anything still unresolved. We deliberately fail the migration
+-- here instead of guessing — making the column NOT NULL with a bogus
+-- backfill would corrupt permission checks for those orgs forever.
+DO $$
+DECLARE
+    orphan_count INT;
+BEGIN
+    SELECT COUNT(*) INTO orphan_count
+      FROM organizations
+     WHERE owner_tenant_id IS NULL
+       AND deleted_at      IS NULL;
+    IF orphan_count > 0 THEN
+        RAISE EXCEPTION
+            '[Migration 000046] % orphan organization(s) have no resolvable owner_tenant_id (owner user missing AND no admin tenant in OTM). Either soft-delete them or backfill manually before retrying. Inspect with: SELECT id, name, owner_id FROM organizations WHERE owner_tenant_id IS NULL AND deleted_at IS NULL;',
+            orphan_count;
+    END IF;
+END $$;
+
+-- Lock in the invariant.
+ALTER TABLE organizations
+    ALTER COLUMN owner_tenant_id SET NOT NULL;
+
+CREATE INDEX IF NOT EXISTS idx_organizations_owner_tenant
+    ON organizations (owner_tenant_id);
+
+COMMENT ON COLUMN organizations.owner_tenant_id IS
+    'Plan 3 (#1303): owning tenant; cannot be removed/downgraded from OTM.';
+
+DO $$ BEGIN RAISE NOTICE '[Migration 000046] organizations.owner_tenant_id ready'; END $$;