feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack (#216)

* feat(infra): add dev compose stack with postgres and redis

* fix(infra): comment dev env defaults until wired; harden dev compose restart and start_period

* chore(deps): add pg driver and testcontainers for postgres migration

* feat(db): translate schema to drizzle pg-core (timestamptz, boolean, pgEnum, jsonb)

Schema translation (apps/api/src/db/schema.ts):
- sqlite-core -> pg-core, all 10 tables preserved 1:1
- integer(mode:'timestamp') -> timestamp({ withTimezone: true })
- integer(mode:'boolean') -> boolean
- jobs.status text enum -> pgEnum('job_status') with same 4 values
- 7 columns changed from text to jsonb: jobs.inputFiles, jobs.settings,
  pipelines.steps, apiKeys.permissions, roles.permissions,
  auditLog.details, userFiles.toolChain
- settings.value stays text, jobs.error stays text, jobs.progress stays real

jsonb call-site sweep (removed JSON.stringify on writes, JSON.parse on reads):
- apps/api/src/routes/roles.ts: permissions read/write (3 sites)
- apps/api/src/routes/api-keys.ts: permissions write + read (2 sites)
- apps/api/src/routes/audit-log.ts: details read (1 site)
- apps/api/src/routes/pipeline.ts: steps write + read (2 sites)
- apps/api/src/routes/progress.ts: inputFiles write (2 sites)
- apps/api/src/routes/tool-factory.ts: toolChain read + write (2 sites)
- apps/api/src/routes/user-files.ts: toolChain read + write (4 sites)
- apps/api/src/permissions.ts: roles.permissions read (1 site)
- apps/api/src/lib/audit.ts: details write (1 site)
- apps/api/src/plugins/auth.ts: apiKeys.permissions read (1 site)

* refactor(db): type jsonb columns via $type and note raw CTE conversion requirements

* feat(db): archive sqlite migrations and generate postgres baseline

* chore(db): dockerignore legacy migrations, add archive breadcrumb, fix trailing newline

* feat(db): pg pool connection, advisory-locked boot migrations, DATABASE_URL config

* fix(db): friendly fatal on unreachable postgres, idempotent closeDb, lock-key convention note

* refactor(db): async drizzle calls in plugins, lib, permissions

* fix(api): analytics never throws, typed permission guard, single-query session invalidation

* refactor(db): async drizzle calls across all routes and bootstrap

Convert every route file and index.ts from sync SQLite drizzle
patterns to async node-postgres drizzle:

- .all() removed (bare await on select)
- .get() converted to destructured [row] = await ...
- .run() removed (bare await on insert/update/delete)
- .changes replaced with .rowCount (null-guarded) in progress.ts
- sqlite import removed from user-files.ts; raw CTEs converted to
  await db.execute(sql`...`) with postgres-dialect recursive CTEs
- ChainRow types updated: tool_chain is parsed jsonb (string[] | null),
  created_at is Date (timestamptz) with no * 1000 conversion
- All requirePermission() guard calls awaited (security: unawaited
  async guard returns truthy Promise, bypassing permission check)
- All hasEffectivePermission() and getPermissions() calls awaited
- All auditLog() calls awaited (preserves write-before-response order)
- trackEvent() and captureException() left un-awaited (fire-and-forget
  by design, guaranteed never-throw)
- ensureAnonymousUser(), startCleanupCron(), recoverStaleJobs() awaited
  in bootstrap sequence
- ensureInstanceId() and ensureDefaultSettings() made async

Files converted: 14 (index.ts + 12 route files + tools/index.ts)

* fix(db): await async checkStorageQuota in user-files upload/save routes

* fix(db): await checkStorageQuota in save-result route (missed second call site)

* feat(db): sqlite-to-postgres migrator with CLI and first-boot import

* fix(db): migrator error context, honest force semantics, boot-hook fatal, null-variance tests

* test: run suite against per-file postgres databases via testcontainers

- Add tests/global-setup.ts: spins up a Postgres testcontainer,
  creates a migrated template database once per vitest run.
- Rewrite tests/setup/per-fork-env.ts: each test file (forks pool)
  clones the template into its own database via CREATE DATABASE ...
  TEMPLATE, preserving the same per-file isolation granularity.
- Update vitest.config.ts: add globalSetup, pg alias, update comment.
- Fix tests/integration/test-server.ts: remove DB_PATH mkdir, async
  runMigrations, async db operations, remove SQLite WAL checkpoint.
- Fix 21 unit test db/index mocks: add pool and closeDb exports.
- Fix 8 unit test files: add async/await for now-async permission,
  audit, and analytics functions.
- Fix 18 integration test files: convert sync .run()/.all()/.get()
  to async drizzle patterns, add async to callbacks.
- Production change: apps/api/src/routes/teams.ts: cast COUNT(*)
  to ::int so Postgres returns a number instead of bigint string.

* fix(db): seed built-in roles, reject NUL bytes, cast COUNT, serialize job persists

- Seed built-in roles (admin, editor, user) at boot via ensureBuiltinRoles()
  with onConflictDoNothing, restoring data that legacy SQLite migration 0007
  provided via INSERT statements (the pg baseline is DDL-only).
- Reject NUL bytes in login credentials with 401 (postgres rejects \x00 in
  text columns; valid usernames never contain NUL, matching 1.x behavior).
- Cast COUNT(*)::int in user-files, audit-log, and roles listing queries so
  postgres returns a JS number instead of bigint-as-string.
- Serialize fire-and-forget job progress DB writes per jobId so the final
  "completed" status is never overwritten by a late-arriving "processing"
  write (race condition exposed by async postgres round-trips).

* test: fix teams race, seed roles in test server, poll for job status

- Add missing await to resetTeams() in teams PUT beforeEach (the async
  delete raced with the subsequent insert under postgres).
- Call ensureBuiltinRoles() in test server bootstrap so integration tests
  have the same built-in roles as production.
- Replace fixed 100ms flushPersist delay with a polling helper that waits
  for terminal job status, eliminating timing-dependent failures caused by
  postgres network round-trip latency.

* test: make heic temp-file cleanup assertion resilient to concurrent workers

Use a set-based diff instead of raw file count when checking that
decodeHeic cleans up temp files. Other concurrent test workers can
create heic-in-*/heic-out-* files in the shared tmpdir, inflating the
"after" count and causing spurious failures under full-suite load.

* fix(db): align builtin-role seed to post-0010 legacy state; test polish

* feat(docker): three-container compose (app, postgres, redis) with boot wait and migrations

* fix(docker): set TEST_DATABASE_URL so containerized tests skip testcontainers

* chore(docker): test compose project name, clearer 1.x upgrade comment, unref probe timer

* feat(enterprise): enforce D15 license boundary; move s3 storage into packages/enterprise

* fix(enterprise): restore lazy aws-sdk loading; community installs load no s3 code at boot

* fix(enterprise): boundary check catches dynamic imports; document getS3 concurrency

* feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack

BREAKING CHANGE: SQLite is no longer the runtime database. Deployments now
require Postgres (and Redis, used from phase 2). Existing installs migrate
with SQLITE_MIGRATE_PATH or 'pnpm --filter @snapotter/api migrate:sqlite'.

* fix(ci): postgres service + fresh e2e database per run; ignore unfixable torch CVE-2025-3000

apps/api/src/index.ts

@@ -4,10 +4,10 @@ import cors from "@fastify/cors";
 import rateLimit from "@fastify/rate-limit";
 import { getDispatcherStatus, initDispatcher, isGpuAvailable } from "@snapotter/ai";
 import { APP_VERSION } from "@snapotter/shared";
-import { eq } from "drizzle-orm";
+import { eq, sql } from "drizzle-orm";
 import Fastify from "fastify";
 import { env } from "./config.js";
-import { db, schema } from "./db/index.js";
+import { closeDb, db, schema } from "./db/index.js";
 import { runMigrations } from "./db/migrate.js";
 import { captureException, initAnalytics, shutdownAnalytics } from "./lib/analytics.js";
 import { startCleanupCron } from "./lib/cleanup.js";
@@ -19,6 +19,7 @@ import {
   authMiddleware,
   authRoutes,
   ensureAnonymousUser,
+  ensureBuiltinRoles,
   ensureDefaultAdmin,
 } from "./plugins/auth.js";
 import { oidcRoutes } from "./plugins/oidc.js";
@@ -43,55 +44,86 @@ import { registerToolRoutes } from "./routes/tools/index.js";
 import { userFileRoutes } from "./routes/user-files.js";
 
 // Run before anything else
-runMigrations();
+try {
+  await runMigrations();
+} catch (err) {
+  const safeUrl = env.DATABASE_URL.replace(/:\/\/[^@]*@/, "://***@");
+  console.error(
+    `FATAL: Cannot connect to Postgres at ${safeUrl}. Is the database running? (docker compose up, or set DATABASE_URL)`,
+  );
+  console.error(err);
+  process.exit(1);
+}
 console.log("Database initialized");
 
+// Auto-import 1.x SQLite database on first boot (before default user creation)
+if (env.SQLITE_MIGRATE_PATH) {
+  const { rows } = await db.execute(sql`SELECT count(*)::int AS n FROM users`);
+  if ((rows[0].n as number) === 0) {
+    try {
+      const { migrateFromSqlite } = await import("./db/migrate-from-sqlite.js");
+      const result = await migrateFromSqlite(env.SQLITE_MIGRATE_PATH, { force: false });
+      console.log("Imported 1.x SQLite database:", JSON.stringify(result.tables));
+    } catch (err) {
+      console.error(
+        `FATAL: 1.x SQLite import failed from ${env.SQLITE_MIGRATE_PATH}: ${(err as Error).message}. No partial data was written.`,
+      );
+      process.exit(1);
+    }
+  } else {
+    console.log("SQLITE_MIGRATE_PATH set but target is not empty; skipping import");
+  }
+}
+
+// Seed built-in roles (admin, editor, user) that legacy SQLite migrations
+// inserted via data statements.  The pg baseline is DDL-only, so roles are
+// seeded here at boot time.  onConflictDoNothing makes this idempotent.
+await ensureBuiltinRoles();
+
 if (env.AUTH_ENABLED) {
   await ensureDefaultAdmin();
 } else {
-  ensureAnonymousUser();
+  await ensureAnonymousUser();
 }
 
-function ensureInstanceId() {
-  const existing = db
+async function ensureInstanceId() {
+  const [existing] = await db
     .select()
     .from(schema.settings)
-    .where(eq(schema.settings.key, "instance_id"))
-    .get();
+    .where(eq(schema.settings.key, "instance_id"));
   if (!existing) {
-    db.insert(schema.settings).values({ key: "instance_id", value: randomUUID() }).run();
+    await db.insert(schema.settings).values({ key: "instance_id", value: randomUUID() });
   }
 }
 
-ensureInstanceId();
+await ensureInstanceId();
 
-function ensureDefaultSettings() {
+async function ensureDefaultSettings() {
   const defaults: Record<string, string> = {
     defaultTheme: env.DEFAULT_THEME,
     defaultLocale: env.DEFAULT_LOCALE,
     defaultToolView: env.DEFAULT_TOOL_VIEW,
   };
   for (const [key, value] of Object.entries(defaults)) {
-    const existing = db.select().from(schema.settings).where(eq(schema.settings.key, key)).get();
+    const [existing] = await db.select().from(schema.settings).where(eq(schema.settings.key, key));
     if (!existing) {
-      db.insert(schema.settings).values({ key, value }).run();
+      await db.insert(schema.settings).values({ key, value });
     }
   }
 }
 
-ensureDefaultSettings();
+await ensureDefaultSettings();
 
 if (!env.COOKIE_SECRET) {
-  const existing = db
+  const [existing] = await db
     .select()
     .from(schema.settings)
-    .where(eq(schema.settings.key, "cookie_secret"))
-    .get();
+    .where(eq(schema.settings.key, "cookie_secret"));
   if (existing) {
     (env as Record<string, unknown>).COOKIE_SECRET = existing.value;
   } else {
     const generated = randomUUID() + randomUUID();
-    db.insert(schema.settings).values({ key: "cookie_secret", value: generated }).run();
+    await db.insert(schema.settings).values({ key: "cookie_secret", value: generated });
     (env as Record<string, unknown>).COOKIE_SECRET = generated;
   }
 }
@@ -113,7 +145,7 @@ try {
 }
 
 // Mark any jobs left in processing/queued from a previous unclean shutdown
-recoverStaleJobs();
+await recoverStaleJobs();
 
 // Set up AI feature directories and recover from interrupted installs
 ensureAiDirs();
@@ -271,7 +303,7 @@ await docsRoutes(app);
 app.get("/api/v1/health", async (_request, reply) => {
   let dbOk = false;
   try {
-    db.select().from(schema.settings).limit(1).get();
+    await db.select().from(schema.settings).limit(1);
     dbOk = true;
   } catch {
     /* db unreachable */
@@ -287,12 +319,12 @@ app.get("/api/v1/health", async (_request, reply) => {
 
 // Admin health check (full diagnostics)
 app.get("/api/v1/admin/health", async (request, reply) => {
-  const admin = requirePermission("system:health")(request, reply);
+  const admin = await requirePermission("system:health")(request, reply);
   if (!admin) return;
 
   let dbOk = false;
   try {
-    db.select().from(schema.settings).limit(1).all();
+    await db.select().from(schema.settings).limit(1);
     dbOk = true;
   } catch {
     /* db unreachable */
@@ -330,7 +362,7 @@ if (process.env.NODE_ENV === "production") {
 }
 
 // Start workspace cleanup cron
-const cleanupCron = startCleanupCron();
+const cleanupCron = await startCleanupCron();
 
 // Start
 try {
@@ -414,8 +446,7 @@ async function shutdown(signal: string) {
   }
 
   try {
-    const { sqlite: sqliteConn } = await import("./db/index.js");
-    sqliteConn.close();
+    await closeDb();
     console.log("Database connection closed");
   } catch (err) {
     console.error("Error closing database:", err);