Files
SnapOtter/apps/docs/guide/database.md
T
SnapOtterandGitHub d10d0f544f fix: release QA hardening across processing, media, security, and CI gates (#649)
A release-readiness QA pass over the whole product. The commits split into
defects a user would hit and gates that were reporting green while measuring
nothing.

## Fixes that change behaviour

Rate limiting was bypassable on every install: TRUST_PROXY defaulted to true, so
request.ip came from a client-set header and a forged X-Forwarded-For got past
the login limiter. The default is now a private-network trust list.

A transient Postgres outage stranded in-flight jobs, leaving finished output on
disk with no row pointing at it. A reconciler now resolves those rows and adopts
the bytes rather than dropping the work.

A Redis connection that moved to a new address wedged every read-blocked
consumer, so completions stopped signalling while health still answered 200.
Socket timeouts plus subscriber pings recover it.

Installing more than one AI bundle left the shared venv multi-versioned and
silently broke three tools. The installer now reconciles distributions to one
version each.

Converting an image to JXL at quality 1 through 4 returned a 500, because
libjxl 0.7 rejects the distance those values compute. The quality is floored at
what the encoder honours. A missing ffmpeg was also reported to the user as a
corrupt upload; it now says the engine is unavailable.

RAW uploads reached an unpatched LibRaw on arm64, so it is built from source at
0.22.2, and the release scan was split so it can fail on an unfixed critical
instead of hiding it behind ignore-unfixed.

## Gates that could not fail

Two mutation lanes ran zero mutants because Stryker crawled the gitignored docs
build; coverage discarded its whole report on any failing test; the lint gate
skipped root tests, scripts, and two workspaces; and several generated matrices
counted a host missing ffmpeg as a passing tool. Each now measures what it
claims.

Full evidence and the outstanding release items are tracked locally and are not
part of this branch.
2026-07-27 15:37:30 +08:00

7.6 KiB

description
description
PostgreSQL database schema, tables, migrations, and backup procedures for SnapOtter.

Database

SnapOtter uses PostgreSQL 17 with Drizzle ORM (pg-core / node-postgres) for data persistence. The schema is defined in apps/api/src/db/schema.ts.

The connection is configured via the DATABASE_URL environment variable (default postgres://snapotter:snapotter@postgres:5432/snapotter). In Docker Compose, the Postgres container stores its data in the SnapOtter-pgdata named volume.

Tables

users

Stores user accounts. Created automatically on first run from DEFAULT_USERNAME and DEFAULT_PASSWORD.

Column Type Notes
id uuid Primary key
username varchar Unique, required
passwordHash varchar scrypt hash
role varchar admin, editor, or user
mustChangePassword boolean Forced password reset flag
createdAt timestamp Creation time
updatedAt timestamp Last update time

sessions

Active login sessions. Each row ties a session token to a user.

Column Type Notes
id varchar Primary key (session token)
userId uuid Foreign key to users.id
expiresAt timestamp Expiry time
createdAt timestamp Creation time

teams

Groups for organizing users. Admins can assign users to teams.

Column Type Description
id uuid Primary key
name varchar (unique, max 50 chars) Team name
createdAt timestamp Creation time

api_keys

API keys for programmatic access. The raw key is shown once on creation; only the hash is stored.

Column Type Notes
id uuid Primary key
userId uuid Foreign key to users.id
keyHash varchar scrypt hash of the key
name varchar User-provided label
createdAt timestamp Creation time
lastUsedAt timestamp Updated on each authenticated request

Keys are prefixed with si_ followed by 96 hex characters (48 random bytes).

pipelines

Saved tool chains that users create in the UI.

Column Type Notes
id uuid Primary key
name varchar Pipeline name
description varchar Optional description
steps jsonb Array of { toolId, settings } objects
createdAt timestamp Creation time

user_files

Persistent file library. A saved edit is inserted as an independent root row by default ("save as new": version 1, parentId null, so the original stays listed), or as a parent-linked version when you overwrite the original (parentId set, version incremented, superseding it). The toolChain column records the tools applied.

Column Type Description
id uuid Primary key
userId uuid FK to users (CASCADE DELETE)
originalName varchar Original upload filename
storedName varchar Filename on disk
mimeType varchar MIME type
size integer File size in bytes
width integer Image width in px
height integer Image height in px
version integer Version number (1 = original)
parentId uuid or null FK to user_files (parent version)
toolChain jsonb Tool IDs applied in order to produce this version
createdAt timestamp Creation time

jobs

Tracks processing jobs for progress reporting and cleanup.

Column Type Notes
id uuid Primary key
type varchar Tool or pipeline identifier
status varchar queued, processing, completed, or failed
progress real 0.0-1.0 fraction
inputFiles jsonb Array of input file paths
outputPath varchar Path to the result file
settings jsonb Tool settings used
error varchar Error message if failed
createdAt timestamp Creation time
completedAt timestamp Completion time

settings

Key-value store for server-wide settings that admins can change from the UI.

Column Type Notes
key varchar Primary key
value varchar Setting value
updatedAt timestamp Last update time

roles

Custom roles with granular permissions.

Column Type Notes
id uuid Primary key
name varchar Unique role name
description varchar Optional description
permissions jsonb Array of permission strings
createdAt timestamp Creation time

audit_log

Security-relevant action log.

Column Type Notes
id uuid Primary key
userId uuid FK to users
action varchar Action type
details jsonb Action-specific data
createdAt timestamp Action time

user_preferences

Per-user UI state, keyed by preference name. Backs the dashboard's pinned tools through PUT /api/v1/preferences.

Column Type Notes
userId text FK to users, cascades on delete. Primary key with key
key text Preference name. Primary key with userId
value jsonb Preference payload
updatedAt timestamp Last write

Migrations

Drizzle handles schema migrations. Migration files live in apps/api/drizzle/. During development:

cd apps/api
npx drizzle-kit generate   # generate a migration from schema changes
npx drizzle-kit migrate    # apply pending migrations

In production, pending migrations are applied automatically on startup.

Backup and restore

The relational database lives in the Postgres container's SnapOtter-pgdata volume, not the app's /data volume.

Logical backup with validation (recommended)

# Dump into PostgreSQL's portable custom archive format
docker exec SnapOtter-postgres \
  pg_dump --format=custom --no-owner -U snapotter snapotter > snapotter.dump
test -s snapotter.dump
docker exec -i SnapOtter-postgres pg_restore --list < snapotter.dump >/dev/null

# Restore into a fresh/disposable target first and fail on the first SQL error
docker exec -i SnapOtter-postgres \
  pg_restore --exit-on-error --clean --if-exists --no-owner \
  -U snapotter -d snapotter < snapotter.dump

This database dump does not contain saved library objects in /data/files or durable BullMQ state in Redis. Back up and restore those with the coordinated procedure in Security & Hardening.

Cold volume snapshot

# Stop every service first, then use your storage platform to snapshot the
# PostgreSQL, app-data, and Redis volumes as one crash-consistent set.
docker compose -f docker/docker-compose.yml stop

Do not copy a live PostgreSQL data directory with tar. Compose prefixes volume names by project, so resolve the mounted volume IDs from docker inspect or your storage platform rather than assuming the literal label SnapOtter-pgdata.

Migrating from 1.x (SQLite)

Upgrading from SnapOtter 1.x has its own guide: see Upgrading from 1.x to 2.0. In short, reuse your existing /data volume and 2.0 auto-detects and imports /data/snapotter.db on first boot (or set SQLITE_MIGRATE_PATH to point at it explicitly). Back up the whole /data volume first, not just snapotter.db: 1.x uses SQLite WAL mode, so a stopped container often leaves most of its data in snapotter.db-wal beside an almost-empty snapotter.db.