chore: release v0.21.3

internal/db/db.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"embed"
 	"fmt"
+	"os"
 	"sort"
 	"strings"
 	"time"
@@ -143,7 +144,6 @@ func SetDialect(d string) {
 // same INSERT/UPDATE works on both backends.
 func NowISO() string { return time.Now().UTC().Format("2006-01-02T15:04:05.000Z") }
 
-
 // Open opens (and creates if needed) the SQLite database at the given path,
 // enables performance PRAGMAs, and applies embedded migrations.
 func Open(path string) (*sql.DB, error) {
@@ -161,18 +161,77 @@ func Open(path string) (*sql.DB, error) {
 		return nil, fmt.Errorf("ping sqlite: %w", err)
 	}
 	Dialect = "sqlite"
-	if err := migrate(conn, nil); err != nil {
+	if err := migrate(conn, nil, path); err != nil {
 		_ = conn.Close()
 		return nil, err
 	}
 	return conn, nil
 }
 
+// LogSink receives this package's diagnostic lines. The app points it at
+// applog.Printf at startup (same pattern as cat / audio / extsvc); left nil in
+// tests and in the CLI tools under cmd/, where it is simply discarded.
+var LogSink func(format string, args ...any)
+
+// logMigration records a migration that has just been applied, and how long it
+// took — the only trace an operator has that a data-rewriting migration ran.
+func logMigration(name string, start time.Time) {
+	logf("db: migration %s applied in %s", name, time.Since(start).Round(time.Millisecond))
+}
+
+func logf(format string, args ...any) {
+	if LogSink != nil {
+		LogSink(format, args...)
+	}
+}
+
+// dataRewriteMarker flags a migration that rewrites existing user rows rather
+// than only altering the schema. Put it on its own line in the .sql file, and a
+// safety copy of the logbook is taken before it runs.
+const dataRewriteMarker = "-- opslog:rewrites-data"
+
+// backupBeforeRewrite takes a one-off copy of the logbook before a migration
+// that rewrites user rows.
+//
+// It exists because the auto-updater gives the operator no say: the new build
+// relaunches and migrates before the changelog explaining it is ever shown, so
+// "back up first" is advice nobody can act on. The app takes the copy instead.
+//
+// Skipped when there is nothing to protect — a shared MySQL (no file to copy;
+// that server is the admin's to back up), the settings database, and a
+// freshly-created empty logbook all have no QSOs at stake.
+func backupBeforeRewrite(conn *sql.DB, dbPath, migration string) {
+	if dbPath == "" {
+		return
+	}
+	var n int
+	if err := conn.QueryRow(`SELECT COUNT(*) FROM qso`).Scan(&n); err != nil || n == 0 {
+		return
+	}
+	dest := dbPath + ".pre-" + strings.TrimSuffix(migration, ".sql") + ".bak"
+	if _, err := os.Stat(dest); err == nil {
+		return // a copy from an earlier attempt is already there — never overwrite it
+	}
+	// VACUUM INTO rather than copying the file: it writes a consistent,
+	// self-contained snapshot even with WAL pages still outstanding, which a
+	// plain file copy would silently miss. It cannot run inside a transaction,
+	// so it happens here, before the migration opens one. The destination is
+	// spliced (VACUUM INTO takes no bound parameter), with quotes doubled.
+	start := time.Now()
+	if _, err := conn.Exec(`VACUUM INTO '` + strings.ReplaceAll(dest, "'", "''") + `'`); err != nil {
+		// Not fatal: the migration itself is a single atomic transaction, so
+		// failing to take a belt-and-braces copy is no reason to block the update.
+		logf("db: could not back up before %s: %v — continuing (the migration is atomic)", migration, err)
+		return
+	}
+	logf("db: backed up %d QSO(s) to %s in %s before %s", n, dest, time.Since(start).Round(time.Millisecond), migration)
+}
+
 // migrate applies all embedded *.sql migrations in alphabetical order,
 // skipping those already applied. Intentionally minimal in-house system
 // (no external dependency). translate, when non-nil, rewrites each statement
 // for a non-SQLite backend (see mysqlDDL); nil means run the SQLite DDL as-is.
-func migrate(conn *sql.DB, translate func(string) string) error {
+func migrate(conn *sql.DB, translate func(string) string, dbPath string) error {
 	// A non-nil translator means this is the MySQL connection (use the
 	// per-statement, FK-aware path); nil means a SQLite connection. This is
 	// determined by the caller's argument, NOT the global Dialect, so the
@@ -219,12 +278,22 @@ func migrate(conn *sql.DB, translate func(string) string) error {
 		if applied[name] {
 			continue // already applied
 		}
+		// Timed, and logged only once it has actually succeeded (below). Most
+		// migrations are instant DDL, but some rewrite user rows — 0024 upper-cases
+		// every callsign — and on a large logbook that is exactly what an operator
+		// wants confirmed afterwards: that it ran, once, and what it cost.
+		start := time.Now()
 		content, err := migrationsFS.ReadFile("migrations/" + name)
 		if err != nil {
 			return fmt.Errorf("read migration %s: %w", name, err)
 		}
 		sqlText := translate(string(content))
 
+		// A migration that rewrites user rows gets a safety copy taken first.
+		if strings.Contains(string(content), dataRewriteMarker) {
+			backupBeforeRewrite(conn, dbPath, name)
+		}
+
 		// MySQL implicitly commits each DDL statement, so a wrapping transaction
 		// gives no atomicity — a mid-file failure would leave columns/tables
 		// behind, unrecorded, and every restart would re-run and choke on
@@ -238,6 +307,7 @@ func migrate(conn *sql.DB, translate func(string) string) error {
 			if _, err := conn.Exec(`INSERT INTO schema_migrations(name) VALUES(?)`, name); err != nil {
 				return fmt.Errorf("record migration %s: %w", name, err)
 			}
+			logMigration(name, start)
 			continue
 		}
 
@@ -257,6 +327,7 @@ func migrate(conn *sql.DB, translate func(string) string) error {
 		if err := tx.Commit(); err != nil {
 			return fmt.Errorf("commit migration %s: %w", name, err)
 		}
+		logMigration(name, start)
 	}
 	return nil
 }