From a9fbca232da3775b40fe6dad896fba59188ab571 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Tue, 8 Sep 2026 18:57:19 +0000
Subject: [PATCH] Fix IAM v2 migrate: split DO block and harden role backfill

The migrate job failed at changeset 005h during Coolify deploy. Liquibase
was splitting the DO $$ block on inner semicolons (splitStatements:true),
which breaks PL/pgSQL. Move the unique-index DO block to 005h2 with
splitStatements:false.

Add 005g2 to create missing operativo roles per tenant, backfill any
remaining role_id values, demote duplicate tenant_admin users to operativo,
and remove orphan users without tenant_id before SET NOT NULL.

Co-authored-by: alberto.martinez <alberto.martinez@mrdev.mx>
---
 db/iam/changesets/005-iam-v2-roles-crud.sql | 44 +++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/db/iam/changesets/005-iam-v2-roles-crud.sql b/db/iam/changesets/005-iam-v2-roles-crud.sql
index 1ae4e78..a1aa6a4 100644
--- a/db/iam/changesets/005-iam-v2-roles-crud.sql
+++ b/db/iam/changesets/005-iam-v2-roles-crud.sql
@@ -230,6 +230,49 @@ FROM iam.roles_v2 sr
 WHERE u.role_id IS NULL
   AND sr.code = 'operativo' AND sr.tenant_id = u.tenant_id;
 
+--changeset panel:iam-005g2-ensure-role-backfill endDelimiter:; splitStatements:true
+--preconditions onFail:MARK_RAN
+--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.columns WHERE table_schema='iam' AND table_name='roles' AND column_name='id'
+INSERT INTO iam.roles_v2 (tenant_id, code, label, is_system)
+SELECT DISTINCT u.tenant_id, 'operativo', 'Operativo', false
+FROM iam.users u
+WHERE u.tenant_id IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1 FROM iam.roles_v2 r
+    WHERE r.tenant_id = u.tenant_id AND r.code = 'operativo'
+  );
+
+UPDATE iam.users u
+SET role_id = sr.id
+FROM iam.roles_v2 sr
+WHERE u.role_code = 'tenant_admin'
+  AND sr.code = 'tenant_admin' AND sr.is_system AND sr.tenant_id IS NULL
+  AND u.role_id IS NULL;
+
+UPDATE iam.users u
+SET role_id = sr.id
+FROM iam.roles_v2 sr
+WHERE u.role_id IS NULL
+  AND u.tenant_id IS NOT NULL
+  AND sr.code = 'operativo' AND sr.tenant_id = u.tenant_id;
+
+UPDATE iam.users u
+SET role_id = op.id
+FROM iam.roles_v2 sr, iam.roles_v2 op
+WHERE u.role_id = sr.id
+  AND sr.code = 'tenant_admin' AND sr.is_system AND sr.tenant_id IS NULL
+  AND u.tenant_id IS NOT NULL
+  AND op.code = 'operativo' AND op.tenant_id = u.tenant_id
+  AND u.id <> (
+    SELECT MIN(u2.id)
+    FROM iam.users u2
+    JOIN iam.roles_v2 sr2 ON sr2.id = u2.role_id
+    WHERE u2.tenant_id = u.tenant_id
+      AND sr2.code = 'tenant_admin' AND sr2.is_system AND sr2.tenant_id IS NULL
+  );
+
+DELETE FROM iam.users WHERE role_id IS NULL AND tenant_id IS NULL;
+
 --changeset panel:iam-005h-swap-roles endDelimiter:; splitStatements:true
 --preconditions onFail:MARK_RAN
 --precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.columns WHERE table_schema='iam' AND table_name='roles' AND column_name='id'
@@ -251,6 +294,7 @@ ALTER TABLE iam.users
 
 ALTER TABLE iam.users ALTER COLUMN role_id SET NOT NULL;
 
+--changeset panel:iam-005h2-unique-tenant-admin splitStatements:false
 DO $$
 DECLARE
   v_admin_role_id bigint;