No description
Find a file
Alberto Martinez c5f9ac0563 Fix IAM v2 Liquibase migrate failure on deploy
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Problem

Coolify deploy built all images successfully but failed when the `migrate` job exited with code 1. The IAM changeset `005-iam-v2-roles-crud.sql` had already applied through `005g` on production; it failed at `005h-swap-roles`.

## Root cause

Changeset `005h` used `splitStatements:true` with `endDelimiter:;` while containing a `DO $$ ... END $$` block. Liquibase splits on every semicolon, which breaks PL/pgSQL blocks and causes the migrate step to fail.

Secondary risks on production data:
- Users without `role_id` after backfill (missing per-tenant `operativo` role)
- Multiple `tenant_admin` users in the same tenant (unique partial index would fail)

## Fix

1. **Move the unique-index `DO` block** to a new changeset `005h2-unique-tenant-admin` with `splitStatements:false`.
2. **Add changeset `005g2-ensure-role-backfill`** (new, safe for DBs that already ran `005g`):
   - Create `operativo` roles for every tenant that has users
   - Re-backfill any remaining `role_id`
   - Demote duplicate tenant admins to `operativo` (keep lowest `id` per tenant)
   - Remove orphan users without `tenant_id`

## Deploy

Merge to `main` and redeploy in Coolify. No manual SQL should be required if the DB stopped at `005h` as expected.

If migrate still fails, capture logs with:

```bash
docker logs migrate-pdyrt8ccp804tfmutefau0k6-<latest> 2>&1 | tail -100
```
<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a href="https://cursor.com/agents/bc-0da3751a-38ff-40ab-bba2-5df2322c8cda?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-0da3751a-38ff-40ab-bba2-5df2322c8cda&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>
2026-09-08 18:58:33 +00:00
.github/workflows api: --allow-sys para el SDK de AWS/R2 en Deno 2026-09-03 05:49:14 +00:00
api Implement client IAM v2: roles per tenant, CRUD matrix, scope, and panel UI 2026-09-08 18:16:59 +00:00
db Fix IAM v2 migrate: split DO block and harden role backfill 2026-09-08 18:57:19 +00:00
docs api: ping R2 con ListObjects, no HeadBucket 2026-09-03 05:42:13 +00:00
overlays compose: unir migrate y api a la red coolify 2026-09-03 05:25:53 +00:00
scripts test: validar endpoints y RPCs de gastos, almacén e IAM 2026-09-04 04:17:47 +00:00
tmp/pdfs Nominas 2026-08-25 20:21:49 -05:00
web first commit 2026-08-21 16:55:01 -05:00
web-panel Implement client IAM v2: roles per tenant, CRUD matrix, scope, and panel UI 2026-09-08 18:16:59 +00:00
web-saas refactor(core): migrate core CRUD to PostgreSQL RPC + unified HTTP errors 2026-09-04 02:34:43 +00:00
.dockerignore first commit 2026-08-21 16:55:01 -05:00
.env.example api: compatibilidad S3 con Cloudflare R2 (reemplazo de Contabo) 2026-09-03 04:40:54 +00:00
.gitignore first commit 2026-08-21 16:55:01 -05:00
docker-compose.yml compose: unir migrate y api a la red coolify 2026-09-03 05:25:53 +00:00
Dockerfile.api api: --allow-sys para el SDK de AWS/R2 en Deno 2026-09-03 05:49:14 +00:00
Dockerfile.migrate deploy: Liquibase automático en cada deploy (job migrate) 2026-09-03 04:54:15 +00:00
Dockerfile.provision db/infra: ETL de datos, backups y limpieza de despliegue (fase 5-7) 2026-09-02 21:05:07 +00:00
Dockerfile.web-panel first commit 2026-08-21 16:55:01 -05:00
Dockerfile.web-saas first commit 2026-08-21 16:55:01 -05:00
package.json ops: sacar el overlay local del glob docker-compose*.yml 2026-09-03 05:19:10 +00:00