AI Implementation feature(871): Admin Area System: Database Backup/Restore and Danger Zone (#61)

2026-07-23 12:10:41 +00:00
parent 6bac67fad7
commit 470ddd30c3
42 changed files with 3996 additions and 55 deletions
@@ -0,0 +1,38 @@
+---
+type: database
+title: Admin Operation Tokens Migration
+description: Forward-only migration that adds the `admin_operation_token` table and its indexes for destructive System-operation confirmation tokens.
+resource: backend/src/database/migrations/1700000000900-AddAdminOperationTokens.ts
+tags: [database, migration, admin, system, tokens]
+timestamp: 2026-07-23T12:04:50Z
+---
+
+# Purpose
+
+Adds the [admin_operation_token](/database/admin-operation-tokens.md)
+table that backs the destructive operations under
+`/api/v1/admin/system/*` (restore-backup, reset-scores,
+wipe-challenges). Always fresh on a new database; on existing instances
+the migration is a no-op if the table already exists.
+
+# Up
+
+1. `CREATE TABLE IF NOT EXISTS admin_operation_token` with the columns
+   listed in the [schema doc](/database/admin-operation-tokens.md#schema).
+2. `CREATE UNIQUE INDEX IF NOT EXISTS uq_admin_op_token_hash` on
+   `token_hash` to make one-shot use enforceable.
+3. `CREATE INDEX IF NOT EXISTS idx_admin_op_token_user_op` on
+   `(user_id, operation)` for fast per-admin lookup.
+4. `CREATE INDEX IF NOT EXISTS idx_admin_op_token_expiry` on
+   `expires_at` so the periodic purge can use an index scan.
+
+# Down
+
+Drops the indexes in reverse order and drops the table.
+
+# Wiring
+
+The migration is registered in
+`backend/src/database/database.module.ts` after the existing user
+triggers migration. The entity is registered in the same `ENTITIES`
+array so `forFeature` lets `AdminSystemModule` inject the repository.