PR Custody

feat: drop project API key allowed_ips column

@shamsharoonchecks n/achecks…codex/drop-project-api-key-allowed-ips-column → master7 files · +241 −2review: @abir-taheerreview: @anshugarg15updated 4d ago

GitHub

▸Description · 1 noise

Summary

remove project API key allowedIps from the Prisma ApiKey model
keep APIKeyItem.allowedIps explicit because responses still expose the allowlist from project_api_key_allowed_ips
add Liquibase v102 to drop project_api_keys.allowed_ips after verifying the join-table invariant

Migration behavior

up.ts runs in a transaction
if project_api_keys.allowed_ips does not exist, it commits and skips
before dropping, it compares sorted/deduped active-key IPs in allowed_ips vs project_api_key_allowed_ips
if any active key differs, it throws and rolls back before dropping anything
down.ts runs in a transaction, re-adds allowed_ips, and backfills it from project_api_key_allowed_ips

Stack order

depends on #10484, which stops app reads/writes of the legacy column
this PR stays stacked on #10484 so staging can run the runtime change before the column is dropped
deploy this only after #10484 has been deployed and observed cleanly in the same environment

Validation

pnpm --dir packages/db db:generate
bun build packages/db/liquibase/migrations/v102_drop_project_api_key_allowed_ips_column/up.ts --target bun --outfile /tmp/v102-up.js
bun build packages/db/liquibase/migrations/v102_drop_project_api_key_allowed_ips_column/down.ts --target bun --outfile /tmp/v102-down.js
node JSON parse check for Liquibase changelogs
pnpm exec oxfmt --check on touched files
git diff --check
pnpm --dir apps/apollo exec vitest run --config vitest.unit.config.ts src/lib/apiKeys/dbUtils/resolve_allowed_ips.unit.test.ts

▸ 1 bot/status comment hidden

@github-actions[bot]1w ago

OpenAPI Changelog (Production)

❌ Breaking changes

loading diff…