From 997142657597758059fe416a659b7b2549f80f8b Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 11 Jul 2026 06:51:29 +0000 Subject: [PATCH] =?UTF-8?q?feat(admin):=20bind=20ADMIN=5FDB=20=E2=80=94=20?= =?UTF-8?q?Phase-3=20storage=20provisioned=20and=20applied?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Operator-authorized ('provision: go'). The wcjbt-admin D1 database now exists (region ENAM), migration 0001_admin_storage applied remotely, and all four tables + five indexes verified against the live database. wrangler.jsonc gains the ADMIN_DB binding with its own migrations-admin dir; a wrangler dry-run confirms the full binding map resolves. The schema header is trued up from draft to provisioned, keeping the three recreate steps for downstream AGPL deployers. Deliberately separate from the wcjbt-auth store: moderation casework and content staging carry a different retention and legal posture than sign-in state. No code path reads these tables yet — the Phase-3+ server slices land against them next, starting with the insert-only tripwire test for admin_action_audit (mirroring the 0002 audit contract). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01LVPyHAtQ1cdK76RpFasafP --- migrations-admin/0001_admin_storage.sql | 17 ++++++++--------- wrangler.jsonc | 8 +++++++- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/migrations-admin/0001_admin_storage.sql b/migrations-admin/0001_admin_storage.sql index a57f7da4..23a00b8d 100644 --- a/migrations-admin/0001_admin_storage.sql +++ b/migrations-admin/0001_admin_storage.sql @@ -1,15 +1,14 @@ --- 0001_admin_storage.sql — DRAFT (admin-panel Phase 3): the ADMIN_DB schema. +-- 0001_admin_storage.sql — admin-panel Phase 3: the ADMIN_DB schema. -- --- ⚠ NOT YET PROVISIONED OR BOUND. This file is the reviewable spec for the --- separate ADMIN_DB database the admin-panel spec calls for. Nothing reads it --- yet: there is no ADMIN_DB binding in wrangler.jsonc and no code path touches --- these tables. It lands first so the schema is reviewed as code BEFORE any --- resource exists. To bring it live (operator, after review): +-- PROVISIONED AND BOUND for this deployment (operator-authorized 2026-07-11): +-- database `wcjbt-admin`, bound as ADMIN_DB in wrangler.jsonc, this migration +-- applied remotely and the resulting tables/indexes verified. The schema was +-- reviewed as code (PR #53) BEFORE the resource was created. No code path +-- reads these tables yet — the Phase-3+ server slices land against them next. -- +-- Downstream deployers (this is AGPL software — run your own instance): -- 1. npx wrangler d1 create wcjbt-admin --- 2. add to wrangler.jsonc d1_databases: --- { "binding": "ADMIN_DB", "database_name": "wcjbt-admin", --- "database_id": "", "migrations_dir": "migrations-admin" } +-- 2. paste the returned database_id into the ADMIN_DB entry in wrangler.jsonc -- 3. npx wrangler d1 migrations apply wcjbt-admin --remote -- -- WHY A SEPARATE DATABASE (not more tables in wcjbt-auth): the runtime roster + diff --git a/wrangler.jsonc b/wrangler.jsonc index 97d691e0..d01d0fed 100644 --- a/wrangler.jsonc +++ b/wrangler.jsonc @@ -27,7 +27,13 @@ { "binding": "ADMIN_SESSIONS", "id": "b250155143e348cba5a22b69024f677a" } ], "d1_databases": [ - { "binding": "DB", "database_name": "wcjbt-auth", "database_id": "d3240389-b265-4229-bff0-b8ab94c4d78d", "migrations_dir": "migrations" } + { "binding": "DB", "database_name": "wcjbt-auth", "database_id": "d3240389-b265-4229-bff0-b8ab94c4d78d", "migrations_dir": "migrations" }, + // Admin panel (Phase 3): moderation cases/labels, action audit, catalog-edit + // staging — deliberately SEPARATE from the auth store (different domain, + // retention, and legal posture; see migrations-admin/0001_admin_storage.sql). + // To recreate on a different account: `npx wrangler d1 create wcjbt-admin`, + // paste the returned id here, then `npx wrangler d1 migrations apply wcjbt-admin --remote`. + { "binding": "ADMIN_DB", "database_name": "wcjbt-admin", "database_id": "08f3ad34-45d4-4d97-a614-d8f9a6684270", "migrations_dir": "migrations-admin" } ], // Native per-colo rate limiter for the unauthenticated sign-in endpoints