fix(projects): recognize completed rollout without its marker

Author: mzxchandra

apps/sim/lib/billing/organizations/lock-order.test.ts

@@ -235,7 +235,7 @@ describe('workspace payer-change transaction lock ordering', () => {
       return chain
     }
     const tx = {
-      execute: async () => [],
+      execute: async () => [{ marker: true, complete: false }],
       select,
       selectDistinct: select,
       insert: () => ({

apps/sim/lib/projects/__integration__/foundation.integration.ts

@@ -314,6 +314,60 @@ afterAll(async () => {
 })
 
 describe('Project foundation at the database and application boundary', () => {
+  check(
+    'completed contraction needs no rollout marker, but incomplete schemas fail closed',
+    async () => {
+      const f = await fixture(false, 1)
+      const rollback = new Error('Restore expansion schema after contraction proof')
+      await expect(
+        db.transaction(async (tx) => {
+          await tx.execute(sql`LOCK TABLE workspace IN ACCESS EXCLUSIVE MODE NOWAIT`)
+          await tx.execute(sql`DROP TABLE project_membership_rollout`)
+          await expect(getProjectMembershipPhase(tx)).rejects.toThrow('authority is missing')
+          await tx.execute(sql`DROP TABLE project_workspace`)
+          await expect(getProjectMembershipPhase(tx)).rejects.toThrow('authority is missing')
+          await tx.execute(sql`ALTER TABLE workspace ALTER COLUMN project_id SET NOT NULL`)
+          await expect(getProjectMembershipPhase(tx)).rejects.toThrow('authority is missing')
+          await tx.execute(sql`ALTER TABLE project ADD COLUMN organization_scope_key text
+        GENERATED ALWAYS AS (CASE WHEN organization_id IS NULL THEN 'personal' ELSE 'organization:' || organization_id END) STORED`)
+          await tx.execute(sql`ALTER TABLE workspace ADD COLUMN organization_scope_key text
+        GENERATED ALWAYS AS (CASE WHEN organization_id IS NULL THEN 'personal' ELSE 'organization:' || organization_id END) STORED`)
+          await tx.execute(
+            sql`ALTER TABLE project ADD CONSTRAINT project_id_organization_scope_unique UNIQUE (id, organization_scope_key)`
+          )
+          await tx.execute(
+            sql`ALTER TABLE workspace ADD CONSTRAINT workspace_id_project_unique UNIQUE (id, project_id)`
+          )
+          await tx.execute(sql`ALTER TABLE workspace ADD CONSTRAINT workspace_project_organization_fk
+        FOREIGN KEY (project_id, organization_scope_key) REFERENCES project(id, organization_scope_key) DEFERRABLE INITIALLY DEFERRED`)
+          await tx.execute(sql`ALTER TABLE workspace ADD CONSTRAINT workspace_fork_project_fk
+        FOREIGN KEY (forked_from_workspace_id, project_id) REFERENCES workspace(id, project_id) DEFERRABLE INITIALLY DEFERRED`)
+          await tx.execute(
+            sql`ALTER TABLE workspace VALIDATE CONSTRAINT workspace_project_id_project_id_fk`
+          )
+          expect(await getProjectMembershipPhase(tx)).toBe('column')
+          const created = await createWorkspaceInTransaction(tx, {
+            userId: f.ownerId,
+            name: 'After contraction',
+            organizationId: null,
+            observedOrganizationId: null,
+            governingPermissionGroupOrganizationId: null,
+            workspaceMode: 'personal',
+            billedAccountUserId: f.ownerId,
+            skipDefaultWorkflow: true,
+          })
+          const environments = await getProjectEnvironmentSource(tx)
+          const [row] = await tx
+            .select({ projectId: environments.projectId })
+            .from(environments)
+            .where(eq(environments.id, created.id))
+          expect(row.projectId).toEqual(expect.any(String))
+          throw rollback
+        })
+      ).rejects.toBe(rollback)
+    }
+  )
+
   for (const phase of ['connector', 'column'] as const) {
     check(`workspace creation and fork/disconnect use only ${phase} authority`, async () => {
       setProjectsEnabled(false)

apps/sim/lib/projects/environment-source.ts

@@ -39,6 +39,20 @@ export async function getProjectMembershipPhase(
   tx: DbTransaction
 ): Promise<'connector' | 'column'> {
   await lockProjectMembershipBarrier(tx)
+  const [schema] = await tx.execute<{ marker: boolean; complete: boolean }>(sql`
+    SELECT to_regclass('public.project_membership_rollout') IS NOT NULL AS marker,
+      to_regclass('public.project_workspace') IS NULL
+      AND EXISTS (SELECT 1 FROM pg_attribute WHERE attrelid = 'public.workspace'::regclass
+        AND attname = 'project_id' AND attnotnull AND NOT attisdropped)
+      AND (SELECT count(*) = 3 FROM pg_constraint
+        WHERE conrelid = 'public.workspace'::regclass AND contype = 'f' AND convalidated
+        AND conname IN ('workspace_project_id_project_id_fk',
+          'workspace_project_organization_fk', 'workspace_fork_project_fk')) AS complete
+  `)
+  if (!schema?.marker) {
+    if (schema?.complete) return 'column'
+    throw new Error('Project membership authority is missing or invalid')
+  }
   const [state] = await tx
     .select({ phase: projectMembershipRollout.phase })
     .from(projectMembershipRollout)

packages/db/PROJECT_MEMBERSHIP.md

@@ -42,14 +42,16 @@ deferred timing after fresh schema push because Drizzle does not represent that
    only for unassigned legacy rows. It performs no bulk membership backfill.
 2. After verifying incompatible membership-sensitive requests/workers have drained,
    #8590 switches authority, performs bounded backfill/reconciliation, validates native
-   constraints, requires membership, and retires the connector. Its migration runs
+   constraints, requires membership, and retires the connector and authority marker atomically. Its migration runs
    while #8830 is serving, before the new app is promoted.
 
 The all-at-once traffic switch stops fresh requests to retired app servers. Remaining
 in-flight operations and independently scheduled workers must be identified explicitly.
 No new infrastructure maintenance mechanism, synchronization triggers, dual writes, or
 extra compatibility release is required. After authority switches, #8830 is the oldest
-supported application rollback; retain the column-phase marker and database changes.
+supported application rollback; retain the database changes. #8830 recognizes the completed schema (no connector or
+marker, required membership, and validated foreign keys) as column authority; a missing
+marker before completion remains an error. This supersedes retaining the marker for rollback.
 
 On PostgreSQL 16/17, adding stored generated scope columns rewrites their tables. The
 finalizer bounds the rewrite and refuses busy tables without waiting. A timeout leaves

packages/db/schema.ts

@@ -2122,7 +2122,7 @@ export const project = pgTable(
   })
 )
 
-/** Durable authority selection; retained after connector retirement for expansion rollback. */
+/** contract-pending(after #8830 is fully deployed): #8590 drops this with the connector; readers recognize the completed schema. */
 export const projectMembershipRollout = pgTable(
   'project_membership_rollout',
   {

packages/testing/src/mocks/database.mock.ts

@@ -244,7 +244,18 @@ const update = chainSpy()
 const set = chainSpy()
 const del = chainSpy()
 const returning = vi.fn(() => Promise.resolve([] as unknown[]))
-const execute = vi.fn(() => Promise.resolve([] as unknown[]))
+const execute = vi.fn((statement?: unknown) => {
+  if (
+    statement &&
+    typeof statement === 'object' &&
+    'toSQL' in statement &&
+    typeof statement.toSQL === 'function' &&
+    statement.toSQL().sql.includes("to_regclass('public.project_membership_rollout')")
+  ) {
+    return Promise.resolve([{ marker: true, complete: false }] as unknown[])
+  }
+  return Promise.resolve([] as unknown[])
+})
 const query = vi.fn(() => Promise.resolve([] as unknown[]))
 const onConflictDoUpdate = vi.fn(() => ({ returning }) as unknown as Promise<void>)
 const onConflictDoNothing = vi.fn(() => ({ returning }) as unknown as Promise<void>)