Skip to content

Align dbscripts directory names with database names using underscores - #4149

Closed
indeewari wants to merge 1 commit into
thunder-id:mainfrom
indeewari:fix/4120-dbscripts-underscore-dirs
Closed

Align dbscripts directory names with database names using underscores#4149
indeewari wants to merge 1 commit into
thunder-id:mainfrom
indeewari:fix/4120-dbscripts-underscore-dirs

Conversation

@indeewari

@indeewari indeewari commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Purpose

The backend/dbscripts/ schema directories used kebab-case names (runtime-transient, runtime-persistent) while the Postgres database names and the config keys use underscores (runtime_transient, runtime_persistent).
Because the two forms differed, the Helm quickstart schema-apply loop, which reuses the database name as the directory path, resolved dbscripts/runtime_transient/ which does not exist. The failure was silent: cat errored to stderr while psql exited 0 on empty input, so the two runtime databases were left with zero tables and no error was reported.

This aligns the physical artifact names to underscores so the directory name equals the database name and the config key for all four databases, removing the mismatch at its source.


⚠️ Breaking Changes

🔧 Summary of Breaking Changes

The two runtime dbscripts/ directories and their SQLite files are renamed:

  • dbscripts/runtime-transient/ to dbscripts/runtime_transient/
  • dbscripts/runtime-persistent/ to dbscripts/runtime_persistent/
  • SQLite files runtime-transient.db / runtime-persistent.db to
    runtime_transient.db / runtime_persistent.db

Postgres database names and config keys are unchanged (already underscore).

💥 Impact

Existing SQLite deployments that use the default paths database/runtime-transient.db and database/runtime-persistent.db will, after this change, look for the underscore file names and create fresh empty databases if the old files are not renamed. Anyone applying schemas from an old dbscripts/ checkout by the kebab directory name must use the underscore names.

🔄 Migration Guide

For SQLite, rename the existing data files to runtime_transient.db and runtime_persistent.db, or point the configured paths at the old files. Postgres deployments need no change; the database names were already runtime_transient and runtime_persistent.

Documentation updates for the pages that still reference the kebab paths will
follow in a separate docs PR.

Related Issues

Related PRs

Checklist

  • Followed the contribution guidelines.
  • Manual test round performed and verified.
  • Documentation provided. (Follows in a separate docs PR)
    • Ran Vale and fixed all errors and warnings
  • Tests provided. (Existing suites updated and validated)
    • Unit Tests
    • Integration Tests
  • Breaking changes. (Fill if applicable)
    • Breaking changes section filled.
    • breaking change label added.

Security checks

  • Followed secure coding standards in WSO2 Secure Coding Guidelines
  • Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

  • New Features
    • Added persistent storage for SSO sessions, consent records, token revocations, audit history, and related authorization data.
    • Added transient storage for OAuth, CIBA, WebAuthn, PAR, replay-protection, and runtime data.
  • Performance
    • Improved expired-data cleanup through controlled batching, reducing lock duration during maintenance.
  • Bug Fixes
    • Standardized runtime database filenames and initialization paths across local, test, and deployed environments.

The dbscripts schema directories used kebab-case (runtime-transient,
runtime-persistent) while the Postgres database names and config keys use
underscores (runtime_transient, runtime_persistent). Because the two forms
differed, the Helm quickstart schema-apply loop resolved directory paths that
do not exist and silently left those two databases empty.

Rename the two dbscripts directories and their SQLite files to underscores so
the directory name matches the database name and config key for all four
databases, and update every reference: build scripts, integration test config,
Helm and OpenChoreo charts, the local-development compose source paths, and the
integration-test CI action. Kubernetes Secret data keys and the
container-internal compose mount aliases keep their kebab-case names, as those
belong to separate naming domains.

Fixes thunder-id#4120
@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Runtime transient and persistent databases now use underscore-separated names across schemas, cleanup procedures, initialization scripts, server configuration, Helm deployments, local development, and integration-test resources. New SQLite and PostgreSQL persistence schemas and batched PostgreSQL cleanup procedures are included.

Changes

Runtime database alignment

Layer / File(s) Summary
Runtime transient schemas
backend/dbscripts/runtime_transient/*
Adds SQLite and PostgreSQL tables and indexes for OAuth, CIBA, WebAuthn, PAR, JTI, and namespaced runtime storage.
Runtime transient cleanup
backend/dbscripts/runtime_transient/postgres-cleanup.sql
Adds batched expiry cleanup for regular and partitioned PostgreSQL tables.
Runtime persistent schemas
backend/dbscripts/runtime_persistent/*
Adds SQLite and PostgreSQL persistence for token revocation, SSO sessions, participants, consents, authorizations, and audit records.
Runtime persistent cleanup
backend/dbscripts/runtime_persistent/postgres-cleanup.sql
Adds batched cleanup for expired revoked tokens.
Database naming and wiring
backend/cmd/server/*, build.*, install/..., tests/integration/..., .github/actions/*
Replaces hyphenated runtime database directories and SQLite filenames with underscore-separated names across initialization and deployment paths.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

Suggested reviewers: darshanasbg, rajithacharith, brionmario, ayeshajay

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning Several copyright-header updates are unrelated to the schema-directory rename objective. Remove the incidental header-only edits or split them into a separate housekeeping PR.
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The rename and reference updates address #4120 by aligning runtime schema paths with the underscore database names.
Title check ✅ Passed The title is specific and accurately reflects the rename to underscore-based dbscript directory names.
Description check ✅ Passed The description is mostly complete and matches the template, though it omits a dedicated Approach section.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (3)
backend/dbscripts/runtime_persistent/postgres-cleanup.sql (1)

73-76: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Prevent concurrent cleanup runs from aborting prematurely.

If two cleanup runs overlap (e.g., a manual run overlaps with a scheduled run), both might SELECT the exact same batch of ctids. The first to execute the DELETE will succeed, while the second will block. When the first commits, the second will wake up, find the rows already deleted, and report v_deleted = 0, causing it to exit the loop prematurely even if there are more expired rows remaining.

To allow concurrent runs to safely process different batches without blocking or aborting each other, append FOR UPDATE SKIP LOCKED to the subquery.

🛠️ Proposed fix
         DELETE FROM "REVOKED_TOKEN"
         WHERE ctid IN (
-            SELECT ctid FROM "REVOKED_TOKEN" WHERE EXPIRY_TIME < v_now LIMIT p_batch_size
+            SELECT ctid FROM "REVOKED_TOKEN" WHERE EXPIRY_TIME < v_now LIMIT p_batch_size FOR UPDATE SKIP LOCKED
         );
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/dbscripts/runtime_persistent/postgres-cleanup.sql` around lines 73 -
76, Update the REVOKED_TOKEN cleanup DELETE subquery to lock selected expired
rows with FOR UPDATE SKIP LOCKED, ensuring overlapping cleanup runs process
separate batches without blocking or exiting prematurely. Preserve the existing
expiry filter and p_batch_size limit.
backend/dbscripts/runtime_persistent/postgres.sql (1)

92-102: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Standardize timestamp types across the schema.

The CONSENT table uses TIMESTAMPTZ and NOW(), whereas other tables in this schema (such as SSO_SESSION and REVOKED_TOKEN) use TIMESTAMP and CURRENT_TIMESTAMP. Consider using a consistent timestamp type and default function throughout the schema. Preferring TIMESTAMPTZ is generally recommended for PostgreSQL.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/dbscripts/runtime_persistent/postgres.sql` around lines 92 - 102,
Standardize the CONSENT table timestamp columns VALIDITY_TIME, CREATED_AT, and
UPDATED_AT on TIMESTAMPTZ with CURRENT_TIMESTAMP defaults, replacing the
inconsistent timestamp default usage while preserving the existing nullable and
column constraints.
backend/dbscripts/runtime_transient/postgres.sql (1)

90-113: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add a DEFAULT partition to RUNTIME_STORE.

RUNTIME_STORE is list-partitioned by NAMESPACE with no DEFAULT partition. Any insert whose NAMESPACE doesn't match one of the 11 listed values will hard-fail with "no partition of relation found for row" rather than degrading gracefully. Given this PR exists specifically to fix a schema/name mismatch that silently broke runtime DB initialization, a missed partition update (per the comment at line 101-102, adding a namespace constant "REQUIRES adding a matching partition here") is the same class of easy-to-miss oversight, but this time it would surface as a hard runtime failure instead of a quiet compile-time miss.

🛡️ Proposed fix: add a DEFAULT partition as a safety net
 CREATE TABLE "RUNTIME_STORE_VP_STATE"   PARTITION OF "RUNTIME_STORE" FOR VALUES IN ('vp:state');
+
+-- Safety net for any NAMESPACE value not yet covered by an explicit partition above.
+CREATE TABLE "RUNTIME_STORE_DEFAULT" PARTITION OF "RUNTIME_STORE" DEFAULT;
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/dbscripts/runtime_transient/postgres.sql` around lines 90 - 113, Add
a DEFAULT child partition for RUNTIME_STORE after the explicit namespace
partitions, preserving all existing namespace-specific partitions. Ensure
unmatched NAMESPACE values are routed to this fallback partition instead of
failing inserts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/cmd/server/config/default.json`:
- Line 48: The SQLite filename rename must preserve existing databases by
migrating or detecting the hyphenated filenames and updating configured paths
consistently. Apply this to backend/cmd/server/config/default.json lines 48-48
and 87-87; preserve both databases in backend/cmd/server/deployment.yaml lines
27-27 and 45-45; document or automate PVC migration in install/helm/values.yaml
lines 311-311 and 377-377; preserve storage in
install/openchoreo/helm/charts/thunderid-component/templates/thunderid-component.yaml
lines 81-81 and 85-85; document or automate migration in its values.yaml lines
52-52 and 58-58 and install/openchoreo/helm/values.yaml lines 70-70 and 76-76;
and preserve both databases in
install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml
lines 418-418 and 434-434.

In `@backend/internal/system/database/provider/dbprovider.go`:
- Around line 42-44: Update the relevant SQLite deployment documentation to
describe the migration from runtime-transient.db and runtime-persistent.db to
runtime_transient.db and runtime_persistent.db, including updating configured
deployment paths to match the renamed files.

In
`@install/openchoreo/helm/charts/thunderid-component/templates/thunderid-release.yaml`:
- Around line 76-80: Update the DB_RUNTIME_TRANSIENT_PATH and
DB_RUNTIME_PERSISTENT_PATH value references in the thunderid release template to
read from the nested database.runtime_transient.sqlite.path and
database.runtime_persistent.sqlite.path values, while preserving their existing
defaults and quoting.

---

Nitpick comments:
In `@backend/dbscripts/runtime_persistent/postgres-cleanup.sql`:
- Around line 73-76: Update the REVOKED_TOKEN cleanup DELETE subquery to lock
selected expired rows with FOR UPDATE SKIP LOCKED, ensuring overlapping cleanup
runs process separate batches without blocking or exiting prematurely. Preserve
the existing expiry filter and p_batch_size limit.

In `@backend/dbscripts/runtime_persistent/postgres.sql`:
- Around line 92-102: Standardize the CONSENT table timestamp columns
VALIDITY_TIME, CREATED_AT, and UPDATED_AT on TIMESTAMPTZ with CURRENT_TIMESTAMP
defaults, replacing the inconsistent timestamp default usage while preserving
the existing nullable and column constraints.

In `@backend/dbscripts/runtime_transient/postgres.sql`:
- Around line 90-113: Add a DEFAULT child partition for RUNTIME_STORE after the
explicit namespace partitions, preserving all existing namespace-specific
partitions. Ensure unmatched NAMESPACE values are routed to this fallback
partition instead of failing inserts.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 69bb2041-3290-4b8b-be05-4bf1e37e4978

📥 Commits

Reviewing files that changed from the base of the PR and between 756feff and 163cafb.

📒 Files selected for processing (25)
  • .github/actions/run-integration-tests/action.yml
  • backend/cmd/server/config/default.json
  • backend/cmd/server/deployment.yaml
  • backend/dbscripts/runtime_persistent/postgres-cleanup.sql
  • backend/dbscripts/runtime_persistent/postgres.sql
  • backend/dbscripts/runtime_persistent/sqlite.sql
  • backend/dbscripts/runtime_transient/postgres-cleanup.sql
  • backend/dbscripts/runtime_transient/postgres.sql
  • backend/dbscripts/runtime_transient/sqlite.sql
  • backend/internal/system/database/provider/dbprovider.go
  • backend/scripts/cleanup_runtime_transient_db.sh
  • backend/tests/resources/deployment.yaml
  • build.ps1
  • build.sh
  • install/helm/values.yaml
  • install/local-development/docker-compose.yml
  • install/openchoreo/helm/charts/thunderid-component/templates/thunderid-component.yaml
  • install/openchoreo/helm/charts/thunderid-component/templates/thunderid-release.yaml
  • install/openchoreo/helm/charts/thunderid-component/values.yaml
  • install/openchoreo/helm/values.yaml
  • install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml
  • tests/integration/resources/deployment.yaml
  • tests/integration/resources/scripts/setup-test-config.ps1
  • tests/integration/resources/scripts/setup-test-config.sh
  • tests/integration/testutils/test_utils.go

"type": "sqlite",
"sqlite": {
"path": "database/runtime-transient.db",
"path": "database/runtime_transient.db",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

The SQLite filename rename needs an upgrade migration or explicit guard. Existing deployments still contain the hyphenated files, so these new defaults can cause the application to create fresh databases and hide existing runtime data.

  • backend/cmd/server/config/default.json#L48-L48: migrate or detect database/runtime-transient.db.
  • backend/cmd/server/config/default.json#L87-L87: migrate or detect database/runtime-persistent.db.
  • backend/cmd/server/deployment.yaml#L27-L27: preserve the transient database during deployment upgrades.
  • backend/cmd/server/deployment.yaml#L45-L45: preserve the persistent database during deployment upgrades.
  • install/helm/values.yaml#L311-L311: document or automate migration for Helm SQLite PVCs.
  • install/helm/values.yaml#L377-L377: document or automate migration for Helm SQLite PVCs.
  • install/openchoreo/helm/charts/thunderid-component/templates/thunderid-component.yaml#L81-L81: preserve the transient database during workload upgrades.
  • install/openchoreo/helm/charts/thunderid-component/templates/thunderid-component.yaml#L85-L85: preserve the persistent database during workload upgrades.
  • install/openchoreo/helm/charts/thunderid-component/values.yaml#L52-L52: document or automate migration for component SQLite storage.
  • install/openchoreo/helm/charts/thunderid-component/values.yaml#L58-L58: document or automate migration for component SQLite storage.
  • install/openchoreo/helm/values.yaml#L70-L70: document or automate migration for OpenChoreo SQLite storage.
  • install/openchoreo/helm/values.yaml#L76-L76: document or automate migration for OpenChoreo SQLite storage.
  • install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml#L418-L418: preserve the transient database in generated deployments.
  • install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml#L434-L434: preserve the persistent database in generated deployments.

Based on PR objectives, existing SQLite deployments must rename their files or update configured paths.

📍 Affects 7 files
  • backend/cmd/server/config/default.json#L48-L48 (this comment)
  • backend/cmd/server/config/default.json#L87-L87
  • backend/cmd/server/deployment.yaml#L27-L27
  • backend/cmd/server/deployment.yaml#L45-L45
  • install/helm/values.yaml#L311-L311
  • install/helm/values.yaml#L377-L377
  • install/openchoreo/helm/charts/thunderid-component/templates/thunderid-component.yaml#L81-L81
  • install/openchoreo/helm/charts/thunderid-component/templates/thunderid-component.yaml#L85-L85
  • install/openchoreo/helm/charts/thunderid-component/values.yaml#L52-L52
  • install/openchoreo/helm/charts/thunderid-component/values.yaml#L58-L58
  • install/openchoreo/helm/values.yaml#L70-L70
  • install/openchoreo/helm/values.yaml#L76-L76
  • install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml#L418-L418
  • install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml#L434-L434
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/cmd/server/config/default.json` at line 48, The SQLite filename
rename must preserve existing databases by migrating or detecting the hyphenated
filenames and updating configured paths consistently. Apply this to
backend/cmd/server/config/default.json lines 48-48 and 87-87; preserve both
databases in backend/cmd/server/deployment.yaml lines 27-27 and 45-45; document
or automate PVC migration in install/helm/values.yaml lines 311-311 and 377-377;
preserve storage in
install/openchoreo/helm/charts/thunderid-component/templates/thunderid-component.yaml
lines 81-81 and 85-85; document or automate migration in its values.yaml lines
52-52 and 58-58 and install/openchoreo/helm/values.yaml lines 70-70 and 76-76;
and preserve both databases in
install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml
lines 418-418 and 434-434.

Comment on lines +42 to +44
dbNameRuntimeTransient = "runtime_transient"
dbNameEntity = "entity"
dbNameRuntimePersistent = "runtime-persistent"
dbNameRuntimePersistent = "runtime_persistent"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

🔴 Documentation Required
This PR introduces user-facing changes that are not covered by documentation updates under docs/.
Please update the relevant documentation before merging.

Missing documentation:

  • SQLite deployment migrations: update deployment guides to indicate that existing SQLite deployments must rename their runtime-transient.db and runtime-persistent.db files to runtime_transient.db and runtime_persistent.db, respectively, and update any configured paths in their deployment settings.

(As per path instructions: "Check whether this change introduces or modifies configuration options... post a single consolidated PR-level comment".)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/internal/system/database/provider/dbprovider.go` around lines 42 -
44, Update the relevant SQLite deployment documentation to describe the
migration from runtime-transient.db and runtime-persistent.db to
runtime_transient.db and runtime_persistent.db, including updating configured
deployment paths to match the renamed files.

Source: Path instructions

Comment on lines +76 to +80
value: {{ .Values.database.runtime_transient.path | default "database/runtime_transient.db" | quote }}
- key: DB_ENTITY_PATH
value: {{ .Values.database.entity.path | default "database/entitydb.db" | quote }}
- key: DB_RUNTIME_PERSISTENT_PATH
value: {{ .Values.database.runtime_persistent.path | default "database/runtime-persistent.db" | quote }}
value: {{ .Values.database.runtime_persistent.path | default "database/runtime_persistent.db" | quote }}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Read runtime SQLite paths from the nested values structure.

install/openchoreo/helm/charts/thunderid-component/values.yaml defines database.runtime_transient.sqlite.path and database.runtime_persistent.sqlite.path, but this template reads database.runtime_transient.path and database.runtime_persistent.path. Custom paths are therefore ignored and the defaults are always selected.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@install/openchoreo/helm/charts/thunderid-component/templates/thunderid-release.yaml`
around lines 76 - 80, Update the DB_RUNTIME_TRANSIENT_PATH and
DB_RUNTIME_PERSISTENT_PATH value references in the thunderid release template to
read from the nested database.runtime_transient.sqlite.path and
database.runtime_persistent.sqlite.path values, while preserving their existing
defaults and quoting.

@codecov

codecov Bot commented Jul 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@indeewari
indeewari added this pull request to the merge queue Jul 20, 2026
@rajithacharith
rajithacharith removed this pull request from the merge queue due to a manual request Jul 20, 2026
@indeewari

Copy link
Copy Markdown
Contributor Author

Superseded by #4164, which combines the code and documentation changes into a single PR targeting the release branch.

@indeewari indeewari closed this Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Helm quickstart: db schema init fails, dbscripts dir uses hyphens not underscores

2 participants