You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
251 lines
12 KiB
251 lines
12 KiB
-- Roll a MySQL/MariaDB database back to the schema the Vaultwarden version *before* the Custom-role
|
|
-- change expects, so that older binary starts again. Read README.md in this directory first --
|
|
-- it lists exactly what is lost and how to run this safely.
|
|
--
|
|
-- NOTE: MySQL/MariaDB commit every DDL statement implicitly, so this script cannot be wrapped in a
|
|
-- transaction. That is exactly why everything below the precondition has to be reached in a known
|
|
-- state: an ALTER that fails halfway leaves every earlier statement committed. Take a backup before
|
|
-- running it; if it is interrupted, restore and start over.
|
|
|
|
-- ---------------------------------------------------------------------------------------------
|
|
-- Precondition. Read-only and session-local: reads `information_schema` and the ledger, prints the
|
|
-- reason when the database does not fit, and aborts on a duplicate key in a TEMPORARY table. No
|
|
-- permanent object is touched, so a database this script does not fit keeps its exact state -- which
|
|
-- matters because DDL here cannot be rolled back. Without it a partially upgraded database would get
|
|
-- through several committed statements before failing on error 1091, ending up *less* consistent.
|
|
--
|
|
-- Deliberately not a stored procedure with SIGNAL: MySQL caps `MESSAGE_TEXT` at 128 characters and
|
|
-- answers a longer one with error 1648 instead of the diagnosis (MariaDB accepts it, so the
|
|
-- difference is easy to miss), and CREATE PROCEDURE is a permanent object that would have to be
|
|
-- written before the checks run.
|
|
-- ---------------------------------------------------------------------------------------------
|
|
CREATE TEMPORARY TABLE __vw_rollback_precondition (
|
|
ok INTEGER NOT NULL PRIMARY KEY
|
|
);
|
|
INSERT INTO __vw_rollback_precondition (ok) VALUES (1);
|
|
|
|
-- 1) Membership `access_all` has to be gone already, i.e. the upgrade ran and this script did not.
|
|
SELECT CONCAT(
|
|
'REFUSED, nothing was changed: users_organizations.access_all still exists. This database was ',
|
|
'either never upgraded past the Custom-role migrations, or this script already ran.'
|
|
) AS rollback_precondition_failure
|
|
FROM information_schema.columns
|
|
WHERE table_schema = DATABASE()
|
|
AND table_name = 'users_organizations'
|
|
AND column_name = 'access_all';
|
|
INSERT INTO __vw_rollback_precondition (ok)
|
|
SELECT 1
|
|
FROM information_schema.columns
|
|
WHERE table_schema = DATABASE()
|
|
AND table_name = 'users_organizations'
|
|
AND column_name = 'access_all';
|
|
|
|
-- 2) All nine permission columns have to be present.
|
|
SELECT CONCAT(
|
|
'REFUSED, nothing was changed: expected all nine Custom-role permission columns on ',
|
|
'users_organizations, found ', c.n, '. The upgrade is incomplete, so restore the backup taken ',
|
|
'before it and start over.'
|
|
) AS rollback_precondition_failure
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM information_schema.columns
|
|
WHERE table_schema = DATABASE()
|
|
AND table_name = 'users_organizations'
|
|
AND column_name IN (
|
|
'manage_users', 'manage_groups', 'manage_policies',
|
|
'create_new_collections', 'edit_any_collection', 'delete_any_collection',
|
|
'access_event_logs', 'access_import_export', 'access_reports'
|
|
)
|
|
) AS c
|
|
WHERE c.n <> 9;
|
|
INSERT INTO __vw_rollback_precondition (ok)
|
|
SELECT 1
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM information_schema.columns
|
|
WHERE table_schema = DATABASE()
|
|
AND table_name = 'users_organizations'
|
|
AND column_name IN (
|
|
'manage_users', 'manage_groups', 'manage_policies',
|
|
'create_new_collections', 'edit_any_collection', 'delete_any_collection',
|
|
'access_event_logs', 'access_import_export', 'access_reports'
|
|
)
|
|
) AS c
|
|
WHERE c.n <> 9;
|
|
|
|
-- 3) The Custom-role migration has to be recorded.
|
|
SELECT CONCAT(
|
|
'REFUSED, nothing was changed: expected the Custom-role migration in ',
|
|
'__diesel_schema_migrations, found ', c.n, '. Schema and ledger disagree, so restore the backup ',
|
|
'taken before the upgrade and start over.'
|
|
) AS rollback_precondition_failure
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM __diesel_schema_migrations
|
|
WHERE version IN (
|
|
'20260630120000'
|
|
)
|
|
) AS c
|
|
WHERE c.n <> 1;
|
|
INSERT INTO __vw_rollback_precondition (ok)
|
|
SELECT 1
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM __diesel_schema_migrations
|
|
WHERE version IN (
|
|
'20260630120000'
|
|
)
|
|
) AS c
|
|
WHERE c.n <> 1;
|
|
|
|
-- 4) No migration newer than the Custom-role change may be recorded: this script does not know what
|
|
-- such a migration changed, and removing only the one version below would leave the ledger
|
|
-- claiming a migration whose schema objects this script may have undone.
|
|
SELECT CONCAT(
|
|
'REFUSED, nothing was changed: ', c.n, ' migration(s) newer than the Custom-role change are ',
|
|
'recorded. Use the rollback script shipped with that newer version.'
|
|
) AS rollback_precondition_failure
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM __diesel_schema_migrations
|
|
WHERE version > '20260630120000'
|
|
) AS c
|
|
WHERE c.n <> 0;
|
|
INSERT INTO __vw_rollback_precondition (ok)
|
|
SELECT 1
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM __diesel_schema_migrations
|
|
WHERE version > '20260630120000'
|
|
) AS c
|
|
WHERE c.n <> 0;
|
|
|
|
-- 5) Which memberships come back as legacy Manager has to be decided for *this* rollback. An empty
|
|
-- list is a valid answer and maps every Custom member to plain User.
|
|
SELECT CONCAT(
|
|
'REFUSED, nothing was changed: __vw_rollback_manager_allowlist does not exist. See README.md, ',
|
|
'section "Choosing which members come back as Manager".'
|
|
) AS rollback_precondition_failure
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM information_schema.tables
|
|
WHERE table_schema = DATABASE()
|
|
AND table_name = '__vw_rollback_manager_allowlist'
|
|
) AS c
|
|
WHERE c.n <> 1;
|
|
INSERT INTO __vw_rollback_precondition (ok)
|
|
SELECT 1
|
|
FROM (
|
|
SELECT COUNT(*) AS n
|
|
FROM information_schema.tables
|
|
WHERE table_schema = DATABASE()
|
|
AND table_name = '__vw_rollback_manager_allowlist'
|
|
) AS c
|
|
WHERE c.n <> 1;
|
|
|
|
-- 7) ...and it has to have the shape the role mapping reads: exactly one non-nullable, uniquely
|
|
-- indexed CHAR(36) `users_organizations_uuid`. A colliding table would otherwise pass every check
|
|
-- above and fail on the first SELECT, *after* the `ADD COLUMN` below has committed implicitly. The
|
|
-- type is part of the authorization boundary: MySQL/MariaDB compare a character UUID against a
|
|
-- numeric allowlist as numbers, so an INT value such as 0 could match unrelated UUIDs.
|
|
SELECT CONCAT(
|
|
'REFUSED, nothing was changed: __vw_rollback_manager_allowlist must have exactly one column ',
|
|
'named users_organizations_uuid, typed CHAR(36), NOT NULL and uniquely indexed. Create it as ',
|
|
'documented in README.md.'
|
|
) AS rollback_precondition_failure
|
|
FROM (
|
|
SELECT
|
|
(SELECT COUNT(*) FROM information_schema.columns
|
|
WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist') AS cols,
|
|
(SELECT COUNT(*) FROM information_schema.columns
|
|
WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist'
|
|
AND column_name = 'users_organizations_uuid'
|
|
AND data_type = 'char' AND character_maximum_length = 36
|
|
AND is_nullable = 'NO') AS usable,
|
|
(SELECT COUNT(*) FROM information_schema.statistics
|
|
WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist'
|
|
AND column_name = 'users_organizations_uuid' AND non_unique = 0) AS uniq
|
|
) AS c
|
|
WHERE c.cols <> 1 OR c.usable <> 1 OR c.uniq < 1;
|
|
INSERT INTO __vw_rollback_precondition (ok)
|
|
SELECT 1
|
|
FROM (
|
|
SELECT
|
|
(SELECT COUNT(*) FROM information_schema.columns
|
|
WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist') AS cols,
|
|
(SELECT COUNT(*) FROM information_schema.columns
|
|
WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist'
|
|
AND column_name = 'users_organizations_uuid'
|
|
AND data_type = 'char' AND character_maximum_length = 36
|
|
AND is_nullable = 'NO') AS usable,
|
|
(SELECT COUNT(*) FROM information_schema.statistics
|
|
WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist'
|
|
AND column_name = 'users_organizations_uuid' AND non_unique = 0) AS uniq
|
|
) AS c
|
|
WHERE c.cols <> 1 OR c.usable <> 1 OR c.uniq < 1;
|
|
|
|
-- `DROP TEMPORARY TABLE`, not `DROP TABLE`: the latter is one more statement that commits implicitly,
|
|
-- and it would happily drop a permanent table of the same name.
|
|
DROP TEMPORARY TABLE __vw_rollback_precondition;
|
|
|
|
-- ---------------------------------------------------------------------------------------------
|
|
-- From here on the database is known to be in the state this script converts *from*.
|
|
-- ---------------------------------------------------------------------------------------------
|
|
|
|
ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE;
|
|
|
|
-- Only a membership on the allowlist comes back as Manager; everything else becomes a plain User and
|
|
-- keeps its per-collection assignments. The legacy role is not a subset of what a Custom member
|
|
-- holds, so handing it out on less than a current, deliberate decision would *grant* authority during
|
|
-- a downgrade -- and historical provenance is not that decision. See README.md.
|
|
--
|
|
-- `access_all` follows the mapping the down migrations use: a Custom member has to hold all three
|
|
-- collection permissions, because in the old schema the bit also carried collection deletion. A
|
|
-- member mapped to plain User never keeps it: `User + access_all` is the one state the upgrade
|
|
-- refuses.
|
|
UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1);
|
|
UPDATE users_organizations
|
|
SET access_all = TRUE
|
|
WHERE atype = 4
|
|
AND uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist)
|
|
AND create_new_collections = TRUE
|
|
AND edit_any_collection = TRUE
|
|
AND delete_any_collection = TRUE;
|
|
|
|
-- The old server cannot load type 4.
|
|
UPDATE users_organizations SET atype = 3
|
|
WHERE atype = 4
|
|
AND uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist);
|
|
UPDATE users_organizations SET atype = 2, access_all = FALSE WHERE atype = 4;
|
|
|
|
-- One ALTER, not nine. Every `ALTER TABLE` commits implicitly here, so nine statements mean eight
|
|
-- intermediate states an interruption could leave behind; one statement is the closest this backend
|
|
-- gets to all-or-nothing.
|
|
ALTER TABLE users_organizations
|
|
DROP COLUMN manage_users,
|
|
DROP COLUMN manage_groups,
|
|
DROP COLUMN manage_policies,
|
|
DROP COLUMN create_new_collections,
|
|
DROP COLUMN edit_any_collection,
|
|
DROP COLUMN delete_any_collection,
|
|
DROP COLUMN access_event_logs,
|
|
DROP COLUMN access_import_export,
|
|
DROP COLUMN access_reports;
|
|
|
|
-- The two decisions this rollback required. A later re-upgrade needs neither: it reads the restored
|
|
-- `atype = 3` rows directly and converts them deterministically.
|
|
DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade;
|
|
DROP TABLE IF EXISTS __vw_rollback_manager_allowlist;
|
|
|
|
-- Finally forget the migration, so the older binary does not see a ledger from the future
|
|
-- and a later upgrade applies it again from a clean state.
|
|
DELETE FROM __diesel_schema_migrations
|
|
WHERE version = '20260630120000';
|
|
|
|
-- Every statement above except this DELETE is DDL and was therefore committed implicitly the moment
|
|
-- it ran. The DELETE is plain DML: under `autocommit = 0` -- which `mysql --init-command`, a my.cnf
|
|
-- default, or a connection pool can all set -- it would be rolled back on disconnect, leaving the
|
|
-- schema rolled back but the migration still marked as applied. A later upgrade would then skip
|
|
-- it and start new code against the old schema. Commit it explicitly; harmless when
|
|
-- autocommit is already on.
|
|
COMMIT;
|
|
|