asd

database/upgrade-2.3.0.sql

@@ -0,0 +1,26 @@
+-- Upgrade an existing calcserubi database to version 2.3.0
+-- (super-admin role, mandatory password change after reset, TOTP 2FA).
+-- Run ONCE, manually (phpMyAdmin > tab SQL, or the mysql client), with an
+-- account that may ALTER the database. Then the application user only needs
+-- SELECT, INSERT, UPDATE, DELETE.
+
+ALTER TABLE admins
+  ADD COLUMN role VARCHAR(20) NOT NULL DEFAULT 'admin' COMMENT 'super_admin | admin' AFTER full_name,
+  ADD COLUMN must_change_password TINYINT(1) NOT NULL DEFAULT 0 AFTER is_active,
+  ADD COLUMN otp_secret VARCHAR(255) NULL COMMENT 'TOTP secret, encrypted with security.app_key' AFTER must_change_password,
+  ADD COLUMN otp_enabled TINYINT(1) NOT NULL DEFAULT 0 AFTER otp_secret,
+  ADD COLUMN otp_last_step BIGINT NULL COMMENT 'last accepted TOTP time step (replay guard)' AFTER otp_enabled,
+  ADD COLUMN recovery_codes TEXT NULL COMMENT 'JSON list of HMAC-hashed one-time recovery codes' AFTER otp_last_step;
+
+-- The oldest active admin becomes the first super admin. Check the result and
+-- adjust if another person should hold the role:
+--   SELECT id, username, role FROM admins;
+UPDATE admins SET role = 'super_admin'
+WHERE id = (SELECT id FROM (SELECT MIN(id) AS id FROM admins WHERE is_active = 1) AS first_admin);
+
+-- Workbook cell references removed from older seeded descriptions (previously done on
+-- every request). Written without REGEXP_REPLACE so it also runs on MySQL 5.7.
+UPDATE settings SET description = TRIM(SUBSTRING_INDEX(description, ' (COB!', 1))
+WHERE description LIKE '% (COB!%';
+UPDATE settings SET description = TRIM(SUBSTRING_INDEX(description, ' (CALC!', 1))
+WHERE description LIKE '% (CALC!%';