27 lines
1.6 KiB
SQL
27 lines
1.6 KiB
SQL
-- Upgrade an existing calcserubi database to version 2.3.0
|
|
-- (super-admin role, mandatory password change after reset, TOTP 2FA).
|
|
-- Run ONCE, manually (phpMyAdmin > tab SQL, or the mysql client), with an
|
|
-- account that may ALTER the database. Then the application user only needs
|
|
-- SELECT, INSERT, UPDATE, DELETE.
|
|
|
|
ALTER TABLE admins
|
|
ADD COLUMN role VARCHAR(20) NOT NULL DEFAULT 'admin' COMMENT 'super_admin | admin' AFTER full_name,
|
|
ADD COLUMN must_change_password TINYINT(1) NOT NULL DEFAULT 0 AFTER is_active,
|
|
ADD COLUMN otp_secret VARCHAR(255) NULL COMMENT 'TOTP secret, encrypted with security.app_key' AFTER must_change_password,
|
|
ADD COLUMN otp_enabled TINYINT(1) NOT NULL DEFAULT 0 AFTER otp_secret,
|
|
ADD COLUMN otp_last_step BIGINT NULL COMMENT 'last accepted TOTP time step (replay guard)' AFTER otp_enabled,
|
|
ADD COLUMN recovery_codes TEXT NULL COMMENT 'JSON list of HMAC-hashed one-time recovery codes' AFTER otp_last_step;
|
|
|
|
-- The oldest active admin becomes the first super admin. Check the result and
|
|
-- adjust if another person should hold the role:
|
|
-- SELECT id, username, role FROM admins;
|
|
UPDATE admins SET role = 'super_admin'
|
|
WHERE id = (SELECT id FROM (SELECT MIN(id) AS id FROM admins WHERE is_active = 1) AS first_admin);
|
|
|
|
-- Workbook cell references removed from older seeded descriptions (previously done on
|
|
-- every request). Written without REGEXP_REPLACE so it also runs on MySQL 5.7.
|
|
UPDATE settings SET description = TRIM(SUBSTRING_INDEX(description, ' (COB!', 1))
|
|
WHERE description LIKE '% (COB!%';
|
|
UPDATE settings SET description = TRIM(SUBSTRING_INDEX(description, ' (CALC!', 1))
|
|
WHERE description LIKE '% (CALC!%';
|