super-productivity/packages/super-sync-server/prisma/schema.prisma
Johannes Millan 2d9988dd73
perf(sync): SuperSync server speed + correctness hardening (#7621)
* docs(sync): add super sync server perf plan

* perf(sync): implement supersync server perf phases

* fix(sync): bracket auth cache invalidation

* fix(sync): avoid empty replay state stringify

* fix(sync): harden supersync batch uploads

* fix super sync review findings

* fix(sync): guard payload bytes backfill rollout

* perf(sync): speed up payload_bytes backfill and index its scan

Raise the backfill batch size (DEFAULT 5->500, MAX 25->1000) so a
100M-row operations table backfills in minutes rather than tens of
hours. Add a CONCURRENTLY partial index on (user_id, id) WHERE
payload_bytes = 0: it drains to empty post-backfill so the boot-time
backfill self-check and the BOOL_OR quota probe stop doing a full
sequential scan to prove absence, and it makes the backfill's per-user
keyset paging a true index seek. Wire the new concurrent-index
migration into both deploy scripts' P3018 recovery path. Add
migration-SQL guard tests for the ADD COLUMN (metadata-only fast path)
and the new partial index.

* fix(sync): bound auth cache invalidation map and bracket every delete

The auth verification cache's invalidationVersions map grew one entry
per lifetime-invalidated user with no eviction (unbounded heap on a
long-lived single replica). Cap it at the same 10k LRU bound as the
entries map, re-inserting the just-invalidated user at the MRU tail so
the CAS race protection still holds for the only window that matters
(one DB round trip). Bracket the passkey/magic-link registration
cleanup deletes with pre+post invalidate to match the documented
convention, and invalidate on verifyEmail so a freshly-verified user
isn't denied for up to the cache TTL.

* perf(sync): skip the redundant exact replay-state measurement

The delta accounting is a proven over-estimate of the serialized state
size, so when the running bound stays within the cap the true size is
too and the final exact JSON.stringify is provably redundant. Skip it
in that case (still measure-and-throw whenever the bound does not prove
safety). This collapses the common small/incremental replay back to
zero expensive full stringifications, matching the old per-op loop
instead of regressing it. Name the entity-key JSON overhead constant
and document that assertReplayStateSize's return value is load-bearing.

* refactor(sync): split processOperationBatch into pipeline stages

Extract the 297-line batch upload method into a thin orchestrator plus
six named single-responsibility stage helpers (validate+clamp, intra-
batch dedupe, classify existing duplicates, conflict-detect, reserve
seq + insert, full-state clock). Behavior-preserving: every stage
writes terminal rejections into the shared results array by index and
the two empty-set guards short-circuit exactly as before. Also share
the timestamp clamp, the duplicate-op SELECT, and the merged
full-state clock persistence between the batch and legacy paths so
they cannot silently diverge.

* test(sync): pin batch error-code divergence and aggregate-once

Strengthen the intra-batch duplicate test to assert same-id /
different-content yields DUPLICATE_OPERATION (deliberate divergence
from the legacy INVALID_OP_ID), and document the divergence in the
plan. Replace the single-full-state aggregate test with two
full-state ops + a spy asserting _aggregatePriorVectorClock runs
exactly once and last-write-wins — the old test could not catch a
per-op-aggregate regression. Add a makeOp fixture factory. Correct
the plan's overstated replay-stringification numbers.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: johannesjo <1456265+johannesjo@users.noreply.github.com>
2026-05-15 17:24:16 +02:00

119 lines
4.9 KiB
Text

// This is your Prisma schema file,
// learn more about it in the docs: https://pris.ly/d/prisma-schema
generator client {
provider = "prisma-client-js"
}
datasource db {
provider = "postgresql"
url = env("DATABASE_URL")
}
model User {
id Int @id @default(autoincrement())
email String @unique
passwordHash String? @map("password_hash") // Nullable for passkey-only users
isVerified Int @default(0) @map("is_verified") // 0 or 1
verificationToken String? @map("verification_token")
verificationTokenExpiresAt BigInt? @map("verification_token_expires_at")
verificationResendCount Int @default(0) @map("verification_resend_count")
resetPasswordToken String? @map("reset_password_token")
resetPasswordTokenExpiresAt BigInt? @map("reset_password_token_expires_at")
passkeyRecoveryToken String? @map("passkey_recovery_token")
passkeyRecoveryTokenExpiresAt BigInt? @map("passkey_recovery_token_expires_at")
loginToken String? @map("login_token")
loginTokenExpiresAt BigInt? @map("login_token_expires_at")
failedLoginAttempts Int @default(0) @map("failed_login_attempts")
lockedUntil BigInt? @map("locked_until")
tokenVersion Int @default(0) @map("token_version")
termsAcceptedAt BigInt? @map("terms_accepted_at")
createdAt DateTime @default(now()) @map("created_at")
storageQuotaBytes BigInt @default(104857600) @map("storage_quota_bytes") // 100MB default
storageUsedBytes BigInt @default(0) @map("storage_used_bytes")
operations Operation[]
syncState UserSyncState?
devices SyncDevice[]
passkeys Passkey[]
@@index([verificationToken])
@@index([resetPasswordToken])
@@index([passkeyRecoveryToken])
@@index([loginToken])
@@map("users")
}
model Passkey {
id String @id @default(cuid())
credentialId Bytes @unique @map("credential_id")
publicKey Bytes @map("public_key")
counter BigInt @default(0)
transports String? // JSON array of transport types
createdAt DateTime @default(now()) @map("created_at")
lastUsedAt DateTime? @map("last_used_at")
userId Int @map("user_id")
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
@@index([userId])
@@map("passkeys")
}
model Operation {
id String @id
userId Int @map("user_id")
clientId String @map("client_id")
serverSeq Int @map("server_seq")
actionType String @map("action_type")
opType String @map("op_type")
entityType String @map("entity_type")
entityId String? @map("entity_id")
payload Json
payloadBytes BigInt @default(0) @map("payload_bytes")
vectorClock Json @map("vector_clock")
schemaVersion Int @map("schema_version")
clientTimestamp BigInt @map("client_timestamp")
receivedAt BigInt @map("received_at")
isPayloadEncrypted Boolean @default(false) @map("is_payload_encrypted")
syncImportReason String? @map("sync_import_reason")
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
@@unique([userId, serverSeq])
@@index([userId, entityType, entityId, serverSeq])
@@index([userId, clientId])
@@index([userId, receivedAt])
// Restore-point opType lookups use a raw partial index in the 20260512000000 migration.
@@map("operations")
}
model UserSyncState {
userId Int @id @map("user_id")
lastSeq Int @default(0) @map("last_seq")
lastSnapshotSeq Int? @map("last_snapshot_seq")
snapshotData Bytes? @map("snapshot_data")
snapshotAt BigInt? @map("snapshot_at")
snapshotSchemaVersion Int? @default(1) @map("snapshot_schema_version")
latestFullStateSeq Int? @map("latest_full_state_seq")
latestFullStateVectorClock Json? @map("latest_full_state_vector_clock")
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
@@map("user_sync_state")
}
model SyncDevice {
clientId String @map("client_id")
userId Int @map("user_id")
deviceName String? @map("device_name")
userAgent String? @map("user_agent")
lastSeenAt BigInt @map("last_seen_at")
lastAckedSeq Int @default(0) @map("last_acked_seq")
createdAt BigInt @map("created_at")
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
@@id([userId, clientId])
@@map("sync_devices")
}