chore(release): secrets-mcp 0.4.0

Bump version for the N:N entry_secrets data model and related MCP/Web
changes. Remove superseded SQL migration artifacts; rely on auto-migrate.
Add structured errors, taxonomy normalization, and web i18n helpers.

Made-with: Cursor

scripts/cleanup-orphan-user-ids.sql

@@ -1,22 +0,0 @@
--- Run against prod BEFORE deploying secrets-mcp with FK migration.
--- Requires: write access to SECRETS_DATABASE_URL.
--- Example: psql "$SECRETS_DATABASE_URL" -v ON_ERROR_STOP=1 -f scripts/cleanup-orphan-user-ids.sql
-
-BEGIN;
-
-UPDATE entries
-SET user_id = NULL
-WHERE user_id IS NOT NULL
-  AND NOT EXISTS (SELECT 1 FROM users u WHERE u.id = entries.user_id);
-
-UPDATE entries_history
-SET user_id = NULL
-WHERE user_id IS NOT NULL
-  AND NOT EXISTS (SELECT 1 FROM users u WHERE u.id = entries_history.user_id);
-
-UPDATE audit_log
-SET user_id = NULL
-WHERE user_id IS NOT NULL
-  AND NOT EXISTS (SELECT 1 FROM users u WHERE u.id = audit_log.user_id);
-
-COMMIT;

scripts/migrate-db-prod-to-nn-test.sh

@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-# Migrate PostgreSQL data from secrets-mcp-prod to secrets-nn-test.
-#
-# Prereqs: pg_dump and pg_restore (PostgreSQL client tools) on PATH.
-# TLS: Use the same connection parameters as your MCP / app (e.g. sslmode=verify-full
-#      and PGSSLROOTCERT if needed). If local psql fails with "certificate verify failed",
-#      run this script from a host that trusts the server CA, or set PGSSLROOTCERT.
-#
-# Usage:
-#   export SOURCE_DATABASE_URL='postgres://USER:PASS@host:5432/secrets-mcp-prod?sslmode=verify-full'
-#   export TARGET_DATABASE_URL='postgres://USER:PASS@host:5432/secrets-nn-test?sslmode=verify-full'
-#   ./scripts/migrate-db-prod-to-nn-test.sh
-#
-# Options (env):
-#   BACKUP_TARGET_FIRST=1     # default: dump target to ./backup-secrets-nn-test-<timestamp>.dump before restore
-#   RUN_NN_SQL=1               # default: run migrations/001_nn_schema.sql then 002_data_cleanup.sql on target after restore
-#   SKIP_TARGET_BACKUP=1       # skip target backup
-#
-# WARNINGS:
-# - pg_restore with --clean --if-exists drops objects that exist in the dump; target DB is replaced
-#   to match the logical content of the source dump (same as typical full restore).
-# - Optionally keep a manual dump of the target before proceeding.
-# - 001_nn_schema.sql will fail if secrets has duplicate (user_id, name) after backfill; fix data first.
-
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
-
-SOURCE_URL="${SOURCE_DATABASE_URL:-}"
-TARGET_URL="${TARGET_DATABASE_URL:-}"
-
-if [[ -z "$SOURCE_URL" || -z "$TARGET_URL" ]]; then
-  echo "Set SOURCE_DATABASE_URL and TARGET_DATABASE_URL (postgres URLs)." >&2
-  exit 1
-fi
-
-if ! command -v pg_dump >/dev/null || ! command -v pg_restore >/dev/null; then
-  echo "pg_dump and pg_restore are required." >&2
-  exit 1
-fi
-
-TS="$(date +%Y%m%d%H%M%S)"
-DUMP_FILE="${DUMP_FILE:-$ROOT/tmp/secrets-mcp-prod-${TS}.dump}"
-mkdir -p "$(dirname "$DUMP_FILE")"
-
-if [[ "${EXCLUDE_TOWER_SESSIONS:-}" == "1" ]]; then
-  echo "==> Excluding schema tower_sessions from dump"
-  pg_dump "$SOURCE_URL" -Fc --no-owner --no-acl --exclude-schema=tower_sessions -f "$DUMP_FILE"
-else
-  echo "==> Dumping source (custom format) -> $DUMP_FILE"
-  pg_dump "$SOURCE_URL" -Fc --no-owner --no-acl -f "$DUMP_FILE"
-fi
-
-if [[ "${SKIP_TARGET_BACKUP:-}" != "1" && "${BACKUP_TARGET_FIRST:-1}" == "1" ]]; then
-  BACKUP_FILE="$ROOT/tmp/secrets-nn-test-before-${TS}.dump"
-  echo "==> Backing up target -> $BACKUP_FILE"
-  pg_dump "$TARGET_URL" -Fc --no-owner --no-acl -f "$BACKUP_FILE" || {
-    echo "Target backup failed (empty DB is OK). Continuing." >&2
-  }
-fi
-
-echo "==> Restoring into target (--clean --if-exists)"
-pg_restore -d "$TARGET_URL" --no-owner --no-acl --clean --if-exists --verbose "$DUMP_FILE"
-
-if [[ "${RUN_NN_SQL:-1}" == "1" ]]; then
-  if [[ ! -f "$ROOT/migrations/001_nn_schema.sql" ]]; then
-    echo "migrations/001_nn_schema.sql not found; skip NN SQL." >&2
-  else
-    echo "==> Applying migrations/001_nn_schema.sql on target"
-    psql "$TARGET_URL" -v ON_ERROR_STOP=1 -f "$ROOT/migrations/001_nn_schema.sql"
-  fi
-  if [[ -f "$ROOT/migrations/002_data_cleanup.sql" ]]; then
-    echo "==> Applying migrations/002_data_cleanup.sql on target"
-    psql "$TARGET_URL" -v ON_ERROR_STOP=1 -f "$ROOT/migrations/002_data_cleanup.sql"
-  fi
-fi
-
-echo "==> Done. Suggested verification:"
-echo "    psql \"\$TARGET_DATABASE_URL\" -c \"SELECT COUNT(*) FROM entries; SELECT COUNT(*) FROM secrets; SELECT COUNT(*) FROM entry_secrets;\""
-echo "    ./scripts/release-check.sh   # optional app-side sanity"

scripts/migrate-v0.3.0.sql

@@ -1,194 +0,0 @@
--- ============================================================================
--- migrate-v0.3.0.sql
--- Schema migration from v0.2.x → v0.3.0
---
--- Changes:
---   • entries:         namespace → folder, kind → type; add notes column
---   • audit_log:       namespace → folder, kind → type
---   • entries_history: namespace → folder, kind → type; add user_id column
---   • Unique index: (user_id, name) → (user_id, folder, name)
---     Same name in different folders is now allowed; no rename needed.
---
--- Safe to run multiple times (fully idempotent).
--- Preserves all data in users, entries, secrets.
--- ============================================================================
-
-BEGIN;
-
--- ── entries: rename namespace→folder, kind→type ──────────────────────────────
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries' AND column_name = 'namespace'
-    ) THEN
-        ALTER TABLE entries RENAME COLUMN namespace TO folder;
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries' AND column_name = 'kind'
-    ) THEN
-        ALTER TABLE entries RENAME COLUMN kind TO type;
-    END IF;
-END $$;
-
--- Set NOT NULL + default for folder/type in entries
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries' AND column_name = 'folder'
-    ) THEN
-        UPDATE entries SET folder = '' WHERE folder IS NULL;
-        ALTER TABLE entries ALTER COLUMN folder SET NOT NULL;
-        ALTER TABLE entries ALTER COLUMN folder SET DEFAULT '';
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries' AND column_name = 'type'
-    ) THEN
-        UPDATE entries SET type = '' WHERE type IS NULL;
-        ALTER TABLE entries ALTER COLUMN type SET NOT NULL;
-        ALTER TABLE entries ALTER COLUMN type SET DEFAULT '';
-    END IF;
-END $$;
-
--- Add notes column to entries if missing
-ALTER TABLE entries ADD COLUMN IF NOT EXISTS notes TEXT NOT NULL DEFAULT '';
-
--- ── audit_log: rename namespace→folder, kind→type ────────────────────────────
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'audit_log' AND column_name = 'namespace'
-    ) THEN
-        ALTER TABLE audit_log RENAME COLUMN namespace TO folder;
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'audit_log' AND column_name = 'kind'
-    ) THEN
-        ALTER TABLE audit_log RENAME COLUMN kind TO type;
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'audit_log' AND column_name = 'folder'
-    ) THEN
-        UPDATE audit_log SET folder = '' WHERE folder IS NULL;
-        ALTER TABLE audit_log ALTER COLUMN folder SET NOT NULL;
-        ALTER TABLE audit_log ALTER COLUMN folder SET DEFAULT '';
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'audit_log' AND column_name = 'type'
-    ) THEN
-        UPDATE audit_log SET type = '' WHERE type IS NULL;
-        ALTER TABLE audit_log ALTER COLUMN type SET NOT NULL;
-        ALTER TABLE audit_log ALTER COLUMN type SET DEFAULT '';
-    END IF;
-END $$;
-
-ALTER TABLE audit_log DROP COLUMN IF EXISTS actor;
-
--- ── entries_history: rename namespace→folder, kind→type; add user_id ─────────
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries_history' AND column_name = 'namespace'
-    ) THEN
-        ALTER TABLE entries_history RENAME COLUMN namespace TO folder;
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries_history' AND column_name = 'kind'
-    ) THEN
-        ALTER TABLE entries_history RENAME COLUMN kind TO type;
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries_history' AND column_name = 'folder'
-    ) THEN
-        UPDATE entries_history SET folder = '' WHERE folder IS NULL;
-        ALTER TABLE entries_history ALTER COLUMN folder SET NOT NULL;
-        ALTER TABLE entries_history ALTER COLUMN folder SET DEFAULT '';
-    END IF;
-END $$;
-
-DO $$ BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_name = 'entries_history' AND column_name = 'type'
-    ) THEN
-        UPDATE entries_history SET type = '' WHERE type IS NULL;
-        ALTER TABLE entries_history ALTER COLUMN type SET NOT NULL;
-        ALTER TABLE entries_history ALTER COLUMN type SET DEFAULT '';
-    END IF;
-END $$;
-
-ALTER TABLE entries_history ADD COLUMN IF NOT EXISTS user_id UUID;
-ALTER TABLE entries_history DROP COLUMN IF EXISTS actor;
-
--- ── secrets_history: drop actor column ───────────────────────────────────────
-ALTER TABLE secrets_history DROP COLUMN IF EXISTS actor;
-
--- ── Rebuild unique indexes: (user_id, folder, name) ──────────────────────────
--- Note: folder is now part of the key, so same name in different folders is
--- naturally distinct — no rename of existing rows needed.
-DROP INDEX IF EXISTS idx_entries_unique_legacy;
-DROP INDEX IF EXISTS idx_entries_unique_user;
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_unique_legacy
-    ON entries(folder, name)
-    WHERE user_id IS NULL;
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_unique_user
-    ON entries(user_id, folder, name)
-    WHERE user_id IS NOT NULL;
-
--- ── Replace old namespace/kind indexes with folder/type ──────────────────────
-DROP INDEX IF EXISTS idx_entries_namespace;
-DROP INDEX IF EXISTS idx_entries_kind;
-DROP INDEX IF EXISTS idx_audit_log_ns_kind;
-DROP INDEX IF EXISTS idx_entries_history_ns_kind_name;
-
-CREATE INDEX IF NOT EXISTS idx_entries_folder
-    ON entries(folder) WHERE folder <> '';
-CREATE INDEX IF NOT EXISTS idx_entries_type
-    ON entries(type) WHERE type <> '';
-CREATE INDEX IF NOT EXISTS idx_entries_user_id
-    ON entries(user_id) WHERE user_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS idx_audit_log_folder_type
-    ON audit_log(folder, type);
-CREATE INDEX IF NOT EXISTS idx_entries_history_folder_type_name
-    ON entries_history(folder, type, name, version DESC);
-CREATE INDEX IF NOT EXISTS idx_entries_history_user_id
-    ON entries_history(user_id) WHERE user_id IS NOT NULL;
-
-COMMIT;
-
--- ── Verification queries (run these manually to confirm) ─────────────────────
--- SELECT column_name, data_type FROM information_schema.columns
---   WHERE table_name = 'entries' ORDER BY ordinal_position;
--- SELECT indexname, indexdef FROM pg_indexes WHERE tablename = 'entries';
--- SELECT COUNT(*) FROM entries;
--- SELECT COUNT(*) FROM users;
--- SELECT COUNT(*) FROM secrets;

scripts/sync-test-to-prod.sh

@@ -0,0 +1,95 @@
+#!/bin/bash
+# 同步测试环境数据到生产环境
+# 用法: ./scripts/sync-test-to-prod.sh
+
+set -euo pipefail
+
+# PostgreSQL 客户端工具路径 (Homebrew libpq)
+export PATH="/opt/homebrew/opt/libpq/bin:$PATH"
+
+# SSL 配置
+export PGSSLMODE=verify-full
+export PGSSLROOTCERT=/etc/ssl/cert.pem
+
+# 测试环境
+TEST_DB="postgres://postgres:Voson_2026_Pg18!@db.refining.ltd:5432/secrets-nn-test"
+
+# 生产环境
+PROD_DB="postgres://postgres:Voson_2026_Pg18!@db.refining.ltd:5432/secrets-nn-prod"
+
+echo "========================================="
+echo "  测试环境 -> 生产环境 数据同步"
+echo "========================================="
+echo ""
+
+# 确认操作
+read -p "⚠️  此操作将覆盖生产环境数据,确认继续? (yes/no): " confirm
+if [ "$confirm" != "yes" ]; then
+    echo "已取消"
+    exit 0
+fi
+
+echo ""
+echo "步骤 1/4: 导出测试环境数据..."
+TEMP_DIR=$(mktemp -d)
+trap "rm -rf $TEMP_DIR" EXIT
+
+# 导出测试环境数据(不含审计日志和历史记录)
+pg_dump "$TEST_DB" \
+    --table=entries \
+    --table=secrets \
+    --table=entry_secrets \
+    --table=users \
+    --table=oauth_accounts \
+    --data-only \
+    --column-inserts \
+    --no-owner \
+    --no-privileges \
+    > "$TEMP_DIR/test_data.sql"
+
+echo "✓ 测试数据已导出到临时文件"
+echo "  文件大小: $(du -h "$TEMP_DIR/test_data.sql" | cut -f1)"
+
+echo ""
+echo "步骤 2/4: 备份当前生产数据..."
+pg_dump "$PROD_DB" \
+    --table=entries \
+    --table=secrets \
+    --table=entry_secrets \
+    --table=users \
+    --table=oauth_accounts \
+    --data-only \
+    --column-inserts \
+    --no-owner \
+    --no-privileges \
+    > "$TEMP_DIR/prod_backup_$(date +%Y%m%d_%H%M%S).sql"
+
+echo "✓ 生产数据已备份"
+
+echo ""
+echo "步骤 3/4: 清空生产环境目标表..."
+psql "$PROD_DB" <<'SQL'
+TRUNCATE TABLE entry_secrets CASCADE;
+TRUNCATE TABLE secrets CASCADE;
+TRUNCATE TABLE entries CASCADE;
+SQL
+
+echo "✓ 生产环境目标表已清空"
+
+echo ""
+echo "步骤 4/4: 导入测试数据到生产环境..."
+psql "$PROD_DB" -f "$TEMP_DIR/test_data.sql" 2>&1 | tail -20
+
+echo ""
+echo "验证数据..."
+echo "生产环境数据统计:"
+psql "$PROD_DB" -c "SELECT 'users' as table_name, count(*) FROM users UNION ALL SELECT 'entries', count(*) FROM entries UNION ALL SELECT 'secrets', count(*) FROM secrets UNION ALL SELECT 'entry_secrets', count(*) FROM entry_secrets UNION ALL SELECT 'oauth_accounts', count(*) FROM oauth_accounts ORDER BY table_name;"
+
+echo ""
+echo "========================================="
+echo "  ✓ 数据同步完成!"
+echo "========================================="
+echo ""
+echo "提示:"
+echo "  - 生产数据备份已保存在临时目录"
+echo "  - 临时文件将在脚本退出后自动删除"