Проект разделен на два репозитория

VM2_services/codebase/services/message-safety/alembic/env.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import asyncio
+
+from sqlalchemy import pool
+from sqlalchemy.ext.asyncio import async_engine_from_config
+
+from alembic import context
+from app.db import Base, postgres_ssl_context
+from app.settings import _secret
+
+config = context.config
+target_metadata = Base.metadata
+
+
+def offline() -> None:
+    context.configure(
+        url=_secret("MESSAGE_SAFETY_CONFIG_ADMIN_DATABASE_URL"),
+        target_metadata=target_metadata,
+        literal_binds=True,
+        dialect_opts={"paramstyle": "named"},
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+async def online() -> None:
+    section = config.get_section(config.config_ini_section) or {}
+    section["sqlalchemy.url"] = _secret("MESSAGE_SAFETY_CONFIG_ADMIN_DATABASE_URL")
+    engine = async_engine_from_config(
+        section,
+        prefix="sqlalchemy.",
+        poolclass=pool.NullPool,
+        connect_args={"ssl": postgres_ssl_context()},
+    )
+    async with engine.connect() as connection:
+
+        def migrate(conn) -> None:
+            context.configure(connection=conn, target_metadata=target_metadata)
+            with context.begin_transaction():
+                context.run_migrations()
+
+        await connection.run_sync(migrate)
+    await engine.dispose()
+
+
+if context.is_offline_mode():
+    offline()
+else:
+    asyncio.run(online())

VM2_services/codebase/services/message-safety/alembic/versions/0001_message_safety_v2.py

@@ -0,0 +1,63 @@
+"""message safety v2 normative schema
+
+Revision ID: 0001_message_safety_v2
+"""
+
+from alembic import op
+from app.db import Base
+
+revision = "0001_message_safety_v2"
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("CREATE SCHEMA IF NOT EXISTS message_safety")
+    Base.metadata.create_all(bind=op.get_bind())
+    op.execute(
+        """
+        CREATE OR REPLACE FUNCTION message_safety.guard_config_immutable()
+        RETURNS trigger LANGUAGE plpgsql AS $$
+        BEGIN
+          IF OLD.version IS DISTINCT FROM NEW.version
+             OR OLD.schema_version IS DISTINCT FROM NEW.schema_version
+             OR OLD.config IS DISTINCT FROM NEW.config
+             OR OLD.config_sha256 IS DISTINCT FROM NEW.config_sha256 THEN
+            RAISE EXCEPTION 'immutable config fields cannot be changed';
+          END IF;
+          RETURN NEW;
+        END $$;
+        """
+    )
+    op.execute(
+        """
+        CREATE TRIGGER config_immutable
+        BEFORE UPDATE ON message_safety.config_versions
+        FOR EACH ROW EXECUTE FUNCTION message_safety.guard_config_immutable();
+        """
+    )
+    op.execute(
+        """
+        CREATE OR REPLACE FUNCTION message_safety.guard_terminal_task()
+        RETURNS trigger LANGUAGE plpgsql AS $$
+        BEGIN
+          IF OLD.status IN ('allowed','denied','failed')
+             AND ROW(OLD.*) IS DISTINCT FROM ROW(NEW.*) THEN
+            RAISE EXCEPTION 'terminal safety task is immutable';
+          END IF;
+          RETURN NEW;
+        END $$;
+        """
+    )
+    op.execute(
+        """
+        CREATE TRIGGER task_terminal_immutable
+        BEFORE UPDATE ON message_safety.safety_tasks
+        FOR EACH ROW EXECUTE FUNCTION message_safety.guard_terminal_task();
+        """
+    )
+
+
+def downgrade() -> None:
+    op.execute("DROP SCHEMA message_safety CASCADE")