Drop the admin's and sign-in's tables, and stop requiring Neon Auth's users_sync

[esthor]

_{Preview · Change Stack · Checks · Files: +2760 −83 in 12 files}

What

Drops the last of the old sign-in from the schema, so turning Neon Auth off can't break the migrator or the tests. It leaves the neon_auth schema alone.

• core/migrations/0023_drop_admin_tables.ts
  • DROP TABLE "public"."profile_users" and DROP TABLE "public"."administrators", without CASCADE: anything else depending on them would stop the migration.
  • They were the only references from public or planning to neon_auth.users_sync (administrators_user_id_users_sync_id_fk, profile_users_user_id_users_sync_id_fk). Nothing reads either table since Remove the old app's admin and members' profile pages #207, Remove Stack Auth from the old app: no sign-in, no handler, no dependency #212 and Remove the stdio MCP's administrator tools and their scripts #213.
• Drizzle, dual-shipped: app/migrations/0035_drop_admin_tables.sql and its snapshot.
  • app/src/lib/schema.ts drops administratorsTable and profileUsersTable, and stops declaring neon_auth.users_sync (usersSync from drizzle-orm/neon).
  • drizzle-kit also wrote DROP TABLE "neon_auth"."users_sync" into 0035. I took it out by hand: neon_auth is Neon's.
  • The app's tests no longer create a neon_auth schema.
• The snapshot. src/schema-snapshot.ts compares public and planning only, not neon_auth. tests/fixtures/production-schema.txt loses the neon_auth.users_sync lines and the two tables' lines.
• The baseline is unchanged (it is never edited). Where Neon Auth isn't on, it still creates its stand-in users_sync, and production is stamped past it. Nothing compares it any more.
• Tests (core/tests/migrations.test.ts):
  • A new test checks that no constraint references neon_auth. It then drops the whole neon_auth schema and checks the snapshot doesn't change.
  • "an invalid index shows in the snapshot" now uses public.event_posts_event_id_idx instead of Neon Auth's index.
  • The baseline's own checks on a Neon-made users_sync stay as they are.
• Docs: a paragraph in core/README.md ("Migrations").

Read-only against production, as site_reader:

• bun run migrate --dry-run lists exactly 0023_drop_admin_tables as pending.
• The only foreign keys into neon_auth are the two this drops.
• No view or routine depends on either table.
• neon_auth.users_sync has about 4 live rows (pg_stat).

site_reader can't read the tables themselves.

Before running the migration: archive, as the owner

Run this as neondb_owner (users_sync holds people's names and emails, so the directory is private), then store the files in the allthings vault:

umask 077 && mkdir -p neon-auth-archive && cd neon-auth-archive
psql "$OWNER_DATABASE_URL" -X -v ON_ERROR_STOP=1 <<'SQL'
BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY;
SELECT (SELECT count(*) FROM neon_auth.users_sync) AS users_sync,
       (SELECT count(*) FROM public.administrators) AS administrators,
       (SELECT count(*) FROM public.profile_users) AS profile_users;
\copy (SELECT * FROM neon_auth.users_sync ORDER BY id) TO 'neon_auth.users_sync.csv' WITH (FORMAT csv, HEADER)
\copy (SELECT * FROM public.administrators ORDER BY created_at, id) TO 'public.administrators.csv' WITH (FORMAT csv, HEADER)
\copy (SELECT * FROM public.profile_users ORDER BY profile_id) TO 'public.profile_users.csv' WITH (FORMAT csv, HEADER)
COMMIT;
SQL
wc -l *.csv   # each file: its count above, plus one header line

The three copies come from one snapshot. users_sync.raw_json carries everything Stack Auth synced for each user, so restoring needs nothing else. Then, from this PR's final head commit, run bun run migrate --dry-run and then bun run migrate (core/README.md, "Running them"), and merge.

What else ties production to Neon Auth

Read via the Neon API and the repository. I changed nothing.

• Neon project prod (wispy-sea-75401301), branch main (br-round-dust-a6avtg0r)
  • Neon Auth integration: provider stack, owned_by: neon, set up on 2025-09-24, Stack project 06a56015-e238-46fb-875e-92ccd980c31b, database neondb. Its JWKS is https://api.stack-auth.com/api/v1/projects/06a56015-…/.well-known/jwks.json.
  • neon_auth schema: owned by neondb_owner. It holds users_sync and two indexes, users_sync_pkey and users_sync_deleted_at_idx.
  • Logical replication is enabled on the project. Nothing in this repository uses it. If Neon Auth was the reason, it can go once Neon Auth is off; otherwise leave it.
  • No Data API on main/neondb, so nothing there validates Stack JWTs.
• Other branches with copies:
  • archive/hackathon-app-2026-10-03 (br-polished-feather-a6yijsdo, protected) holds its own neon_auth.users_sync, administrators and profile_users as of 2026-10-03.
  • hello-chatgpt and dev-1 (archived) date from 2026-03 and hold the same.
  • This migration doesn't touch any branch except the one it runs on.
• Stack Auth itself: the Stack project above (dashboard at app.stack-auth.com, unless Neon manages it) and its OAuth providers and redirect URLs for allthingsweb.dev/handler. infra/docs/r2-migration.md already lists deleting it.
• Vercel: the three STACK env vars are already gone. If the project is connected through Vercel's Neon integration with Neon Auth enabled, the integration can write them back; turn Neon Auth off there too.
• Repository: nothing reads Neon Auth after this PR, in app/, core/, web/ or infra/. Two references stay:
  • core/tests/site-sync.test.ts checks the sync role can't read neon_auth.users_sync. In tests that is the baseline's stand-in.
  • The baseline's comments.

Verify

cd core && bun test   # 2191 pass, including tests/migrations.test.ts (26) with the drizzle replay
cd app && bun run typecheck && bun test   # 161 pass

Summary by CodeRabbit

• Database Updates
  • Removed the app-managed administrator and profile-user tables.
  • Schema snapshots and migration checks now exclude Neon Auth’s schema, so its presence or absence does not affect app schema validation.
  • Snapshots continue to cover the app’s event, talk, profile, sponsor, image, and planning data.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: allthingsweb-dev/allthingsweb/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 31f59266-a5f0-4faf-a127-8e86185e0e7a

📥 Commits

Reviewing files that changed from the base of the PR and between c69c764 and e82d174.

📒 Files selected for processing (12)

• app/migrations/0035_drop_admin_tables.sql
• app/migrations/meta/0035_snapshot.json
• app/migrations/meta/_journal.json
• app/src/lib/schema.ts
• app/tests/short-links.test.ts
• app/tests/support/schema.ts
• core/README.md
• core/migrations/0023_drop_admin_tables.ts
• core/migrations/index.ts
• core/src/schema-snapshot.ts
• core/tests/fixtures/production-schema.txt
• core/tests/migrations.test.ts

💤 Files with no reviewable changes (4)

• app/src/lib/schema.ts
• app/tests/short-links.test.ts
• app/tests/support/schema.ts
• core/tests/fixtures/production-schema.txt

Limit details: You’ve used the included review currently available. Your 112 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: 🧱 Core
• GitHub Check: 🚀 Deploy
• GitHub Check: 🧹 Lint
• GitHub Check: 🔢 Migration numbers
• GitHub Check: 🌐 Web
• GitHub Check: 🧪 Tests

🧰 Additional context used

🪛 Squawk (2.65.0)

app/migrations/0035_drop_admin_tables.sql

[warning] 1-1: Dropping a table may break existing clients.

(ban-drop-table)

---

[warning] 2-2: Dropping a table may break existing clients.

(ban-drop-table)

🔇 Additional comments (1)

app/migrations/0035_drop_admin_tables.sql (1)

1-2: 🗄️ Data Integrity & Integration

The CASCADE concern does not apply to a supported migration path. The project documentation states that only tests replay app/migrations; production uses the core migrations after cutover. The production counterpart already uses plain drops.

The app/package.json db:migrate script does not establish a supported existing-production workflow for this migration.

---

📝 Walkthrough

Walkthrough

The changes remove Neon Auth-linked tables from the app schema and migrations. Schema snapshots now cover only public and planning, and migration tests verify that the external neon_auth schema does not affect snapshot results.

Changes

Neon Auth schema removal

Layer / File(s)	Summary
Remove user-linked tables app/src/lib/schema.ts, core/migrations/0023_drop_admin_tables.ts, core/migrations/index.ts, app/migrations/0035_drop_admin_tables.sql, app/migrations/meta/_journal.json, app/migrations/meta/0035_snapshot.json, app/tests/short-links.test.ts, app/tests/support/schema.ts	The app schema removes users_sync, administrators, and profile_users. Core and app migrations drop the public user-linked tables. App test setup no longer creates neon_auth.
Limit snapshots to site schemas core/src/schema-snapshot.ts, core/tests/fixtures/production-schema.txt, core/tests/migrations.test.ts, core/README.md	Snapshots now cover public and planning, not neon_auth. The production fixture and migration tests reflect this scope, and the README describes the external schema and its handling.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e82d1

This change drops the unused admin and sign-in tables and narrows schema snapshots to the site's own schemas. The production migration path drops the tables without CASCADE and fails safely if anything unexpected depends on them. No merge-blocking risk was found.

Security Architecture Review

Security architecture risk: 🔵 Low · up to e82d1

The change separates the site database from Neon Auth without deleting Neon's schema. The documented production migration stops on unexpected dependencies, and no new attacker-controlled access path was identified. Risk remains low rather than minimal because committed deletion is irreversible through these migrations, and live deployment and recovery conditions were not independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The direct destructive scope is the two obsolete identity-mapping tables in the database selected by the migration operator. Core's non-cascading statements stop rather than automatically expanding deletion to unexpected dependent objects. Live database dependencies were not independently verified.

Trust Boundaries and Controls

• observed — The new production migration deletes site-owned identity mappings without modifying the provider-owned authentication table. Snapshot verification correspondingly stops treating the provider schema as part of the site contract. The added test checks for remaining foreign-key references before removing neon_auth in an isolated test database.

Resilience and Maintainability Implications

• observed — The existing migrator rejects inconsistent migration history and refuses baseline execution on a provisioned but unstamped database. These controls remain in place around the destructive cleanup. Transaction and table-lock behavior is documented as supplied by the external migrator; concurrent production execution was not independently established.

Hardening Proposals

• proposed — If the app SQL history is ever reused for a live upgrade, preserve core's fail-closed dependency handling rather than relying on CASCADE. Its present test-only role does not establish a production vulnerability.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: removing the admin and sign-in tables and stopping the requirement for Neon Auth's users_sync.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 8
• Charged: $2.00
• View usage details

Note

This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. View usage-based billing.

---

_{Comment @coderabbitai help to get the list of available commands.}