Function runBackfill

packages/db/scripts/backfill-api-key-hash.ts:94–204

()

}

export async function runBackfill(): Promise<void> {
  const dryRun = process.argv.includes('--dry-run')

  const connectionString = process.env.POSTGRES_URL ?? process.env.DATABASE_URL
  if (!connectionString) {
    console.error('Missing POSTGRES_URL or DATABASE_URL environment variable')
    process.exit(1)
  }

  const apiEncryptionKey = process.env.API_ENCRYPTION_KEY ?? null
  if (!apiEncryptionKey) {
    console.warn(
      'API_ENCRYPTION_KEY is not set. Rows whose stored key is encrypted will fail to decrypt. ' +
        'Only rows whose stored key is already plain text will be backfilled in this run.'
    )
  } else if (apiEncryptionKey.length !== 64) {
    console.error('API_ENCRYPTION_KEY must be a 64-character hex string (32 bytes)')
    process.exit(1)
  }

  assertCryptoRoundTrip(apiEncryptionKey)

  const postgresClient = postgres(connectionString, {
    prepare: false,
    idle_timeout: 20,
    connect_timeout: 30,
    max: 5,
    onnotice: () => {},
  })
  const db = drizzle(postgresClient)

  const stats: BackfillStats = {
    scanned: 0,
    updated: 0,
    skippedEncryptedNoKey: 0,
    failed: 0,
  }

  try {
    const [{ count: pendingBefore }] = await db
      .select({ count: sql<number>`count(*)::int` })
      .from(apiKey)
      .where(isNull(apiKey.keyHash))

    console.log(
      `Backfill starting — ${pendingBefore} row(s) with NULL key_hash${dryRun ? ' [DRY RUN]' : ''}`
    )

    for (;;) {
      const rows = await db
        .select({ id: apiKey.id, key: apiKey.key })
        .from(apiKey)
        .where(isNull(apiKey.keyHash))
        .limit(BATCH_SIZE)

      if (rows.length === 0) break

      await Promise.all(