D1's server-side statement splitter ends a trigger body at the first END it encounters, so CASE ... END inside a trigger fails wrangler d1 migrations apply --remote with "incomplete input". Use SELECT RAISE(...) WHERE ... instead; behavior and messages are unchanged.
- commit
- e98fe1c87a98f39bfa70b2ecc20675b41dc14aa7
- parent
- b54c48b6f90e439f4eae0e25698c285b05bb3585
- author
- Dami <dami.etoile@gmail.com>
| M | worker/ | 51 | ++++++++++++++++-------------- |
| M | worker/ | 51 | ++++++++++++++++-------------- |
@@ -6,41 +6,46 @@ ALTER TABLE vaults ADD COLUMN require_password INTEGER NOT NULL DEFAULT 0
66 ALTER TABLE vaults ADD COLUMN default_password_hash TEXT;77 88 -- These guards also cover concurrent API operations and non-CLI writers.9+-- Bodies use SELECT RAISE(...) WHERE ... rather than CASE ... END: D1's remote statement splitter10+-- ends a trigger at the first END it sees, so a CASE expression inside a body breaks11+-- `wrangler d1 migrations apply --remote` with "incomplete input". Keep BEGIN uppercase and LF endings.912 CREATE TRIGGER IF NOT EXISTS sites_vault_policy_insert1013 BEFORE INSERT ON sites BEGIN11- SELECT CASE WHEN (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 112- AND NEW.password_hash IS NULL THEN RAISE(ABORT, 'vault requires password protection') END;13- SELECT CASE WHEN EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL14- AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)))15- THEN RAISE(ABORT, 'site expiry exceeds vault maximum TTL') END;14+ SELECT RAISE(ABORT, 'vault requires password protection')15+ WHERE (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 116+ AND NEW.password_hash IS NULL;17+ SELECT RAISE(ABORT, 'site expiry exceeds vault maximum TTL')18+ WHERE EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL19+ AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)));1620 END;1721 1822 CREATE TRIGGER IF NOT EXISTS sites_vault_policy_update1923 BEFORE UPDATE ON sites BEGIN20- SELECT CASE WHEN (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 121- AND NEW.password_hash IS NULL THEN RAISE(ABORT, 'vault requires password protection') END;22- SELECT CASE WHEN EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL23- AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)))24- THEN RAISE(ABORT, 'site expiry exceeds vault maximum TTL') END;24+ SELECT RAISE(ABORT, 'vault requires password protection')25+ WHERE (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 126+ AND NEW.password_hash IS NULL;27+ SELECT RAISE(ABORT, 'site expiry exceeds vault maximum TTL')28+ WHERE EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL29+ AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)));2530 END;2631 2732 CREATE TRIGGER IF NOT EXISTS vault_policy_insert2833 BEFORE INSERT ON vaults BEGIN29- SELECT CASE WHEN NEW.max_ttl IS NOT NULL AND30- (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl)31- THEN RAISE(ABORT, 'vault default TTL exceeds maximum TTL') END;34+ SELECT RAISE(ABORT, 'vault default TTL exceeds maximum TTL')35+ WHERE NEW.max_ttl IS NOT NULL36+ AND (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl);3237 END;3338 3439 CREATE TRIGGER IF NOT EXISTS vault_policy_update3540 BEFORE UPDATE ON vaults BEGIN36- SELECT CASE WHEN NEW.max_ttl IS NOT NULL AND37- (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl)38- THEN RAISE(ABORT, 'vault default TTL exceeds maximum TTL') END;39- SELECT CASE WHEN NEW.require_password = 1 AND EXISTS40- (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND password_hash IS NULL)41- THEN RAISE(ABORT, 'protect existing sites before requiring vault passwords') END;42- SELECT CASE WHEN NEW.max_ttl IS NOT NULL AND EXISTS43- (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND44- (expires_at IS NULL OR expires_at > unixepoch() + round(NEW.max_ttl * 86400)))45- THEN RAISE(ABORT, 'shorten existing site expiry before tightening vault maximum TTL') END;41+ SELECT RAISE(ABORT, 'vault default TTL exceeds maximum TTL')42+ WHERE NEW.max_ttl IS NOT NULL43+ AND (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl);44+ SELECT RAISE(ABORT, 'protect existing sites before requiring vault passwords')45+ WHERE NEW.require_password = 146+ AND EXISTS (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND password_hash IS NULL);47+ SELECT RAISE(ABORT, 'shorten existing site expiry before tightening vault maximum TTL')48+ WHERE NEW.max_ttl IS NOT NULL49+ AND EXISTS (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND50+ (expires_at IS NULL OR expires_at > unixepoch() + round(NEW.max_ttl * 86400)));4651 END;@@ -175,41 +175,46 @@ CREATE INDEX IF NOT EXISTS idx_notification_deliveries_due
175175 ON notification_deliveries(status, next_attempt_at);176176 177177 -- These guards also cover concurrent API operations and non-CLI writers.178+-- Bodies use SELECT RAISE(...) WHERE ... rather than CASE ... END: D1's remote statement splitter179+-- ends a trigger at the first END it sees, so a CASE expression inside a body breaks180+-- `wrangler d1 migrations apply --remote` with "incomplete input". Keep BEGIN uppercase and LF endings.178181 CREATE TRIGGER IF NOT EXISTS sites_vault_policy_insert179182 BEFORE INSERT ON sites BEGIN180- SELECT CASE WHEN (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 1181- AND NEW.password_hash IS NULL THEN RAISE(ABORT, 'vault requires password protection') END;182- SELECT CASE WHEN EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL183- AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)))184- THEN RAISE(ABORT, 'site expiry exceeds vault maximum TTL') END;183+ SELECT RAISE(ABORT, 'vault requires password protection')184+ WHERE (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 1185+ AND NEW.password_hash IS NULL;186+ SELECT RAISE(ABORT, 'site expiry exceeds vault maximum TTL')187+ WHERE EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL188+ AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)));185189 END;186190 187191 CREATE TRIGGER IF NOT EXISTS sites_vault_policy_update188192 BEFORE UPDATE ON sites BEGIN189- SELECT CASE WHEN (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 1190- AND NEW.password_hash IS NULL THEN RAISE(ABORT, 'vault requires password protection') END;191- SELECT CASE WHEN EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL192- AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)))193- THEN RAISE(ABORT, 'site expiry exceeds vault maximum TTL') END;193+ SELECT RAISE(ABORT, 'vault requires password protection')194+ WHERE (SELECT require_password FROM vaults WHERE slot = NEW.vault_slot) = 1195+ AND NEW.password_hash IS NULL;196+ SELECT RAISE(ABORT, 'site expiry exceeds vault maximum TTL')197+ WHERE EXISTS (SELECT 1 FROM vaults WHERE slot = NEW.vault_slot AND max_ttl IS NOT NULL198+ AND (NEW.expires_at IS NULL OR NEW.expires_at > unixepoch() + round(max_ttl * 86400)));194199 END;195200 196201 CREATE TRIGGER IF NOT EXISTS vault_policy_insert197202 BEFORE INSERT ON vaults BEGIN198- SELECT CASE WHEN NEW.max_ttl IS NOT NULL AND199- (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl)200- THEN RAISE(ABORT, 'vault default TTL exceeds maximum TTL') END;203+ SELECT RAISE(ABORT, 'vault default TTL exceeds maximum TTL')204+ WHERE NEW.max_ttl IS NOT NULL205+ AND (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl);201206 END;202207 203208 CREATE TRIGGER IF NOT EXISTS vault_policy_update204209 BEFORE UPDATE ON vaults BEGIN205- SELECT CASE WHEN NEW.max_ttl IS NOT NULL AND206- (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl)207- THEN RAISE(ABORT, 'vault default TTL exceeds maximum TTL') END;208- SELECT CASE WHEN NEW.require_password = 1 AND EXISTS209- (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND password_hash IS NULL)210- THEN RAISE(ABORT, 'protect existing sites before requiring vault passwords') END;211- SELECT CASE WHEN NEW.max_ttl IS NOT NULL AND EXISTS212- (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND213- (expires_at IS NULL OR expires_at > unixepoch() + round(NEW.max_ttl * 86400)))214- THEN RAISE(ABORT, 'shorten existing site expiry before tightening vault maximum TTL') END;210+ SELECT RAISE(ABORT, 'vault default TTL exceeds maximum TTL')211+ WHERE NEW.max_ttl IS NOT NULL212+ AND (COALESCE(NEW.default_ttl, 14) = 0 OR COALESCE(NEW.default_ttl, 14) > NEW.max_ttl);213+ SELECT RAISE(ABORT, 'protect existing sites before requiring vault passwords')214+ WHERE NEW.require_password = 1215+ AND EXISTS (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND password_hash IS NULL);216+ SELECT RAISE(ABORT, 'shorten existing site expiry before tightening vault maximum TTL')217+ WHERE NEW.max_ttl IS NOT NULL218+ AND EXISTS (SELECT 1 FROM sites WHERE vault_slot = OLD.slot AND219+ (expires_at IS NULL OR expires_at > unixepoch() + round(NEW.max_ttl * 86400)));215220 END;