Add identities table and sync cron

Author: rudyfraser

server/postgres/migrations/000017_create_identities_table.sql

@@ -0,0 +1,29 @@
+-- Global identity directory: one row per person, indexed by DID.
+-- DID is nullable for email-only records that haven't been linked yet.
+
+CREATE TABLE IF NOT EXISTS identities (
+    id SERIAL PRIMARY KEY,
+    did TEXT UNIQUE,
+    email TEXT,
+    alt_email_1 TEXT,
+    alt_email_2 TEXT,
+    handle TEXT,
+    display_name TEXT,
+    avatar_url TEXT,
+    is_member BOOLEAN DEFAULT FALSE,
+    is_funder BOOLEAN DEFAULT FALSE,
+    is_team BOOLEAN DEFAULT FALSE,
+    is_oss_supporter BOOLEAN DEFAULT FALSE,
+    source TEXT,
+    member_updated_at BIGINT,
+    funder_updated_at BIGINT,
+    team_updated_at BIGINT,
+    oss_updated_at BIGINT,
+    created BIGINT DEFAULT now_as_millis(),
+    modified BIGINT DEFAULT now_as_millis()
+);
+
+CREATE INDEX IF NOT EXISTS identities_email_idx ON identities (LOWER(email));
+CREATE INDEX IF NOT EXISTS identities_alt_email_1_idx ON identities (LOWER(alt_email_1));
+CREATE INDEX IF NOT EXISTS identities_alt_email_2_idx ON identities (LOWER(alt_email_2));
+CREATE INDEX IF NOT EXISTS identities_handle_idx ON identities (LOWER(handle));

server/src/auth/atproto-admin.ts

@@ -9,9 +9,11 @@ import pg from "../db/pg-query";
 
 // eslint-disable-next-line no-restricted-properties
 const FEEDGEN_DATABASE_URL = process.env.FEEDGEN_DATABASE_URL || "";
+// eslint-disable-next-line no-restricted-properties
+const FEEDGEN_MEMBER_LIST = process.env.FEEDGEN_MEMBER_LIST || "blacksky";
 let feedgenPool: pgLib.Pool | null = null;
 
-function getFeedgenPool(): pgLib.Pool {
+export function getFeedgenPool(): pgLib.Pool {
   if (!feedgenPool) {
     // Strip sslmode from URL — we configure SSL via the pool options
     const connStr = FEEDGEN_DATABASE_URL.replace(/[?&]sslmode=[^&]*/g, '');
@@ -24,6 +26,10 @@ function getFeedgenPool(): pgLib.Pool {
   return feedgenPool;
 }
 
+export function isFeedgenConfigured(): boolean {
+  return !!FEEDGEN_DATABASE_URL;
+}
+
 const JWT_ALGORITHM = "RS256" as const;
 const JWT_EXPIRATION_SECONDS = 30 * 24 * 60 * 60; // 30 days
 
@@ -185,8 +191,8 @@ export async function checkMembershipBatch(
   try {
     const pool = getFeedgenPool();
     const result = await pool.query(
-      "SELECT DISTINCT did FROM membership WHERE did = ANY($1) AND included = true AND list = 'blacksky'",
-      [dids]
+      "SELECT DISTINCT did FROM membership WHERE did = ANY($1) AND included = true AND list = $2",
+      [dids, FEEDGEN_MEMBER_LIST]
     );
     return new Set(result.rows.map((r: any) => r.did));
   } catch (err) {
@@ -223,7 +229,7 @@ const OC_MEMBERS_QUERY = `
   }
 `;
 
-async function fetchOcMembersByRole(
+export async function fetchOcMembersByRole(
   role: string,
 ): Promise<Set<string>> {
   const emails = new Set<string>();

server/src/auth/github-supporters.ts

@@ -288,6 +288,19 @@ export function isOssSupporter(
   return false;
 }
 
+/**
+ * Get the raw cache data for use by the identity sync cron.
+ * Returns null if cache isn't ready yet.
+ */
+export function getGithubSupporterData(): {
+  dids: Set<string>;
+  handles: Set<string>;
+  emails: Set<string>;
+} | null {
+  if (!cache.ready) return null;
+  return { dids: cache.dids, handles: cache.handles, emails: cache.emails };
+}
+
 /**
  * Ensure cache is populated. Call on server startup or first request.
  */