build(security): add migration and CI security gates

backend/alembic/versions/20260728_01_baseline_schema.py

@@ -0,0 +1,57 @@
+"""Establish the tracked baseline schema and replace application-startup DDL.
+
+Revision ID: 20260728_01
+Revises:
+Create Date: 2026-07-28
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+from app.database import Base
+import app.models  # noqa: F401  # Register every model with Base.metadata.
+
+
+revision: str = "20260728_01"
+down_revision: str | None = None
+branch_labels: Sequence[str] | None = None
+depends_on: Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Create the current schema and upgrade tables created by older app versions."""
+    bind = op.get_bind()
+    Base.metadata.create_all(bind=bind, checkfirst=True)
+
+    # These columns were historically added in application startup code.  Keep this
+    # compatibility path so existing deployments can adopt Alembic safely.
+    statements = (
+        "ALTER TABLE customers ADD COLUMN IF NOT EXISTS remarks TEXT DEFAULT ''",
+        "ALTER TABLE visits ADD COLUMN IF NOT EXISTS visitor_name VARCHAR(50) DEFAULT ''",
+        "ALTER TABLE visits ADD COLUMN IF NOT EXISTS visitor_phone VARCHAR(20) DEFAULT ''",
+        "ALTER TABLE users ADD COLUMN IF NOT EXISTS require_report BOOLEAN DEFAULT TRUE",
+        "ALTER TABLE customers ADD COLUMN IF NOT EXISTS last_visit_date DATE",
+        "ALTER TABLE customers ADD COLUMN IF NOT EXISTS last_visit_manager_id UUID",
+        "ALTER TABLE visits ADD COLUMN IF NOT EXISTS companion_names TEXT[] DEFAULT '{}'",
+        "ALTER TABLE users ADD COLUMN IF NOT EXISTS color VARCHAR(7)",
+        "ALTER TABLE visits ADD COLUMN IF NOT EXISTS edit_log JSONB DEFAULT '[]'",
+        "ALTER TABLE daily_notes ADD COLUMN IF NOT EXISTS edit_log JSONB DEFAULT '[]'",
+        "ALTER TABLE work_plans ADD COLUMN IF NOT EXISTS edit_log JSONB DEFAULT '[]'",
+        "ALTER TABLE mini_business ADD COLUMN IF NOT EXISTS edit_log JSONB DEFAULT '[]'",
+        "ALTER TABLE key_visits ADD COLUMN IF NOT EXISTS edit_log JSONB DEFAULT '[]'",
+        "CREATE UNIQUE INDEX IF NOT EXISTS uq_users_wecom_userid "
+        "ON users (wecom_userid) WHERE wecom_userid IS NOT NULL",
+    )
+    for statement in statements:
+        op.execute(statement)
+
+
+def downgrade() -> None:
+    """Remove only objects introduced by the tracked security hardening revision.
+
+    The historical base tables pre-date Alembic and may contain production data, so
+    they are deliberately not dropped by a downgrade operation.
+    """
+    op.execute("DROP INDEX IF EXISTS uq_users_wecom_userid")
+    op.execute("DROP TABLE IF EXISTS wecom_bind_tokens")

backend/alembic/versions/__init__.py

@@ -0,0 +1 @@
+"""Alembic migration revisions for the Qiji backend."""