fix(db): pin the Project bootstrap to the public schema

The replayed migration SQL and the script runner name tables unqualified, so a
connection search path that lists another schema first created the Project
foundation outside public. The refusal snapshot now also covers folders and
Projects.

Author: waleedlatif1

packages/db/scripts/project-push-bootstrap.integration.ts

@@ -69,6 +69,8 @@ async function retainedState(sql: Sql) {
   return {
     schema,
     workspaces: await sql`SELECT to_jsonb(w) AS row FROM workspace w ORDER BY id`,
+    folders: await sql`SELECT to_jsonb(f) AS row FROM folder f ORDER BY id`,
+    projects: schema.project ? await sql`SELECT to_jsonb(p) AS row FROM project p ORDER BY id` : [],
     connector: schema.connector
       ? await sql`SELECT * FROM project_workspace ORDER BY workspace_id`
       : [],
@@ -261,6 +263,20 @@ describe('development schema push of a database that predates Projects', () => {
     })
   }, 240_000)
 
+  it('bootstraps into public when the connection search path lists another schema first', async () => {
+    await preProjectDatabase(async (sql, url) => {
+      await sql`CREATE SCHEMA shadow`
+      const shadowed = new URL(url)
+      shadowed.searchParams.set('options', '-c search_path=shadow,public')
+      const pushed = runPush(shadowed.toString(), true)
+      expect(pushed.status, pushed.output).toBe(0)
+      const shadowTables = await sql`SELECT tablename FROM pg_tables WHERE schemaname = 'shadow'
+        AND tablename IN ('project', 'project_workspace', 'project_membership_rollout')`
+      await expectBootstrapped(sql)
+      expect(shadowTables).toEqual([])
+    })
+  }, 240_000)
+
   it('leaves the database untouched outside development push mode', async () => {
     await preProjectDatabase(async (sql, url) => {
       const refused = runPush(url, false)

packages/db/scripts/reconcile-project-membership.ts

@@ -99,6 +99,17 @@ async function expandProjects(mode: 'fresh' | 'resume'): Promise<void> {
   }
 }
 
+/** Migration SQL and the script runner name tables unqualified; pin them to `public`, as the migrator's default session does. */
+async function inPublicSchema(run: () => Promise<void>): Promise<void> {
+  const [settings] = await sql<{ search_path: string }[]>`SHOW search_path`
+  await sql`SELECT set_config('search_path', 'public, pg_temp', false)`
+  try {
+    await run()
+  } finally {
+    await sql`SELECT set_config('search_path', ${settings.search_path}, false)`
+  }
+}
+
 function assertProjectMembershipComplete(state: ProjectSchemaState): void {
   if (state.workspace && (state.connector || !state.projectIdNotNull || !state.project)) {
     throw new Error(REFUSAL)
@@ -117,13 +128,13 @@ try {
   if (process.argv.includes('--prepare')) {
     const bootstrap = await classifyProjectBootstrap(state)
     if (bootstrap) {
-      await expandProjects(bootstrap)
+      await inPublicSchema(() => expandProjects(bootstrap))
       state = await readProjectSchemaState()
     }
     if ((await classifyProjectBootstrap(state)) !== 'resume') assertProjectMembershipComplete(state)
   } else if (process.argv.includes('--bootstrap')) {
     if ((await classifyProjectBootstrap(state)) !== 'resume') throw new Error(REFUSAL)
-    await runScriptMigrations(sql, [projectMembershipMigration])
+    await inPublicSchema(() => runScriptMigrations(sql, [projectMembershipMigration]))
     assertProjectMembershipComplete(await readProjectSchemaState())
   } else {
     assertProjectMembershipComplete(state)