Merge pull request #42 from niteeshkanna-sh/claude/stoic-rubin-fnglq7

Run pending migrations when the panel loads

Author: niteeshkanna-sh

admin/admin.css

@@ -132,6 +132,14 @@ button { font-family: inherit; }
 .panel-header-link:hover { color: var(--primary); }
 .panel-header p { color: var(--ink-dim); font-size: 0.84rem; }
 
+/* Shown only when a migration could not be applied, which is rare and worth
+   interrupting for: the panel works, but something in it will not. */
+.migration-warning {
+  background: #FFF4E0; border-bottom: 1px solid var(--warning, #E8A317);
+  padding: 10px 16px; font-size: 0.9rem; color: var(--ink);
+}
+.migration-warning span { display: block; color: var(--ink-dim); font-size: 0.82rem; margin-top: 2px; }
+
 /* ---------- Vehicle photograph ---------- */
 .photo-field { display: flex; flex-direction: column; gap: 8px; }
 .photo-preview { display: flex; align-items: center; gap: 10px; }

admin/api/public-vehicles.php

@@ -57,11 +57,18 @@
 // edit in the panel take long to show up.
 header('Cache-Control: public, max-age=300');
 
+// Named only when it exists. A deploy adds the column, but the migration that
+// creates it does not run until someone opens the panel -- and this endpoint
+// serves the public website in the meantime. Selecting it unconditionally
+// meant a change made inside the admin could empty the fleet on the live site.
+$hasPhoto = table_has_column('vehicles', 'photo_file');
+$photoColumn = $hasPhoto ? 'v.photo_file,' : "NULL AS photo_file,";
+
 $rows = fetch_all(
     "SELECT v.id,
             v.name,
             v.brand,
-            v.photo_file,
+            $photoColumn
             v.body_type,
             v.fuel,
             v.transmission,

admin/api/vehicle-photo.php

@@ -23,6 +23,14 @@
     json_error('Which vehicle this belongs to was not sent.', 422);
 }
 
+// A clear sentence rather than a SQL error, for the window between a deploy
+// adding the column and the migration that creates it having run. Loading the
+// dashboard applies it, which is what the message says to do.
+if (!table_has_column('vehicles', 'photo_file')) {
+    json_error('The database has not been updated for photographs yet. '
+             . 'Open the Dashboard tab once and try again.', 503);
+}
+
 $vehicle = fetch_one('SELECT id, name, photo_file FROM vehicles WHERE id = ?', [$vehicleId]);
 if ($vehicle === null) {
     json_error('That vehicle no longer exists.', 404);

admin/dashboard.php

@@ -3,11 +3,33 @@
 
 require_once __DIR__ . '/src/csrf.php';
 require_once __DIR__ . '/src/assets.php';
+require_once __DIR__ . '/src/migrate.php';
 
 // Anyone reaching this page must already be signed in; require_login sends
 // them to the sign-in form otherwise.
 $me = require_login();
 
+// Apply any migration that has not run yet.
+//
+// They used to run only from install.php, which refuses once an account
+// exists, or from a button on the content page that nobody has a reason to
+// press. So a deploy could add a column and nothing would ever create it: the
+// code shipped, the database did not, and the first sign was a feature failing
+// with a SQL error. That happened -- the vehicle photograph column was added
+// and never existed.
+//
+// migrate() records what it has applied and skips those, so the cost here is
+// one small SELECT per dashboard load. A failure is reported rather than
+// thrown: a migration that cannot run is worth knowing about, and it is not a
+// reason to refuse to show a panel that otherwise works.
+$migrationError = null;
+try {
+    migrate();
+} catch (Throwable $e) {
+    error_log('migrate on dashboard load failed: ' . $e->getMessage());
+    $migrationError = $e->getMessage();
+}
+
 header('X-Frame-Options: DENY');
 header('X-Content-Type-Options: nosniff');
 header('Referrer-Policy: same-origin');
@@ -26,6 +48,13 @@
   <link rel="stylesheet" href="<?= asset('admin.css') ?>" />
 </head>
 <body>
+<?php if ($migrationError !== null): ?>
+  <div class="migration-warning">
+    <strong>The database is not fully up to date.</strong>
+    Some newer features may fail until this is resolved.
+    <span><?= e($migrationError) ?></span>
+  </div>
+<?php endif; ?>
 
   <!-- ===== Dashboard ===== -->
   <div class="dashboard" id="dashboard">

admin/src/db.php

@@ -295,3 +295,36 @@ function next_number(string $prefix, ?int $year = null): string
 
     return sprintf('%s-%d-%04d', $prefix, $year, $next);
 }
+
+/**
+ * Is this column on this table yet?
+ *
+ * Migrations only run when someone opens the panel, and the public website
+ * asks for the fleet whether or not anyone has signed in today. So between a
+ * deploy that adds a column and an admin next loading the dashboard, a query
+ * naming that column would fail -- and the failure would land on the public
+ * site's car listing, for a change made entirely inside the panel.
+ *
+ * Asked once per request and remembered, so a page reading several vehicles
+ * does not ask several times.
+ */
+function table_has_column(string $table, string $column): bool
+{
+    static $cache = [];
+    $key = $table . '.' . $column;
+
+    if (!array_key_exists($key, $cache)) {
+        // The table name cannot be a bound parameter, so it is checked against
+        // a pattern rather than trusted -- these are always literals in this
+        // codebase, and the day one is not is the day this matters.
+        if (!preg_match('/^[a-z_]+$/', $table)) {
+            return false;
+        }
+        try {
+            $cache[$key] = fetch_one("SHOW COLUMNS FROM `$table` LIKE ?", [$column]) !== null;
+        } catch (Throwable $e) {
+            $cache[$key] = false;
+        }
+    }
+    return $cache[$key];
+}