diff --git a/CHANGELOG.md b/CHANGELOG.md index 4ec7de6..3e00297 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Fixed +- Fixed `sqlalchemy.exc.DBAPIError` raised by asyncpg when inserting timezone-aware `datetime.now(timezone.utc)` values into timezone-naive `DateTime` (TIMESTAMP WITHOUT TIME ZONE) columns: changed all `DateTime` column definitions in `database_models.py` to `DateTime(timezone=True)` (TIMESTAMP WITH TIME ZONE) and replaced all `default=datetime.utcnow` callable references with `default=lambda: datetime.now(timezone.utc)` for consistent, timezone-aware timestamps throughout the ORM. - Fixed `ProgrammingError` (`cached statement plan is invalid`) raised by the asyncpg dialect during startup: SQLAlchemy's asyncpg wrapper maintains an LRU prepared-statement cache per connection (default size 100). When `Base.metadata.create_all()` executes `CREATE TYPE … AS ENUM` DDL inside a transaction, PostgreSQL invalidates the cached plans for that connection. The next enum-type existence check then fails because the dialect tries to reuse the now-stale prepared statement. Fix: set `prepared_statement_cache_size=0` in `connect_args` on `create_async_engine` to disable the cache entirely, which is the documented SQLAlchemy recommendation for DDL-at-startup scenarios. - Fixed `UndefinedTableError` on first boot: the lifespan startup event now calls `Base.metadata.create_all()` via the async engine before attempting to seed default settings, so all tables are created automatically when the database is empty (e.g., fresh PostgreSQL container with no Alembic migrations run yet). - Fixed frontend API calls being hardcoded to `http://localhost:8000` in production: `NEXT_PUBLIC_API_URL` is baked into the JavaScript bundle at Next.js build time, so it can never be overridden at container runtime. Replaced the `NEXT_PUBLIC_API_URL` mechanism with a Next.js Route Handler proxy at `/api/v1/[...path]` that reads `process.env.BACKEND_URL` at server startup and proxies all `/api/v1/*` requests to the real backend. The frontend Axios client now uses a relative base URL (`/api/v1`), which also eliminates the CORS issue since the browser only ever talks to the same-origin Next.js server. Update `BACKEND_URL=http://backend:8000` in `docker-compose.new.yml` (or your deployment env) to point the proxy at your backend. diff --git a/backend/app/models/database_models.py b/backend/app/models/database_models.py index b7b6b82..3bf2126 100644 --- a/backend/app/models/database_models.py +++ b/backend/app/models/database_models.py @@ -2,7 +2,7 @@ Database models for the multi-tenant POP3 forwarder application. """ -from datetime import datetime +from datetime import datetime, timezone from sqlalchemy import ( Column, Integer, @@ -93,14 +93,21 @@ class User(Base): ) # active, canceled, past_due stripe_customer_id = Column(String(255), unique=True, nullable=True) stripe_subscription_id = Column(String(255), unique=True, nullable=True) - subscription_expires_at = Column(DateTime, nullable=True) + subscription_expires_at = Column(DateTime(timezone=True), nullable=True) # Timestamps - created_at = Column(DateTime, default=datetime.utcnow, nullable=False) - updated_at = Column( - DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False + created_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, ) - last_login_at = Column(DateTime, nullable=True) + updated_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + onupdate=lambda: datetime.now(timezone.utc), + nullable=False, + ) + last_login_at = Column(DateTime(timezone=True), nullable=True) # Relationships mail_accounts = relationship( @@ -161,15 +168,22 @@ class MailAccount(Base): # Statistics total_emails_processed = Column(Integer, default=0) total_emails_failed = Column(Integer, default=0) - last_check_at = Column(DateTime, nullable=True) - last_successful_check_at = Column(DateTime, nullable=True) - last_error_at = Column(DateTime, nullable=True) + last_check_at = Column(DateTime(timezone=True), nullable=True) + last_successful_check_at = Column(DateTime(timezone=True), nullable=True) + last_error_at = Column(DateTime(timezone=True), nullable=True) last_error_message = Column(Text, nullable=True) # Timestamps - created_at = Column(DateTime, default=datetime.utcnow, nullable=False) + created_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + ) updated_at = Column( - DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + onupdate=lambda: datetime.now(timezone.utc), + nullable=False, ) # Relationships @@ -196,8 +210,12 @@ class ProcessingRun(Base): ) # Run details - started_at = Column(DateTime, default=datetime.utcnow, nullable=False) - completed_at = Column(DateTime, nullable=True) + started_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + ) + completed_at = Column(DateTime(timezone=True), nullable=True) duration_seconds = Column(Float, nullable=True) # Results @@ -233,7 +251,12 @@ class ProcessingLog(Base): ) # Log details - timestamp = Column(DateTime, default=datetime.utcnow, nullable=False, index=True) + timestamp = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + index=True, + ) level = Column(String(20), nullable=False) # INFO, WARNING, ERROR message = Column(Text, nullable=False) @@ -283,9 +306,16 @@ class NotificationConfig(Base): notify_threshold = Column(Integer, default=3) # Notify after N consecutive errors # Timestamps - created_at = Column(DateTime, default=datetime.utcnow, nullable=False) + created_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + ) updated_at = Column( - DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + onupdate=lambda: datetime.now(timezone.utc), + nullable=False, ) # Relationships @@ -319,9 +349,16 @@ class MailServerPreset(Base): popularity_score = Column(Integer, default=0) # For sorting recommendations # Timestamps - created_at = Column(DateTime, default=datetime.utcnow, nullable=False) + created_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + ) updated_at = Column( - DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + onupdate=lambda: datetime.now(timezone.utc), + nullable=False, ) @@ -358,9 +395,16 @@ class SubscriptionPlan(Base): is_active = Column(Boolean, default=True) # Timestamps - created_at = Column(DateTime, default=datetime.utcnow, nullable=False) + created_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + ) updated_at = Column( - DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + onupdate=lambda: datetime.now(timezone.utc), + nullable=False, ) @@ -388,7 +432,12 @@ class AuditLog(Base): status = Column(String(20), default="success") # success, failure # When - timestamp = Column(DateTime, default=datetime.utcnow, nullable=False, index=True) + timestamp = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + index=True, + ) # Indexes __table_args__ = ( @@ -415,17 +464,24 @@ class GmailCredential(Base): encrypted_refresh_token = Column(Text, nullable=True) # Token metadata - token_expiry = Column(DateTime, nullable=True) + token_expiry = Column(DateTime(timezone=True), nullable=True) scopes = Column(JSON, nullable=True) # Status is_valid = Column(Boolean, default=True) - last_verified_at = Column(DateTime, nullable=True) + last_verified_at = Column(DateTime(timezone=True), nullable=True) # Timestamps - created_at = Column(DateTime, default=datetime.utcnow, nullable=False) + created_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + ) updated_at = Column( - DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + onupdate=lambda: datetime.now(timezone.utc), + nullable=False, ) # Relationships @@ -453,7 +509,14 @@ class AppSetting(Base): category = Column(String(100), nullable=True, index=True) # Timestamps - created_at = Column(DateTime, default=datetime.utcnow, nullable=False) - updated_at = Column( - DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False + created_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + nullable=False, + ) + updated_at = Column( + DateTime(timezone=True), + default=lambda: datetime.now(timezone.utc), + onupdate=lambda: datetime.now(timezone.utc), + nullable=False, ) diff --git a/docs/TODO.md b/docs/TODO.md index 7e0244d..96418b7 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -15,7 +15,7 @@ Comprehensive task breakdown for repository improvements and production readines ### In Progress 🔨 - [ ] Enable rate limiting per user/tier - [x] Fix bare exception handlers throughout codebase -- [x] Update datetime usage to timezone-aware (datetime.now(timezone.utc)) +- [x] Update datetime usage to timezone-aware (`DateTime(timezone=True)` columns and `lambda: datetime.now(timezone.utc)` defaults; fixes `DBAPIError` from asyncpg on timezone-naive columns) - [ ] Validate redirect_uri to prevent open redirect vulnerabilities - [ ] Add per-user random salt for encryption (currently deterministic)