ChatGPT's update to harden software and run db updates.

2026-10-21 06:53:45 -04:00
parent 1e63076123
commit acc8cb70f5
171 changed files with 9325 additions and 404 deletions
@@ -0,0 +1,27 @@
+<?php
+/** Explicit account selection; never promotes every legacy administrator. */
+if(PHP_SAPI!=='cli'){http_response_code(404);exit;}
+require_once __DIR__.'/../classes/Base.php';
+$db=(new Base())->connect();
+$columns=$db->query('SHOW COLUMNS FROM club_memberships')->fetchAll(PDO::FETCH_COLUMN);
+if(!in_array('membership_role',$columns,true))$db->exec("ALTER TABLE club_memberships ADD COLUMN membership_role ENUM('member','administrator') NOT NULL DEFAULT 'member'");
+// Club display names are tenant-local, not a global account lookup key.
+$index=$db->query("SHOW INDEX FROM clubs WHERE Key_name='club_name'")->fetch();
+if($index && !(int)$index['Non_unique'])$db->exec('ALTER TABLE clubs DROP INDEX club_name, ADD INDEX club_name (club_name)');
+foreach(explode(';',file_get_contents(__DIR__.'/../migrations/004_tenants.sql')) as $sql)if(trim($sql))$db->exec($sql);
+$email=getenv('HCR_SUPER_ADMIN_EMAIL')?:'';
+if($email!==''){
+ if(!filter_var($email,FILTER_VALIDATE_EMAIL))throw new RuntimeException('Use a valid existing Super System Administrator email.');
+ $db->beginTransaction();
+ try{
+  $stmt=$db->prepare("SELECT user_serial,user_role FROM users WHERE user_email=? AND user_status='active' FOR UPDATE");$stmt->execute([$email]);$user=$stmt->fetch();
+  if(!$user)throw new RuntimeException('The selected active account does not exist. No account was promoted.');
+  if($user['user_role']!==TenantAccess::SUPER){
+   $stmt=$db->prepare('UPDATE users SET user_role=?,user_auth_version=user_auth_version+1 WHERE user_serial=?');$stmt->execute([TenantAccess::SUPER,$user['user_serial']]);
+   foreach(['password_resets','email_verifications'] as $table){$stmt=$db->prepare('DELETE FROM '.$table.' WHERE user_serial=?');$stmt->execute([$user['user_serial']]);}
+   Audit::required($db,(int)$user['user_serial'],'designated Super System Administrator by CLI migration');
+  }
+  $db->commit();
+ }catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;}
+}
+echo "Tenant schema is ready. Existing clubs require explicit administrator assignments; no memberships were guessed.\n";