fix(sponsor-panel): merge split github id columns

GORM derives the column name git_hub_id from the field name GitHubID,
but the schema has always called that column github_id. An early
AutoMigrate added a second column, so Create wrote git_hub_id while
upsertUser looked up github_id.

Every user who registered after that point missed the lookup on each
later login, inserted a duplicate row, and violated the unique index
users_github_id_key. 32 of 90 accounts could not refresh their
sponsorship data.

Pin the column name in the model, match on the struct field instead of
a literal column name, and merge the two columns at startup.

Assisted-by: Claude Opus 5 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>

Author: Xe

cmd/sponsor-panel/main.go

@@ -173,6 +173,12 @@ func main() {
 
 	slog.Info("main: database connection established")
 
+	// Merge the split GitHub ID columns before AutoMigrate inspects them.
+	if err := consolidateGitHubIDColumn(db); err != nil {
+		slog.Error("failed to consolidate GitHub ID columns", "err", err)
+		os.Exit(1)
+	}
+
 	// Run GORM AutoMigrate
 	slog.Debug("main: running GORM auto-migration")
 	if err := db.AutoMigrate(PanelModels()...); err != nil {
@@ -181,6 +187,11 @@ func main() {
 	}
 	slog.Info("main: auto-migration completed")
 
+	if err := dropEmailUniqueIndex(db); err != nil {
+		slog.Error("failed to drop email unique index", "err", err)
+		os.Exit(1)
+	}
+
 	// Start sponsor sync loop in background
 	syncCtx, syncCancel := context.WithCancel(context.Background())
 	defer syncCancel()

cmd/sponsor-panel/migration_test.go

@@ -0,0 +1,193 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+// productionSchema recreates the users table as it stood before the GitHub ID
+// columns were merged: a legacy github_id column plus the git_hub_id column
+// that GORM derived from the field name.
+const productionSchema = `
+DROP TABLE IF EXISTS logo_submissions;
+DROP TABLE IF EXISTS users;
+
+CREATE TABLE users (
+    id                     serial PRIMARY KEY,
+    github_id              bigint,
+    login                  text NOT NULL,
+    avatar_url             text,
+    name                   text,
+    email                  text,
+    sponsorship_data       jsonb,
+    last_sponsorship_check timestamp,
+    created_at             timestamp,
+    updated_at             timestamp,
+    patreon_id             text,
+    provider               text NOT NULL DEFAULT 'github',
+    git_hub_id             bigint,
+    thoth_user_id          text
+);
+
+CREATE UNIQUE INDEX idx_users_provider_login ON users (provider, login);
+CREATE UNIQUE INDEX users_github_id_key ON users (git_hub_id);
+CREATE UNIQUE INDEX users_patreon_id_key ON users (patreon_id);
+
+INSERT INTO users (github_id, git_hub_id, patreon_id, login, provider) VALUES
+    (1111, NULL, NULL, 'legacy-only', 'github'),
+    (NULL, 2222, NULL, 'gorm-only',   'github'),
+    (NULL, NULL,  'p1', 'patreon-only', 'patreon');
+`
+
+// testDB connects to a throwaway PostgreSQL instance. Set SPONSOR_PANEL_TEST_DSN
+// to run the migration tests.
+func testDB(t *testing.T) *gorm.DB {
+	t.Helper()
+
+	dsn := os.Getenv("SPONSOR_PANEL_TEST_DSN")
+	if dsn == "" {
+		t.Skip("SPONSOR_PANEL_TEST_DSN is not set")
+	}
+
+	db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: logger.Discard})
+	if err != nil {
+		t.Fatalf("gorm.Open: %v", err)
+	}
+
+	if err := db.Exec(productionSchema).Error; err != nil {
+		t.Fatalf("cannot create the test schema: %v", err)
+	}
+
+	return db
+}
+
+// columnNames returns the columns of the users table.
+func columnNames(t *testing.T, db *gorm.DB) map[string]bool {
+	t.Helper()
+
+	var names []string
+	err := db.Raw(`SELECT column_name FROM information_schema.columns
+	               WHERE table_name = 'users' AND table_schema = current_schema()`).Scan(&names).Error
+	if err != nil {
+		t.Fatalf("cannot read the users columns: %v", err)
+	}
+
+	out := map[string]bool{}
+	for _, n := range names {
+		out[n] = true
+	}
+	return out
+}
+
+// TestConsolidateGitHubIDColumn verifies the merge against a real database.
+func TestConsolidateGitHubIDColumn(t *testing.T) {
+	db := testDB(t)
+
+	if err := consolidateGitHubIDColumn(db); err != nil {
+		t.Fatalf("consolidateGitHubIDColumn: %v", err)
+	}
+
+	cols := columnNames(t, db)
+	if cols["git_hub_id"] {
+		t.Error("users.git_hub_id still exists after the merge")
+	}
+	if !cols["github_id"] {
+		t.Fatal("users.github_id is missing after the merge")
+	}
+
+	for _, tt := range []struct {
+		login string
+		want  int64
+	}{
+		{login: "legacy-only", want: 1111},
+		{login: "gorm-only", want: 2222},
+	} {
+		t.Run(tt.login, func(t *testing.T) {
+			var got int64
+			if err := db.Raw(`SELECT github_id FROM users WHERE login = ?`, tt.login).Scan(&got).Error; err != nil {
+				t.Fatalf("cannot read github_id: %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("github_id for %s = %d, want %d", tt.login, got, tt.want)
+			}
+		})
+	}
+
+	// The unique index must follow the column, or duplicate accounts return.
+	var indexed string
+	err := db.Raw(`SELECT indexdef FROM pg_indexes
+	               WHERE tablename = 'users' AND indexname = 'users_github_id_key'`).Scan(&indexed).Error
+	if err != nil {
+		t.Fatalf("cannot read the index definition: %v", err)
+	}
+	if indexed == "" {
+		t.Fatal("users_github_id_key is missing after the merge")
+	}
+	if !strings.Contains(indexed, "(github_id)") {
+		t.Errorf("users_github_id_key = %q, want an index on github_id", indexed)
+	}
+
+	// AutoMigrate must not re-create the derived column.
+	if err := db.AutoMigrate(PanelModels()...); err != nil {
+		t.Fatalf("AutoMigrate: %v", err)
+	}
+	if columnNames(t, db)["git_hub_id"] {
+		t.Error("AutoMigrate re-created users.git_hub_id")
+	}
+
+	// A second run must do nothing.
+	if err := consolidateGitHubIDColumn(db); err != nil {
+		t.Fatalf("consolidateGitHubIDColumn is not idempotent: %v", err)
+	}
+}
+
+// TestUpsertUserFindsMigratedRows verifies that a login after the merge updates
+// the existing row instead of inserting a duplicate.
+func TestUpsertUserFindsMigratedRows(t *testing.T) {
+	db := testDB(t)
+
+	if err := consolidateGitHubIDColumn(db); err != nil {
+		t.Fatalf("consolidateGitHubIDColumn: %v", err)
+	}
+	if err := db.AutoMigrate(PanelModels()...); err != nil {
+		t.Fatalf("AutoMigrate: %v", err)
+	}
+
+	var before int64
+	db.Model(&PanelUser{}).Count(&before)
+
+	for _, tt := range []struct {
+		name  string
+		id    int64
+		login string
+	}{
+		{name: "row migrated from the legacy column", id: 1111, login: "legacy-only"},
+		{name: "row written by GORM", id: 2222, login: "gorm-only"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			user := &PanelUser{
+				GitHubID:        &tt.id,
+				Login:           tt.login,
+				Name:            "updated",
+				SponsorshipData: `{"is_active":true,"monthly_amount_cents":5000}`,
+			}
+			if err := upsertUser(db, user); err != nil {
+				t.Fatalf("upsertUser: %v", err)
+			}
+			if user.Name != "updated" {
+				t.Errorf("Name = %q, want the update to survive", user.Name)
+			}
+		})
+	}
+
+	var after int64
+	db.Model(&PanelUser{}).Count(&after)
+	if after != before {
+		t.Errorf("user count = %d, want %d; upsertUser inserted duplicates", after, before)
+	}
+}

cmd/sponsor-panel/models.go

@@ -2,16 +2,20 @@ package main
 
 import (
 	"encoding/json"
+	"fmt"
 	"log/slog"
+	"strings"
 	"time"
 
 	"gorm.io/gorm"
 )
 
 // PanelUser represents an authenticated user with cached sponsorship data.
 type PanelUser struct {
-	ID                   uint      `json:"id" gorm:"primaryKey"`
-	GitHubID             *int64    `json:"github_id" gorm:"uniqueIndex:users_github_id_key"`
+	ID uint `json:"id" gorm:"primaryKey"`
+	// The column tag is mandatory. GORM derives git_hub_id from the field
+	// name, which does not match the column the schema has always used.
+	GitHubID             *int64    `json:"github_id" gorm:"column:github_id;uniqueIndex:users_github_id_key"`
 	PatreonID            *string   `json:"patreon_id" gorm:"uniqueIndex:users_patreon_id_key"`
 	Provider             string    `json:"provider" gorm:"not null;default:'github';uniqueIndex:idx_users_provider_login"`
 	Login                string    `json:"login" gorm:"not null;uniqueIndex:idx_users_provider_login"`
@@ -87,6 +91,104 @@ func PanelModels() []any {
 	}
 }
 
+// consolidateGitHubIDColumn merges the legacy users.git_hub_id column back
+// into users.github_id.
+//
+// The schema has always called this column github_id. GORM derives git_hub_id
+// from the field name GitHubID, so an early AutoMigrate added a second column
+// and writes went to one column while reads went to the other. Move the values
+// across, then take the original name back.
+//
+// Run this before AutoMigrate. It is a no-op once the columns are merged.
+func consolidateGitHubIDColumn(db *gorm.DB) error {
+	m := db.Migrator()
+
+	if !m.HasTable(&PanelUser{}) {
+		return nil
+	}
+
+	if !m.HasColumn(&PanelUser{}, "git_hub_id") {
+		return nil
+	}
+
+	hasLegacy := m.HasColumn(&PanelUser{}, "github_id")
+
+	return db.Transaction(func(tx *gorm.DB) error {
+		if hasLegacy {
+			res := tx.Exec(`UPDATE users SET git_hub_id = github_id WHERE git_hub_id IS NULL AND github_id IS NOT NULL`)
+			if res.Error != nil {
+				return fmt.Errorf("cannot backfill users.git_hub_id: %w", res.Error)
+			}
+			slog.Info("consolidateGitHubIDColumn: backfilled GitHub IDs", "rows", res.RowsAffected)
+
+			if err := tx.Exec(`ALTER TABLE users DROP COLUMN github_id`).Error; err != nil {
+				return fmt.Errorf("cannot drop the legacy users.github_id column: %w", err)
+			}
+		}
+
+		if err := tx.Exec(`ALTER TABLE users RENAME COLUMN git_hub_id TO github_id`).Error; err != nil {
+			return fmt.Errorf("cannot rename users.git_hub_id to github_id: %w", err)
+		}
+
+		slog.Info("consolidateGitHubIDColumn: users.git_hub_id is now users.github_id")
+		return nil
+	})
+}
+
+// emailUniqueIndex describes a legacy unique index on users(email).
+type emailUniqueIndex struct {
+	IndexName      string
+	ConstraintName string
+}
+
+// dropEmailUniqueIndex removes any legacy unique index on users(email).
+//
+// AutoMigrate never drops indexes, so a unique index created by an older
+// schema stays in the database forever. Look the index up in the catalog
+// because the name depends on how the old schema declared it.
+func dropEmailUniqueIndex(db *gorm.DB) error {
+	const findQuery = `
+SELECT i.relname AS index_name, COALESCE(c.conname, '') AS constraint_name
+FROM pg_index x
+JOIN pg_class i ON i.oid = x.indexrelid
+JOIN pg_class t ON t.oid = x.indrelid
+JOIN pg_namespace n ON n.oid = t.relnamespace
+LEFT JOIN pg_constraint c ON c.conindid = x.indexrelid
+WHERE t.relname = 'users'
+  AND n.nspname = current_schema()
+  AND x.indisunique
+  AND x.indnatts = 1
+  AND (SELECT a.attname FROM pg_attribute a WHERE a.attrelid = t.oid AND a.attnum = x.indkey[0]) = 'email'`
+
+	var found []emailUniqueIndex
+	if err := db.Raw(findQuery).Scan(&found).Error; err != nil {
+		return fmt.Errorf("cannot look up unique indexes on users(email): %w", err)
+	}
+
+	for _, idx := range found {
+		var stmt string
+		switch {
+		case idx.ConstraintName != "":
+			stmt = fmt.Sprintf("ALTER TABLE users DROP CONSTRAINT %s", quoteIdent(idx.ConstraintName))
+		default:
+			stmt = fmt.Sprintf("DROP INDEX %s", quoteIdent(idx.IndexName))
+		}
+
+		if err := db.Exec(stmt).Error; err != nil {
+			return fmt.Errorf("cannot drop unique index %s on users(email): %w", idx.IndexName, err)
+		}
+
+		slog.Info("dropEmailUniqueIndex: dropped unique index on users(email)", "index", idx.IndexName, "constraint", idx.ConstraintName)
+	}
+
+	return nil
+}
+
+// quoteIdent quotes a SQL identifier for PostgreSQL.
+func quoteIdent(name string) string {
+	return `"` + strings.ReplaceAll(name, `"`, `""`) + `"`
+}
+
 // --- DB helper functions (GORM) ---
 
 // getUserByID retrieves a user by ID from the database.
@@ -101,8 +203,14 @@ func getUserByID(db *gorm.DB, userID int) (*PanelUser, error) {
 
 // upsertUser creates or updates a GitHub user in the database.
 func upsertUser(db *gorm.DB, user *PanelUser) error {
+	if user.GitHubID == nil {
+		return fmt.Errorf("upsertUser: user %q has no GitHub ID", user.Login)
+	}
+
 	var existing PanelUser
-	result := db.Where("github_id = ?", user.GitHubID).First(&existing)
+	// Match on the struct field, not a literal column name. The field decides
+	// which column both this query and Create use, so the two cannot drift.
+	result := db.Where(&PanelUser{GitHubID: user.GitHubID}).First(&existing)
 	if result.Error == nil {
 		// Update existing
 		existing.Login = user.Login