HAULDR-12: o storage-api atravessa o cutover junto com o projeto

O storage-api montava sua DATABASE_URL de config.adminUrl — pg16, sempre. A
constante era invisível enquanto a frota inteira estava no pg16, e o cutover
nunca tocou no storage (grep = zero ocorrências em cutover.ts). As duas somadas
deixaram 5 projetos servindo do pg17 com o metadado de arquivo indo pro pg16:
upload dá 200, os bytes chegam no Garage, e o app nunca vê o arquivo.

Re-provisionar não consertava — re-provisionar era o que reaplicava a constante.

- storageapi.ts: DATABASE_URL sai de adminDbUrlForCluster(clusterOf(name), db),
  a mesma lente que GoTrue/PostgREST/backups já usam. Para pg16 o resultado é
  byte-idêntico ao anterior.
- cutover.ts: stageB e rollback repontam o storage junto com auth/REST. Fatal
  como o REST (e diferente do realtime, que é provisionado-mas-sem-uso): storage
  é load-bearing, então falha tem que ser alta, não virar meio-movimento calado.

O schema storage já atravessa no stageA (o pg_dump só exclui `realtime`), então
é repoint puro, não migração de dados.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: valvesss

control-plane/src/cutover.ts

@@ -15,6 +15,7 @@ import { ensureGlobalRoles } from "./roles";
 import { poolerEnabled, registerTenant, terminateTenant } from "./supavisor";
 import { AUTH_HELPERS_SQL, provisionAuth } from "./gotrue";
 import { provisionRest } from "./postgrest";
+import { provisionStorageApi } from "./storageapi";
 import { provisionRealtime, realtimeEnabled } from "./realtime";
 
 /**
@@ -35,8 +36,9 @@ import { provisionRealtime, realtimeEnabled } from "./realtime";
  *   A — data move: roles, database, dump→restore (excluding `realtime`), compat
  *       baseline, reindex, integrity check. Idempotent + verifiable; the app is
  *       still serving from pg16 while this runs.
- *   B — flip: `projects.cluster='pg17'`, then re-provision auth/REST/realtime
- *       (now cluster-aware → they repoint at v17) + `notify pgrst` on the v17 db.
+ *   B — flip: `projects.cluster='pg17'`, then re-provision auth/REST/storage/
+ *       realtime (now cluster-aware → they repoint at v17) + `notify pgrst` on
+ *       the v17 db.
  */
 
 function ident(s: string) {
@@ -409,10 +411,22 @@ export async function stageB(name: string): Promise<void> {
   console.log(`[cutover ${name}] stageB 1/4 flip projects.cluster = pg17`);
   await controlPool.query("update projects set cluster = 'pg17' where name = $1", [name]);
 
-  console.log(`[cutover ${name}] stageB 2/4 repoint sidecars (auth, rest, realtime)`);
+  console.log(`[cutover ${name}] stageB 2/4 repoint sidecars (auth, rest, storage, realtime)`);
   await provisionAuth(name);
   // REST is à-la-carte — only repoint it if the project has it.
   if (await hasRest(name)) await provisionRest(name);
+  // Storage is à-la-carte too, and it is repointed for the same reason as REST:
+  // its metadata (storage.objects / storage.buckets, and the RLS on them) lives
+  // in the project db, so a storage-api left on pg16 writes file rows into a
+  // database the app no longer reads. That is silent — uploads succeed, the
+  // bytes land in Garage, and the app simply never sees the file. The schema
+  // itself crosses in stageA (pg_dump excludes only `realtime`), so this is a
+  // pure repoint, not a data move.
+  //
+  // Fatal, like REST and unlike realtime: realtime is provisioned-but-unused
+  // fleet-wide, storage is load-bearing. A failure here must be loud rather than
+  // leave the project half-moved and quietly writing to the wrong cluster.
+  if (await hasStorageApi(name)) await provisionStorageApi(name);
   // Realtime is à-la-carte + service-configured — only if enabled and registered.
   //
   // Non-fatal, deliberately. stageA excludes the service-managed `realtime`
@@ -466,6 +480,7 @@ export async function rollback(name: string): Promise<void> {
   console.log(`[cutover ${name}] rollback 2/3 repoint sidecars back to pg16`);
   await provisionAuth(name);
   if (await hasRest(name)) await provisionRest(name);
+  if (await hasStorageApi(name)) await provisionStorageApi(name);
   if (realtimeEnabled() && (await hasRealtime(name))) await provisionRealtime(name);
 
   // Symmetric with stageB: a tenant left on v17 would keep pooled traffic there
@@ -483,6 +498,13 @@ async function hasRest(name: string): Promise<boolean> {
   );
   return !!(rows[0]?.postgrest_url || rows[0]?.rest_requested);
 }
+async function hasStorageApi(name: string): Promise<boolean> {
+  const { rows } = await controlPool.query(
+    "select storage_api_url, storage_api_container from projects where name = $1",
+    [name],
+  );
+  return !!(rows[0]?.storage_api_url || rows[0]?.storage_api_container);
+}
 async function hasRealtime(name: string): Promise<boolean> {
   const { rows } = await controlPool.query(
     "select realtime_external_id from projects where name = $1",

control-plane/src/storageapi.ts

@@ -2,6 +2,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { controlPool } from "./db";
 import { config, projectHostLabel } from "./config";
+import { clusterOf, adminDbUrlForCluster } from "./clusters";
 import { coolifyProvisionStorageApi, coolifyDestroyStorageApi } from "./coolify";
 import { projectIdentity } from "./gotrue";
 import { provisionStorage } from "./storage";
@@ -16,16 +17,6 @@ export type ProjectStorageApi = {
   handle: string;
 };
 
-/** The Postgres URL storage-api uses to reach its database: the project's owner
- *  (postgres) — it installs the `storage` schema + roles and runs metadata
- *  queries, so it needs DDL. Per-request authorization still keys off the JWT.
- *  Mirrors GoTrue's internal admin connection. */
-function adminDbUrl(database: string): string {
-  const u = new URL(config.adminUrl);
-  const user = u.username || "postgres";
-  return `postgres://${user}:${u.password}@${config.authDbHost}:${config.authDbPort}/${database}?sslmode=disable`;
-}
-
 /**
  * Assemble what a per-project storage-api needs: its database (as the owner, for
  * the storage schema + metadata), the GoTrue JWT secret (so GoTrue tokens
@@ -36,6 +27,7 @@ function adminDbUrl(database: string): string {
  */
 async function prepareStorageApi(name: string): Promise<Record<string, string>> {
   const store = await provisionStorage(name);
+  const cluster = await clusterOf(name);
   const { rows } = await controlPool.query(
     "select database, jwt_secret from projects where name = $1",
     [name],
@@ -55,9 +47,18 @@ async function prepareStorageApi(name: string): Promise<Record<string, string>>
     // Supabase-shaped keys, minted from the secret (the `apikey` header + admin).
     ANON_KEY: mintApiKey("anon", secret),
     SERVICE_KEY: mintApiKey("service_role", secret),
-    // Metadata + schema live in the project DB; storage-api installs its schema
-    // and the storage roles on boot (idempotent against the existing base roles).
-    DATABASE_URL: adminDbUrl(row.database),
+    // Metadata + schema live in the project DB, ON THE PROJECT'S CLUSTER —
+    // storage-api installs its schema and the storage roles on boot (idempotent
+    // against the existing base roles), so it connects as that cluster's admin
+    // (`postgres` on pg16, `supabase_admin` on pg17). Per-request authorization
+    // still keys off the JWT.
+    //
+    // This used to build the URL from `config.adminUrl` — pg16, always. It was
+    // invisible while the whole fleet was on pg16, and it is what put five
+    // cut-over projects in split-brain: the project served from pg17 while its
+    // file metadata was written to the pg16 copy nobody reads. Re-provisioning
+    // could not fix it, because re-provisioning is what re-applied the constant.
+    DATABASE_URL: adminDbUrlForCluster(cluster, row.database),
     DB_INSTALL_ROLES: "true",
     // Bytes go to the project's Garage bucket via the S3 backend (path-style —
     // Garage requires it). The key is scoped to just this project's bucket.