0001_initial.py: restore create_type=False on the two inline ENUM column
declarations (world_visibility, asset_type) -- this task's own auto-checkpoint
had accidentally reverted the 2026-08-18 fix (PR #25) while working on an
unrelated file.
0003_add_moderation_tables_and_user_roles.py: same bug pattern, self-inflicted
this time -- added create_type=False to all 8 inline column ENUM declarations
(user_role, target_type x2, reason_category, report_status, resolution,
action_type, appeal_status). Also shortened the revision id from
0003_add_moderation_tables_and_user_roles (42 chars) to 0003_moderation_schema
(23 chars) -- alembic_version.version_num is VARCHAR(32) by default, so the
migration ran to completion and then failed writing its own bookkeeping row.
Verified against a genuinely fresh Postgres container: full chain
(0001 -> 0002 -> 0003) now runs clean, all 8 tables land.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
world_visibility and asset_type were each declared twice: once explicitly
via `.create(checkfirst=True)`, and again implicitly by SQLAlchemy when
create_table() compiled the inline postgresql.ENUM() column type (which
defaults create_type=True). On a genuinely empty database this raises
asyncpg.DuplicateObjectError mid-transaction and the migration never
completes -- verified this was true 100% of the time from a fresh
container, meaning the backend has never successfully bootstrapped from
scratch. Fixed by passing create_type=False on the inline column
declarations, since the type is already created explicitly above.
Also parameterized both services' host ports (POSTGRES_HOST_PORT /
REDIS_HOST_PORT, defaulting to the original 5432/6379) so concurrent
agent workspaces sharing this same docker-compose.yml can run isolated
databases without colliding on the host port.
Requesting an explicit ?visibility=PRIVATE (or FRIENDS_ONLY) skipped the
ownership check entirely — any authenticated user could list every other
user's private worlds just by passing the filter. Only the no-filter
default path enforced ownership. Now the ownership check applies whenever
a non-PUBLIC visibility is requested, explicit or not.
Also fixed current_user: CurrentUser = Depends() in assets.py (redundant
empty Depends() on an already-Annotated dependency, inconsistent with
every other endpoint) to plain current_user: CurrentUser per the review
feedback, and reordered params since that made it a non-default arg
following a defaulted one (SyntaxError otherwise).
Verified: py_compile clean, full app imports and loads in a clean venv.
config.py's DATABASE_URL uses postgresql+asyncpg but requirements.txt
only listed the sync psycopg2-binary driver, causing ModuleNotFoundError
on app startup.
Scaffolding only — FastAPI app, SQLAlchemy models, Alembic migrations,
and docker-compose from the original task description are still not
implemented. Committing what exists so it isn't lost; task ec0074121ca3
reset to pending to finish the rest.
coder-bot
claude-mvp-fix
architect-bot
agent-bot