refactor(integrations): consolidate integrations schema into baseline migration

apps/server/src/database/migrations/20260522T1264122-integrations.ts

@@ -3,6 +3,7 @@ import { type Kysely, sql } from 'kysely';
 export async function up(db: Kysely<any>): Promise<void> {
   await db.schema
     .createTable('integrations')
+    .ifNotExists()
     .addColumn('id', 'uuid', (col) =>
       col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
     )
@@ -30,6 +31,7 @@ export async function up(db: Kysely<any>): Promise<void> {
 
   await db.schema
     .createTable('integration_connections')
+    .ifNotExists()
     .addColumn('id', 'uuid', (col) =>
       col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
     )
@@ -43,25 +45,55 @@ export async function up(db: Kysely<any>): Promise<void> {
       col.references('workspaces.id').onDelete('cascade').notNull(),
     )
     .addColumn('provider_user_id', 'text')
-    .addColumn('access_token', 'text', (col) => col.notNull())
+    // Nullable: workspace-scoped rows carry a token; user-scoped identity-link
+    // rows have no token (the binding alone is what they store).
+    .addColumn('access_token', 'text')
     .addColumn('refresh_token', 'text')
     .addColumn('token_expires_at', 'timestamptz')
     .addColumn('scopes', 'text')
     .addColumn('metadata', 'jsonb')
+    // 'workspace' = one shared bot/app connection per integration (Slack);
+    // 'user' = a per-user OAuth token or identity link (Linear, GitHub, Slack
+    // identity binding). Enforced via a check constraint below.
+    .addColumn('kind', 'text', (col) => col.notNull().defaultTo('user'))
     .addColumn('created_at', 'timestamptz', (col) =>
       col.notNull().defaultTo(sql`now()`),
     )
     .addColumn('updated_at', 'timestamptz', (col) =>
       col.notNull().defaultTo(sql`now()`),
     )
-    .addUniqueConstraint('uq_integration_connections_integration_user', [
-      'integration_id',
-      'user_id',
-    ])
+    .execute();
+
+  await sql`
+    ALTER TABLE integration_connections
+    ADD CONSTRAINT integration_connections_kind_check
+    CHECK (kind IN ('workspace', 'user'))
+  `.execute(db);
+
+  // One workspace-bot connection per integration.
+  await db.schema
+    .createIndex('uq_integration_connections_workspace_per_integration')
+    .on('integration_connections')
+    .column('integration_id')
+    .where(sql.ref('kind'), '=', 'workspace')
+    .unique()
+    .execute();
+
+  // One user-link row per (integration, user). Partial on kind='user' so a
+  // workspace bot row sharing (integration_id, user_id) with the installer's
+  // personal user-link is NOT a conflict — they are semantically different
+  // rows with their own constraints.
+  await db.schema
+    .createIndex('uq_integration_connections_user_per_integration')
+    .on('integration_connections')
+    .columns(['integration_id', 'user_id'])
+    .where(sql.ref('kind'), '=', 'user')
+    .unique()
     .execute();
 
   await db.schema
     .createTable('integration_webhooks')
+    .ifNotExists()
     .addColumn('id', 'uuid', (col) =>
       col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
     )
@@ -85,6 +117,7 @@ export async function up(db: Kysely<any>): Promise<void> {
 
   await db.schema
     .createIndex('idx_integration_webhooks_integration_event')
+    .ifNotExists()
     .on('integration_webhooks')
     .columns(['integration_id', 'event_type'])
     .execute();