fix(db): chain users migration off c7d8e9f0a1b2; persist dev user on NO_LOGIN (#586)

Address review on #980:
- Drop obsolete merge revision f0e1d2c3b4a5; main already merges the two
  embedding heads via c7d8e9f0a1b2 (#979). Second merge left two Alembic heads.
- Point users migration at c7d8e9f0a1b2 and update the Revises docstring.
  Verified: flask db heads reports a single head; upgrade/downgrade/upgrade
  clean on Postgres.
- NO_LOGIN dev login now upserts the User and sets session['user_id'] when
  CRE_ENABLE_LOGIN is on, so local dev sessions have a row for user-scoped
  endpoints. Covered by tests for flag-on and flag-off.
- Narrow login persistence except from Exception to SQLAlchemyError.

Author: skypank-coder

application/tests/web_main_test.py

@@ -1219,6 +1219,47 @@ def test_callback_does_not_persist_when_login_flag_off(
 
         self.assertEqual(sqla.session.query(db.User).count(), 0)
 
+    def test_no_login_dev_path_persists_user_and_sets_session(self) -> None:
+        # NO_LOGIN=1 bypasses OAuth for local dev. It must still upsert a User
+        # and set session['user_id'], otherwise the dev session looks logged in
+        # but user-scoped endpoints have no row to hang a selection on.
+        self.app.secret_key = "test-secret"
+        with patch.dict(
+            os.environ,
+            {
+                "NO_LOGIN": "1",
+                "CRE_ENABLE_LOGIN": "1",
+                "NO_LOAD_GRAPH_DB": "1",
+                "INSECURE_REQUESTS": "1",
+            },
+        ):
+            with self.app.test_client() as client:
+                client.get("/rest/v1/login")
+                with client.session_transaction() as sess:
+                    self.assertIn("user_id", sess)
+                    session_user_id = sess["user_id"]
+
+        users = sqla.session.query(db.User).all()
+        self.assertEqual(len(users), 1)
+        self.assertEqual(users[0].google_sub, "some dev id")
+        self.assertEqual(session_user_id, users[0].id)
+
+    def test_no_login_dev_path_does_not_persist_when_flag_off(self) -> None:
+        self.app.secret_key = "test-secret"
+        with patch.dict(
+            os.environ,
+            {
+                "NO_LOGIN": "1",
+                "NO_LOAD_GRAPH_DB": "1",
+                "INSECURE_REQUESTS": "1",
+            },
+        ):
+            os.environ.pop("CRE_ENABLE_LOGIN", None)
+            with self.app.test_client() as client:
+                client.get("/rest/v1/login")
+
+        self.assertEqual(sqla.session.query(db.User).count(), 0)
+
     @patch("application.web.web_main.id_token")
     @patch("application.web.web_main.CREFlow")
     def test_callback_skips_persistence_when_sub_missing(

application/web/web_main.py

@@ -44,6 +44,7 @@
 )
 from google.oauth2 import id_token
 from google_auth_oauthlib.flow import Flow
+from sqlalchemy.exc import SQLAlchemyError
 from application.utils.spreadsheet import write_csv
 import oauthlib
 import google.auth.transport.requests
@@ -1165,6 +1166,21 @@ def login():
         session["state"] = {"state": True}
         session["google_id"] = "some dev id"
         session["name"] = "dev user"
+        # Persist the dev account as well, so local/dev sessions carry a real
+        # user_id for user-scoped endpoints to hang data on. Without this the
+        # dev session looks logged in but has no User row. Mirrors the callback.
+        if is_login_enabled():
+            try:
+                user = db.Node_collection().upsert_user(
+                    google_sub=session["google_id"],
+                    email="",
+                    display_name=session["name"],
+                )
+                session["user_id"] = user.id
+            except SQLAlchemyError as e:
+                logger.error(
+                    "failed to persist dev user on login: %s", type(e).__name__
+                )
         return redirect("/chatbot")
     flow_instance = CREFlow.instance()
     authorization_url, state = flow_instance.flow.authorization_url()
@@ -1236,9 +1252,11 @@ def callback():
                     display_name=id_info.get("name"),
                 )
                 session["user_id"] = user.id
-            except Exception as e:
-                # Avoid logging the raw exception: it can carry SQL parameters
-                # such as the user's email or OIDC subject. Log only the class.
+            except SQLAlchemyError as e:
+                # Keep DB failures soft so persistence can never block login, but
+                # let unexpected (non-DB) bugs surface instead of being swallowed.
+                # Log only the exception class: the message can carry SQL
+                # parameters such as the user's email or OIDC subject.
                 logger.error("failed to persist user on login: %s", type(e).__name__)
     return redirect("/chatbot")
 

migrations/versions/a1b2c3d4e5f6_add_users_and_resource_selection.py

@@ -1,7 +1,7 @@
 """add users and user_resource_selection tables (issue #586)
 
 Revision ID: a1b2c3d4e5f6
-Revises: f0e1d2c3b4a5
+Revises: c7d8e9f0a1b2
 Create Date: 2026-07-08
 
 """
@@ -11,7 +11,7 @@
 
 
 revision = "a1b2c3d4e5f6"
-down_revision = "f0e1d2c3b4a5"
+down_revision = "c7d8e9f0a1b2"
 branch_labels = None
 depends_on = None