Re-land spacetime lock/unlock to prevent accidental database deletion#4888
Merged
Conversation
…4502) ## Motivation Feature request: "Is there any way we can lock a module to prevent it from being deleted? A bit concerned about some fat finger risk of accidentally deleting prod." ## Solution Adds a database lock mechanism. A locked database cannot be deleted until explicitly unlocked. ### New CLI Commands ```bash # Lock a database to prevent deletion spacetime lock my-database # Attempt to delete a locked database (fails with 403) spacetime delete my-database # Error: Database is locked and cannot be deleted. Run \`spacetime unlock\` first. # Unlock when you actually need to delete spacetime unlock my-database spacetime delete my-database ``` Both commands support `--server` and `--no-config` flags, and resolve the database from `spacetime.json` when no argument is given (same as `spacetime delete`). ### New HTTP API - `POST /v1/database/:name_or_identity/lock` -- Lock a database - `POST /v1/database/:name_or_identity/unlock` -- Unlock a database Both require the same authorization as `DELETE` (owner only). ### Implementation - Lock state stored in a separate `database_locks` sled tree in the standalone control DB (avoids changing the `Database` struct and needing a data migration) - `ControlStateReadAccess::is_database_locked()` and `ControlStateWriteAccess::set_database_lock()` added to the trait - `delete_database` route checks lock state before proceeding; returns `403 Forbidden` with a descriptive message if locked - Locking is idempotent (locking an already-locked database is a no-op, same for unlock) - Lock only prevents deletion, not publishing updates ### What is NOT locked - `spacetime publish` (updating module code) still works on locked databases - Only `spacetime delete` is blocked This matches the intent: protect prod from accidental destruction while allowing normal deployments. --------- Co-authored-by: clockwork-labs-bot <clockwork-labs-bot@users.noreply.github.com>
clockwork-labs-bot
requested review from
bfops,
cloutiertyler and
jdetter
as code owners
…-lock # Conflicts: # crates/client-api/src/routes/database.rs
cloutiertyler
approved these changes
Jun 16, 2026
cloutiertyler
left a comment
cloutiertyler
left a comment
Contributor
There was a problem hiding this comment.
This already landed and just needs to be relanded because we rolled back for unrelated reasons.
…er' into bot/reopen-database-lock
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-lands #4502 on current
masterafter the revert in #4881.Summary
spacetime lock/spacetime unlockValidation
cargo fmt --all --checkcargo check -p spacetimedb-cli -p spacetimedb-client-api -p spacetimedb-standalone