fix: let user API key migration run on populated databases

Version20260702123347 added user.api_key as NOT NULL and then put a unique
index on it, so every existing user got the same empty string and the index
collided on the second row. Any database holding more than one user failed
to migrate.

Generate a key for each existing user before creating the index, matching
App\Entity\User::__construct, which gives every user created since #88 a key
of its own. The keys come from PHP rather than SQL because they are
credentials and SQL's RAND() and UUID() are not cryptographically secure.

Author: turegjorup

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+- [#90](https://github.com/itk-dev/devops_itksites/pull/90)
+  - Fixed user API key migration failing on databases with more than one user
+  - Generated an API key for existing users, as users created since already get
+  - Added users to the fixtures and a CI job running migrations on a populated
+    database
 - [#89](https://github.com/itk-dev/devops_itksites/pull/89)
   Added `--rm` to `docker compose run` in prod deployment
 - [#88](https://github.com/itk-dev/devops_itksites/pull/88)

migrations/Version20260702123347.php

@@ -19,8 +19,20 @@ public function getDescription(): string
 
     public function up(Schema $schema): void
     {
-        // this up() migration is auto-generated, please modify it to your needs
+        // Adding the column gives every existing user the same empty string,
+        // which collides on the unique index below as soon as a second user
+        // exists, so give each of them a key of their own first. Users created
+        // from here on get one from App\Entity\User::__construct.
+        //
+        // The keys are generated in PHP because they are credentials and have
+        // to come from a cryptographically secure source. SQL's RAND() and
+        // UUID() are not one.
         $this->addSql('ALTER TABLE user ADD api_key VARCHAR(255) NOT NULL');
+
+        foreach ($this->connection->fetchFirstColumn('SELECT email FROM user') as $email) {
+            $this->addSql('UPDATE user SET api_key = ? WHERE email = ?', [sha1(\random_bytes(40)), $email]);
+        }
+
         $this->addSql('CREATE UNIQUE INDEX UNIQ_8D93D649C912ED9D ON user (api_key)');
     }