chore: standardize security and quality foundations

backend/app/db.py

@@ -13,6 +13,7 @@ from .config import settings
 from .models import Snapshot
 from .security import hash_password, verify_and_update_password, verify_password
 from .secret_storage import decrypt_setting_value, encrypt_setting_value, is_sensitive_setting
+from .schema_migrations import run_schema_migrations
 
 logger = logging.getLogger(__name__)
 
@@ -686,163 +687,9 @@ def init_db() -> None:
             ON user_activity (last_seen_at)
             """
         )
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN email TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN last_login_at TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN is_blocked INTEGER NOT NULL DEFAULT 0")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN auth_provider TEXT NOT NULL DEFAULT 'local'")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN jellyfin_password_hash TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN last_jellyfin_auth_at TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN jellyseerr_user_id INTEGER")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN auto_search_enabled INTEGER NOT NULL DEFAULT 1")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN invite_management_enabled INTEGER NOT NULL DEFAULT 0")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN profile_id INTEGER")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN expires_at TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN invited_by_code TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN invited_at TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN auth_version INTEGER NOT NULL DEFAULT 1")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE signup_invites ADD COLUMN recipient_email TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE signup_invites ADD COLUMN code_hint TEXT")
-        except sqlite3.OperationalError:
-            pass
+        run_schema_migrations(conn)
         _protect_legacy_signup_invite_codes(conn)
         _encrypt_legacy_sensitive_settings(conn)
-        try:
-            conn.execute("ALTER TABLE portal_items ADD COLUMN related_item_id INTEGER")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE portal_items ADD COLUMN workflow_request_status TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE portal_items ADD COLUMN workflow_media_status TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE portal_items ADD COLUMN issue_type TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE portal_items ADD COLUMN issue_resolved_at TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE portal_items ADD COLUMN metadata_json TEXT")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute(
-                """
-                CREATE INDEX IF NOT EXISTS idx_portal_items_workflow
-                ON portal_items (kind, workflow_request_status, workflow_media_status, updated_at DESC, id DESC)
-                """
-            )
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute(
-                """
-                CREATE INDEX IF NOT EXISTS idx_portal_items_related_item
-                ON portal_items (related_item_id, updated_at DESC, id DESC)
-                """
-            )
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute(
-                """
-                CREATE INDEX IF NOT EXISTS idx_users_profile_id
-                ON users (profile_id)
-                """
-            )
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute(
-                """
-                CREATE INDEX IF NOT EXISTS idx_users_expires_at
-                ON users (expires_at)
-                """
-            )
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute(
-                """
-                CREATE INDEX IF NOT EXISTS idx_users_username_nocase
-                ON users (username COLLATE NOCASE)
-                """
-            )
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute(
-                """
-                CREATE INDEX IF NOT EXISTS idx_users_email_nocase
-                ON users (email COLLATE NOCASE)
-                """
-            )
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE requests_cache ADD COLUMN requested_by_id INTEGER")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute(
-                """
-                CREATE INDEX IF NOT EXISTS idx_requests_cache_requested_by_id
-                ON requests_cache (requested_by_id)
-                """
-            )
-        except sqlite3.OperationalError:
-            pass
         try:
             conn.execute("PRAGMA optimize")
         except sqlite3.OperationalError: