Draft: Backfill iam_outbox for existing OAuth applications

Daniele Braccianirequested to merge
db/602678/backfill-iam-outbox-for-oauth-applications into master

Warning: do not merge until the iam_data_replication feature flag is enabled in production. This backfill seeds iam_outbox rows for the drain worker to deliver to the IAM stores. Merging before replication is live would accumulate rows that nothing consumes yet.

What does this MR do and why?

One-shot post-deployment migration that seeds an upsert iam_outbox row for every existing oauth_application, so the IAM stores are populated in a single pass. It complements the in-transaction model callbacks (added in the implementation MR) that capture ongoing mutations.

  • Batched each_batch + insert_all! over oauth_applications.
  • Gated on Gitlab.com_except_jh?; a no-op elsewhere.
  • Reversible: down is a no-op (the outbox is append-only and upserts are idempotent, since the drain re-reads Rails).

The migration depends only on the iam_outbox and oauth_applications tables, both already on master, so it has no code dependency on the implementation MR and can merge independently once the flag is enabled.

How to validate

The post-deploy migration seeds rows on GitLab.com; locally it is a no-op (Gitlab.com_except_jh? is false). See spec/migrations/20260716154924_backfill_iam_outbox_for_oauth_applications_spec.rb for the insert behavior (2 examples, both green).

Feature flag

iam_data_replication (wip, disabled by default). This migration is not itself flag-gated (migrations cannot check feature flags), so it must be deployed only when the flag is enabled in production.

References

Edited by Daniele Bracciani

Merge request reports