feat: migration risk service, dialect wiring, MySQL stub, analyze endpoint

Author: notSumit25

backend/src/main/java/com/dbaagent/controller/MigrationRiskController.java

@@ -0,0 +1,39 @@
+package com.dbaagent.controller;
+
+import com.dbaagent.dto.MigrationRiskReport;
+import com.dbaagent.service.migration.MigrationRiskService;
+import com.dbaagent.service.security.AccessControlService;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.Map;
+
+@RestController
+@RequestMapping("/migrations")
+@RequiredArgsConstructor
+public class MigrationRiskController {
+
+    private final MigrationRiskService migrationRiskService;
+    private final AccessControlService accessControlService;
+
+    @PostMapping("/analyze")
+    public ResponseEntity<?> analyze(@RequestBody Map<String, String> body) {
+        String connectionId = body.get("connectionId");
+        String sql = body.get("sql");
+        if (connectionId == null || connectionId.isBlank() || sql == null || sql.isBlank()) {
+            return ResponseEntity.badRequest().body(Map.of("message", "connectionId and sql are required"));
+        }
+        try {
+            accessControlService.assertCanReadConnectionContent(connectionId);
+            MigrationRiskReport report = migrationRiskService.analyze(connectionId, sql);
+            return ResponseEntity.ok(report);
+        } catch (ResponseStatusException e) {
+            throw e;   // preserve 403/404 — a catch-all below would report it as a 500
+        } catch (Exception e) {
+            return ResponseEntity.internalServerError()
+                    .body(Map.of("message", "Migration analysis failed: " + e.getMessage()));
+        }
+    }
+}

backend/src/main/java/com/dbaagent/provider/api/DatabaseDialect.java

@@ -93,4 +93,10 @@ public interface DatabaseDialect {
      * @return The sampling provider
      */
     SamplingProvider sampling();
+
+    /**
+     * Get the migration risk provider for this database.
+     * @return The migration risk provider
+     */
+    MigrationRiskProvider migrationRisk();
 }

backend/src/main/java/com/dbaagent/provider/mysql/MySQLDialect.java

@@ -28,6 +28,7 @@ public class MySQLDialect implements DatabaseDialect {
     private final MySQLQueryExecutionProvider queryExecutionProvider;
     private final MySQLPrivilegeCheckProvider privilegeCheckProvider;
     private final MySQLSamplingProvider samplingProvider;
+    private final MySQLMigrationRiskProvider migrationRiskProvider;
 
     @Override
     public String getCanonicalName() {
@@ -93,4 +94,9 @@ public PrivilegeCheckProvider privileges() {
     public SamplingProvider sampling() {
         return samplingProvider;
     }
+
+    @Override
+    public MigrationRiskProvider migrationRisk() {
+        return migrationRiskProvider;
+    }
 }

backend/src/main/java/com/dbaagent/provider/mysql/MySQLMigrationRiskProvider.java

@@ -0,0 +1,28 @@
+package com.dbaagent.provider.mysql;
+
+import com.dbaagent.dto.MigrationRiskReport;
+import com.dbaagent.dto.TableFacts;
+import com.dbaagent.provider.api.MigrationRiskProvider;
+import com.dbaagent.service.migration.DdlFacts;
+import org.springframework.stereotype.Component;
+
+import java.util.List;
+
+/**
+ * MySQL migration risk is not implemented. Returning UNKNOWN is deliberate: MySQL's
+ * online-DDL matrix varies by version, storage engine and ALGORITHM/LOCK clause, and a
+ * confident wrong answer about a lock is worse than no answer.
+ */
+@Component
+public class MySQLMigrationRiskProvider implements MigrationRiskProvider {
+
+    @Override
+    public MigrationRiskReport classify(DdlFacts facts, TableFacts table) {
+        return new MigrationRiskReport("mysql", "UNKNOWN", false, false,
+                facts.operation().name(), facts.table(), List.of(), false,
+                table.rowEstimate(), table.sizeBytes(), "unknown",
+                "DeepSQL does not yet have verified MySQL DDL rules. Review this by hand.",
+                null, "https://dev.mysql.com/doc/refman/8.0/en/innodb-online-ddl-operations.html",
+                "unverified");
+    }
+}

backend/src/main/java/com/dbaagent/provider/postgres/PostgresDialect.java

@@ -28,6 +28,7 @@ public class PostgresDialect implements DatabaseDialect {
     private final PostgresQueryExecutionProvider queryExecutionProvider;
     private final PostgresPrivilegeCheckProvider privilegeCheckProvider;
     private final PostgresSamplingProvider samplingProvider;
+    private final PostgresMigrationRiskProvider migrationRiskProvider;
 
     @Override
     public String getCanonicalName() {
@@ -93,4 +94,9 @@ public PrivilegeCheckProvider privileges() {
     public SamplingProvider sampling() {
         return samplingProvider;
     }
+
+    @Override
+    public MigrationRiskProvider migrationRisk() {
+        return migrationRiskProvider;
+    }
 }

backend/src/main/java/com/dbaagent/service/migration/MigrationRiskService.java

@@ -0,0 +1,67 @@
+package com.dbaagent.service.migration;
+
+import com.dbaagent.dto.MigrationRiskReport;
+import com.dbaagent.dto.TableFacts;
+import com.dbaagent.model.ConnectionRequest;
+import com.dbaagent.provider.DatabaseProviderRegistry;
+import com.dbaagent.service.ConnectionService;
+import com.dbaagent.service.CredentialService;
+import com.dbaagent.service.security.AccessControlService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class MigrationRiskService {
+
+    private final DdlStatementParser parser;
+    private final DatabaseProviderRegistry registry;
+    private final CredentialService credentialService;
+    private final ConnectionService connectionService;
+    private final AccessControlService accessControlService;
+
+    public MigrationRiskReport analyze(String connectionId, String sql) {
+        accessControlService.assertCanReadConnectionContent(connectionId);
+
+        var parsed = parser.parse(sql);
+        if (parsed.isEmpty()) {
+            return failClosed("DeepSQL could not parse this statement, so it cannot verify what "
+                    + "it will do. Review it by hand before running it.");
+        }
+        var facts = parsed.get();
+
+        var request = credentialService.getDecryptedConnection(connectionId);
+        var dialect = registry.getDialect(request.getDbType());
+        var provider = dialect.migrationRisk();
+
+        TableFacts table = tableFacts(connectionId, request, facts.table());
+        return provider.classify(facts, table);
+    }
+
+    private TableFacts tableFacts(String connectionId, ConnectionRequest request, String table) {
+        try {
+            var jdbc = connectionService.getJdbcTemplate(connectionId, request);
+            var row = jdbc.queryForMap("""
+                    SELECT COALESCE(c.reltuples, 0)::bigint AS rows,
+                           COALESCE(pg_total_relation_size(c.oid), 0)::bigint AS bytes
+                    FROM pg_class c WHERE c.oid = ?::regclass
+                    """, table);
+            long rows = ((Number) row.get("rows")).longValue();
+            long bytes = ((Number) row.get("bytes")).longValue();
+            return new TableFacts(Math.max(rows, 0), bytes, rows == 0);
+        } catch (Exception e) {
+            // Unknown size is not a reason to claim safety — assume large.
+            log.warn("Could not read table facts for {}: {}", table, e.getMessage());
+            return new TableFacts(Long.MAX_VALUE, 0L, false);
+        }
+    }
+
+    private MigrationRiskReport failClosed(String reason) {
+        return new MigrationRiskReport("unknown", "UNKNOWN", false, true, "UNKNOWN", null,
+                List.of(), false, 0L, 0L, "unknown", reason, null, null, "unverified");
+    }
+}

backend/src/test/java/com/dbaagent/service/migration/MigrationRiskServiceTest.java

@@ -0,0 +1,49 @@
+package com.dbaagent.service.migration;
+
+import com.dbaagent.dto.MigrationRiskReport;
+import com.dbaagent.provider.DatabaseProviderRegistry;
+import com.dbaagent.provider.postgres.PostgresMigrationRiskProvider;
+import com.dbaagent.service.ConnectionService;
+import com.dbaagent.service.CredentialService;
+import com.dbaagent.service.security.AccessControlService;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.*;
+
+class MigrationRiskServiceTest {
+
+    @Test
+    void unparseableSqlFailsClosedWithoutTouchingTheDatabase() {
+        var access = mock(AccessControlService.class);
+        var credentials = mock(CredentialService.class);
+        var connections = mock(ConnectionService.class);
+        var registry = mock(DatabaseProviderRegistry.class);
+
+        var service = new MigrationRiskService(new DdlStatementParser(), registry,
+                credentials, connections, access);
+
+        MigrationRiskReport r = service.analyze("conn-1", "this is not sql");
+
+        assertThat(r.verdict()).isEqualTo("UNKNOWN");
+        assertThat(r.safeToRun()).isFalse();
+        verify(access).assertCanReadConnectionContent("conn-1");
+        verifyNoInteractions(connections);   // never opens a session for garbage input
+    }
+
+    @Test
+    void authorizationIsAssertedBeforeAnyWork() {
+        var access = mock(AccessControlService.class);
+        doThrow(new RuntimeException("denied")).when(access).assertCanReadConnectionContent(anyString());
+        var service = new MigrationRiskService(new DdlStatementParser(),
+                mock(DatabaseProviderRegistry.class), mock(CredentialService.class),
+                mock(ConnectionService.class), access);
+
+        org.assertj.core.api.Assertions
+            .assertThatThrownBy(() -> service.analyze("conn-1", "ALTER TABLE t ADD COLUMN c text"))
+            .hasMessageContaining("denied");
+    }
+}