Gates legacy migration behind a legacy-database check

New users were always prompted to migrate, even on fresh or self-hosted installs. Now a newly created user is only sent to /migrate when an off-by-default config (CHECK_FOR_MIGRATION) is on and a matching github_id exists in the legacy database; everyone else starts migrated. Adds a read-only legacy connection and a LegacyMigration service mirroring the sponsorship check, with a logged failure path so a legacy-database hiccup never blocks sign-in.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: syropian

.env.example

@@ -63,6 +63,14 @@ GITHUB_SPONSOREE_LOGIN=syropian
 
 CHECK_FOR_SPONSORSHIP=true
 
+# Legacy migration (hosted instance only — leave off for local/self-hosted)
+CHECK_FOR_MIGRATION=false
+LEGACY_DB_HOST=127.0.0.1
+LEGACY_DB_PORT=3306
+LEGACY_DB_DATABASE=
+LEGACY_DB_USERNAME=
+LEGACY_DB_PASSWORD=
+
 VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 VITE_PUSHER_HOST="${PUSHER_HOST}"
 VITE_PUSHER_PORT="${PUSHER_PORT}"

app/Http/Controllers/AuthController.php

@@ -4,6 +4,7 @@
 
 namespace App\Http\Controllers;
 
+use App\Lib\LegacyMigration;
 use App\Lib\Sponsorship;
 use App\Models\User;
 use Illuminate\Http\Request;
@@ -33,7 +34,7 @@ public function redirectToProvider(Request $request)
             ->redirect();
     }
 
-    public function handleProviderCallback(Request $request, Sponsorship $sponsorship)
+    public function handleProviderCallback(Request $request, Sponsorship $sponsorship, LegacyMigration $migration)
     {
         $scope = $request->session()->pull('auth_scope', 'read:user');
 
@@ -50,6 +51,16 @@ public function handleProviderCallback(Request $request, Sponsorship $sponsorshi
 
         $user->save();
 
+        if ($user->wasRecentlyCreated) {
+            try {
+                $migration->markAsMigratedUnlessLegacy($user);
+            } catch (Throwable $e) {
+                // A legacy lookup failure must never block sign-in; the user stays
+                // gated to /migrate, which is harmless when they have no data.
+                Log::warning('Legacy migration check failed during login', ['user_id' => $user->id, 'exception' => $e]);
+            }
+        }
+
         if (config('app.check_for_sponsorship')) {
             try {
                 $sponsorship->updateUserSponsorshipStatus($user);

app/Lib/LegacyMigration.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Lib;
+
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+
+class LegacyMigration
+{
+    public function isEnabled(): bool
+    {
+        return (bool) config('app.check_for_migration');
+    }
+
+    public function hasLegacyAccount(User $user): bool
+    {
+        return DB::connection('legacy')
+            ->table('users')
+            ->where('github_id', $user->github_id)
+            ->exists();
+    }
+
+    public function markAsMigratedUnlessLegacy(User $user): void
+    {
+        if ($this->isEnabled() && $this->hasLegacyAccount($user)) {
+            return;
+        }
+
+        $user->markAsMigrated();
+    }
+}

config/app.php

@@ -138,6 +138,10 @@
 
     'check_for_sponsorship' => env('CHECK_FOR_SPONSORSHIP', false),
 
+    // Only the shared hosted instance has a legacy database to migrate from;
+    // local runners and self-hosters leave this off.
+    'check_for_migration' => env('CHECK_FOR_MIGRATION', false),
+
     /*
     |--------------------------------------------------------------------------
     | Maintenance Mode Driver

config/database.php

@@ -95,6 +95,24 @@
             // 'trust_server_certificate' => env('DB_TRUST_SERVER_CERTIFICATE', 'false'),
         ],
 
+        // Read-only connection to the previous-generation Astral database, used
+        // by the hosted instance to detect which users have data to migrate.
+        'legacy' => [
+            'driver' => env('LEGACY_DB_CONNECTION', 'mysql'),
+            'url' => env('LEGACY_DATABASE_URL'),
+            'host' => env('LEGACY_DB_HOST', '127.0.0.1'),
+            'port' => env('LEGACY_DB_PORT', '3306'),
+            'database' => env('LEGACY_DB_DATABASE'),
+            'username' => env('LEGACY_DB_USERNAME'),
+            'password' => env('LEGACY_DB_PASSWORD', ''),
+            'charset' => 'utf8mb4',
+            'collation' => 'utf8mb4_unicode_ci',
+            'prefix' => '',
+            'prefix_indexes' => true,
+            'strict' => true,
+            'engine' => null,
+        ],
+
     ],
 
     /*