Remove typeorm (#1814)

Author: c-mac

.github/workflows/api.yml

@@ -109,3 +109,72 @@ jobs:
         run: cd api && make build
       - name: Run tests
         run: cd api && make api-test
+
+  # Ephemeral Postgres: alembic upgrade → Node schema contract + worker smoke → API tests
+  # (alerts CRUD, /stats fixture, admin list routes, alembic_version).
+  alerts_db_alembic_and_alerting:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      PRISM_ALERTS_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+      # Required to import prism_app.main during pytest collection (see docker-compose.yml defaults).
+      KOBO_USERNAME: kobo_user
+      KOBO_PASSWORD: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: snok/install-poetry@v1
+        with:
+          version: 2.2.1
+          virtualenvs-create: true
+          virtualenvs-in-project: true
+      - name: Install API dependencies
+        run: |
+          cd api
+          poetry install
+      - name: Upgrade pip (CVE-2026-1703)
+        run: |
+          cd api
+          poetry run pip install --upgrade 'pip>=26.0'
+      - name: Alembic upgrade head
+        run: cd api && poetry run alembic upgrade head
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Alerting install and DB checks
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: "true"
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+        run: |
+          cd alerting
+          yarn install --frozen-lockfile
+          yarn setup:common
+          yarn check-alerts-db-contract
+          yarn smoke-alerts-db-pool
+          yarn smoke-alerting-workers
+      - name: API alerts integration tests (same database)
+        env:
+          # Ubuntu runner Poetry venv has rasterio but not a full gdal_calc CLI like the API Docker image.
+          SKIP_GDAL_MASK_STATS_TEST: "1"
+        run: |
+          cd api
+          PYTHONPATH=. poetry run pytest \
+            prism_app/tests/test_api.py \
+            prism_app/tests/test_alerting.py \
+            prism_app/tests/test_alerts_db_integration.py \
+            -v --tb=short

alerting/.env.example

@@ -1,3 +1,4 @@
+# Copy to `.env`. `src/db/pool.ts` loads it via dotenv for local `yarn` / `ts-node` (host port 54321).
 PRISM_ALERTS_EMAIL_HOST=smtp.gmail.com
 PRISM_ALERTS_EMAIL_USER=prism.alerts.wfp@gmail.com
 PRISM_ALERTS_EMAIL_PASSWORD=test

alerting/.eslintrc

@@ -75,14 +75,6 @@
           }
         ]
       }
-    },
-    {
-      "files": [
-        "src/**/*.entity.{ts,js}"
-      ],
-      "rules": {
-        "import/no-cycle": "off"
-      }
     }
   ]
 }

alerting/README.md

@@ -9,7 +9,7 @@ There is a unique service running for all country specific frontends.
 
 ## Database schema and migrations
 
-The alerting stack uses the same PostgreSQL database as the PRISM API for `alert`, `user_info`, and `anticipatory_action_alerts`. **Python/Alembic under `api/alembic/` is the sole owner of new schema migrations** for this database. The TypeORM migration history in `migration/` remains useful as a record of how production was built, but **do not add new TypeORM migrations** for these tables or enums. Change SQLModel in `api/prism_app/database/`, add an Alembic revision under `api/alembic/versions/`, and run `alembic upgrade head` with `PRISM_ALERTS_DATABASE_URL` (see `api/README.md`).
+The alerting stack uses the same PostgreSQL database as the PRISM API for `alert`, `user_info`, and `anticipatory_action_alerts`. **Python/Alembic under `api/alembic/` is the sole owner of schema migrations** for this database. Change SQLModel in `api/prism_app/database/`, add an Alembic revision under `api/alembic/versions/`, and run `alembic upgrade head` with `PRISM_ALERTS_DATABASE_URL` (see `api/README.md`).
 
 ## Functionalities
 
@@ -23,18 +23,20 @@ The alerting stack uses the same PostgreSQL database as the PRISM API for `alert
 - Alerts are triggered by a cron job running within the `alerting-node` process.
 - Run `docker compose up` to launch the `alerting-node` and `alerting-db` processes.
 - The system checks database entries to determine **which country** needs to be triggered.
-- Currently, **Mozambique is supported**. After the DB schema exists (Alembic baseline / TypeORM history in prod), seed local data from the **API** (same repo area that owns migrations)—see **Local dev seed data** in [`api/README.md`](../api/README.md): `poetry run python scripts/seed_alerts_db.py` from `api/`. Connection vars are `PRISM_ALERTS_DATABASE_URL` or `POSTGRES_*` in `api/.env`; for host access to `alerting-db`, use port `54321` as in [`.env.example`](./.env.example).
+- Currently, **Mozambique is supported**. After the DB schema exists, seed local data from the **API** (same repo area that owns migrations)—see **Local dev seed data** in [`api/README.md`](../api/README.md): `poetry run python scripts/seed_alerts_db.py` from `api/`. Connection vars are `PRISM_ALERTS_DATABASE_URL` or `POSTGRES_*` in `api/.env`; for host access to `alerting-db`, use port `54321` as in [`.env.example`](./.env.example).
 
 - **country**: The target country for the alert.  
 - **emails**: A list of email addresses that will receive the alert notification.  
 - **prism_url**: The base URL of the PRISM platform for redirection link and screenshot capture.
 - **type**: Hazard type enum: `storm` | `flood` | `drought`.
 
-The `type` column is a PostgreSQL ENUM (`anticipatory_action_alerts_type_enum`). It was originally created by TypeORM migration `1738850000000-add-type-to-anticipatory-action-alerts.ts`; the authoritative definition for new environments is the Alembic baseline under `api/alembic/versions/`.
+The `type` column is a PostgreSQL ENUM (`anticipatory_action_alerts_type_enum`) defined by the Alembic baseline under `api/alembic/versions/`.
 
 ### Optional: threshold `alert` rows + `user_info` (local testing)
 
-The same API seed step loads a [Starlette Admin](https://github.com/jowilf/starlette-admin)–friendly `user_info` row and two sample `alert` rows (SQL under [`api/scripts/seed_local_alerts_dev.sql`](../api/scripts/seed_local_alerts_dev.sql)). **User password:** with `salt = 'false'`, the PRISM API validates this row using a **plain-text** password match ([`prism_app/auth.py`](../api/prism_app/auth.py))—use HTTP Basic `local_dev_user` / `localdev` when auth is enabled. Re-running the seed replaces the fixed `seed-alert-*@example.com` rows and leaves `user_info` unchanged if the username already exists.
+For [Starlette Admin](https://github.com/jowilf/starlette-admin) or API smoke tests, use the same seed step as above: from `api/`, run `poetry run python scripts/seed_alerts_db.py`. That executes [`api/scripts/seed_local_alerts_dev.sql`](../api/scripts/seed_local_alerts_dev.sql), which loads sample `alert` and `user_info` rows (and the Mozambique AA rows) in one shot. Re-running is safe: see comments at the top of that SQL file.
+
+- **User password:** with `salt = 'false'`, the PRISM API validates this row using a **plain-text** password match ([`prism_app/auth.py`](../api/prism_app/auth.py))—use HTTP Basic `local_dev_user` / `localdev` when auth is enabled.
 
 ### Shared worker runner
 
@@ -65,11 +67,35 @@ sudo docker compose run --entrypoint "yarn aa-flood-alert-worker --testEmail='em
 ```
 - The provided emails replace the DB-configured recipients for test runs.
 
+### Ethereal (fake SMTP, no credentials)
+
+If **`PRISM_ALERTS_EMAIL_USER`** and **`PRISM_ALERTS_EMAIL_PASSWORD`** are both unset or empty, [`src/utils/email.ts`](./src/utils/email.ts) uses Nodemailer’s [Ethereal](https://ethereal.email) test inbox: it creates a disposable SMTP account, sends through `smtp.ethereal.email`, and logs a **preview URL** (`Preview URL: …`) you can open in a browser to read the message and attachments.
+
+This is independent of **`--testEmail`**: you can keep using test addresses in the command; Ethereal still delivers to its fake SMTP and you inspect the result via the preview URL (those addresses are not a real inbox).
+
+1. Ensure real SMTP env vars are not set (or remove them from `.env` / compose for local runs).
+2. Run a worker that sends mail (commands above, or threshold `alert-worker` if your DB triggers a send).
+3. Copy the logged preview link from the container or terminal output.
+
+Each run may use a new Ethereal account. To reuse one inbox, configure Ethereal’s SMTP user/password yourself via `PRISM_ALERTS_EMAIL_USER`, `PRISM_ALERTS_EMAIL_PASSWORD`, and `PRISM_ALERTS_EMAIL_HOST` (e.g. `smtp.ethereal.email`).
+
 ### Flood data source
 - The flood worker reads `dates.json`: `https://data.earthobservation.vam.wfp.org/public-share/aa/flood/moz/dates.json`.
 - Email triggers when `trigger_status` is one of: `bankfull`, `moderate`, `severe`.
 - Email content follows the AA Flood design and includes a map screenshot and CTA link.
 
+## CI and release checks (shared alerts database)
+
+GitHub Actions job **`alerts_db_alembic_and_alerting`** (in [`.github/workflows/api.yml`](../.github/workflows/api.yml)) starts an ephemeral Postgres, runs `alembic upgrade head` from `api/`, then:
+
+1. **`yarn check-alerts-db-contract`** — Validates tables/columns/types the Node workers query still match the migrated schema (`src/ci/check-alerts-db-contract.ts`). Requires `PRISM_ALERTS_DATABASE_URL`.
+2. **`yarn smoke-alerts-db-pool`** — Runs real `pg` queries used by threshold and AA workers (empty tables OK; `src/ci/smoke-alerts-db-pool.ts`).
+3. **`yarn smoke-alerting-workers`** — Runs `runAlertWorker()` plus AA storm/flood `SELECT`s on the same pool (`src/ci/smoke-alerting-workers.ts`; safe when there are no active alerts).
+
+The same job then runs **`pytest`** on `test_api.py`, `test_alerting.py`, and **`test_alerts_db_integration.py`** so the API, `/stats` alerting fixture, admin list routes, and Alembic metadata align with that database. See [api/README.md](../api/README.md) (**Alerts database (CI integration + local)**).
+
+**Before or right after the first production `alembic upgrade` on the shared alerts DB**, also smoke manually: full `alert-worker`, one AA worker **without** `--testEmail` (so the pool hits Postgres), and read-only Starlette Admin on `alert` / `user_info` / `anticipatory_action_alerts`.
+
 ## Server crons
 Alert workers are running as crons on the server. Edit with: `crontab -e`
 Crontab examples :

alerting/crons/cron_aa_flood_alert_run.sh

@@ -4,7 +4,7 @@ cd ~/prism-app/alerting
 # source secrets from AWS
 source ../api/set_envs.sh
 
-docker compose run --rm --entrypoint 'yarn aa-flood-alert-worker' alerting-node 2>&1 | tee -a ~/prism-app/alerting/aa_flood_alert_worker.log
+docker compose run --rm -e POSTGRES_SSL=true --entrypoint 'yarn aa-flood-alert-worker' alerting-node 2>&1 | tee -a ~/prism-app/alerting/aa_flood_alert_worker.log
 
 ## To set up the cron job, run the following command on the server:
 # crontab -e

alerting/crons/cron_aa_storm_alert_run.sh

@@ -4,12 +4,10 @@ cd ~/prism-app/alerting
 # source secrets from AWS
 source ../api/set_envs.sh
 
-docker compose run --rm --entrypoint 'yarn aa-storm-alert-worker' alerting-node 2>&1 | tee -a ~/prism-app/alerting/aa_storm_alert_worker.log
+docker compose run --rm -e POSTGRES_SSL=true --entrypoint 'yarn aa-storm-alert-worker' alerting-node 2>&1 | tee -a ~/prism-app/alerting/aa_storm_alert_worker.log
 
 ## To set up the cron job, run the following command on the server:
 # crontab -e
 ## and then add the following line to the crontab file:
 ## This will run the storm AA alerting script every hour at minute 0.
 # 0 * * * * ~/prism-app/alerting/crons/cron_aa_storm_alert_run.sh
-
-

alerting/crons/cron_alert_run.sh

@@ -4,12 +4,10 @@ cd ~/prism-app/alerting
 # source secrets from AWS
 source ../api/set_envs.sh
 
-docker compose run --rm --entrypoint 'yarn alert-worker' alerting-node 2>&1 | tee -a ~/prism-app/alerting/alert_worker.log
+docker compose run --rm -e POSTGRES_SSL=true --entrypoint 'yarn alert-worker' alerting-node 2>&1 | tee -a ~/prism-app/alerting/alert_worker.log
 
 ## To set up the cron job, run the following command on the server:
 # crontab -e
 ## and then add the following line to the crontab file:
 # 0 1 * * * ~/prism-app/alerting/crons/cron_alert_run.sh
 ## This will run the alerting script every day at 1:00 AM.
-
-

alerting/docker-compose.yml

@@ -25,6 +25,8 @@ services:
     working_dir: /prism_app
     environment:
       - POSTGRES_HOST=alerting-db
+      # Override host-oriented POSTGRES_PORT from alerting/.env (dotenv); DB listens on 5432 inside the network.
+      - POSTGRES_PORT=5432
       - POSTGRES_USER=postgres
       - POSTGRES_DB=postgres
       - POSTGRES_PASSWORD=!ChangeMe!