feat(spaces): replace sequential space ID with UUID

[vseehausen]

WA-1583

Why

Sequential auto-incrementing space IDs leak the total number of spaces and allow enumeration attacks. We replace them with server-generated UUID v4.

We evaluated external ID libraries (nanoid, cuid2, ksuid) but chose native PG gen_random_uuid() — zero dependencies, built-in validation via the existing UuidSchema, and 16-byte binary storage with native indexing. No app-side generation needed.

What changes

• Migration: add-backfill-swap from SERIAL int → uuid DEFAULT gen_random_uuid() on spaces.id and all FK references (members, space_safes, space_address_book_items)
• Entity & schema: SpaceSchema overrides RowSchema.id with UuidSchema; DB entity uses @PrimaryGeneratedColumn('uuid')
• Controllers: ParseIntPipe + RowSchema.shape.id → UuidSchema for all spaceId params; userId stays as int
• DTOs: ApiProperty({ type: Number }) → String for space ID fields
• Tests: builders and specs updated to use faker.string.uuid()

Scope

Only spaces.id and its FK references change. Child table own PKs, users, and wallets stay as SERIAL int. RowSchema is untouched.

Test plan

• yarn lint-check passes
• yarn build compiles
• yarn test:unit passes
• yarn test:integration passes (requires test DB)
• yarn test:e2e passes (requires Redis + RabbitMQ)
• yarn migration:revert restores integer IDs

🤖 Generated with Claude Code

[katspaugh]

@vseehausen what happens to existing Spaces, are we going to migrate them?

[katspaugh]

@claude review

[claude]

Claude finished @katspaugh's task —— View job

---

• Read migration file
• Read entity and schema changes
• Read controller changes
• Read test changes
• Post review

Review

Overall this is a well-structured migration. A few things to address:

Migration (critical)

1. Single-statement migration is not transactional (migrations/1773836092000-space-id-to-uuid.ts): The entire up() runs as one queryRunner.query() call with ~15 DDL statements. If any statement fails partway through, PG will roll back the implicit transaction, but TypeORM may not mark the migration as failed. Consider wrapping in an explicit BEGIN/COMMIT or splitting into separate queryRunner.query() calls so that TypeORM's migration runner can handle rollback properly. Alternatively, confirm that TypeORM wraps each migration in a transaction by default for your setup.

2. Constraint name casing change (migrations/1773836092000-space-id-to-uuid.ts:32,72): The original FK_SABI_space_id was created unquoted (folded to fk_sabi_space_id), and the migration correctly drops the lowercase version. However, it recreates it as "FK_SABI_space_id" (now case-preserved due to quoting). The same happens for UQ_SABI_space_id_address → "UQ_SABI_space_id_address", uq_ss_chainid_address_space → "UQ_SS_chainId_address_space", and idx_sabi_space_id → "IDX_SABI_space_id". This is intentional normalization to match entity definitions, but worth calling out — the revert migration must use the new quoted names (which it does correctly).

Code

3. ParseIntPipe still imported in members.controller.ts:21 — it's still used for userId params, so this is fine. Just noting it's intentional.

4. UUID string comparison (spaces.service.ts:119): spaces.find((space) => space.id === id) compares UUIDs as strings. This works if both sides are always the same case. Since PG returns lowercase UUIDs and UuidSchema (zod) typically lowercases, this should be fine — but worth verifying that the UuidSchema normalizes to lowercase (e.g. via .toLowerCase() or .transform()), otherwise a client sending uppercase A-F hex chars would miss the match.

5. GetSpaceResponse is missing safeCount in e2e tests (spaces.controller.e2e-spec.ts): The GET /spaces e2e test asserts full object shape but doesn't check safeCount. This is pre-existing but worth adding since it's part of the DTO.

Minor / nits

6. Invitation entity (invitation.entity.ts:20): @ApiProperty({ type: String }) for spaceId is correct now (was Number). Good.

7. space.entity.ts:21: The Omit<z.infer<typeof RowSchema>, 'id'> & { id: UUID; ... } pattern works but is a bit complex. An alternative would be RowSchema.omit({ id: true }).extend(...) to keep it purely in Zod-land, though this is stylistic.