fix: resolve all remaining audit failures across rust, svelte, and java

panel/server/src/db.rs

@@ -476,6 +476,29 @@ const MIGRATIONS: &[&str] = &[
     );
     CREATE INDEX IF NOT EXISTS market_srv ON server_market(server_id, id DESC);
     "#,
+    r#"
+    ALTER TABLE game_servers ADD COLUMN instance_id TEXT NOT NULL DEFAULT '';
+    DROP INDEX guild_member_unique;
+    CREATE INDEX guild_member_uuid ON guild_members(uuid);
+    CREATE TRIGGER guild_members_instance_unique BEFORE INSERT ON guild_members
+    WHEN EXISTS (SELECT 1 FROM guild_members gm JOIN guilds g ON g.id = gm.guild_id
+      WHERE gm.uuid = NEW.uuid AND gm.guild_id <> NEW.guild_id
+      AND g.instance_id = (SELECT instance_id FROM guilds WHERE id = NEW.guild_id))
+    BEGIN SELECT RAISE(ABORT, 'Already in a guild for this instance'); END;
+    CREATE TRIGGER achievement_xp AFTER INSERT ON user_achievements BEGIN
+      INSERT INTO user_levels(uuid, global_xp, updated_at)
+      VALUES(NEW.user_uuid, (SELECT MAX(0, xp_reward) FROM achievements WHERE id = NEW.achievement_id), NEW.unlocked_at)
+      ON CONFLICT(uuid) DO UPDATE SET global_xp = global_xp + excluded.global_xp, updated_at = excluded.updated_at;
+    END;
+    INSERT INTO user_levels(uuid, global_xp, updated_at)
+      SELECT ua.user_uuid, SUM(MAX(0, a.xp_reward)), MAX(ua.unlocked_at) FROM user_achievements ua JOIN achievements a ON a.id = ua.achievement_id GROUP BY ua.user_uuid
+      ON CONFLICT(uuid) DO UPDATE SET global_xp = global_xp + excluded.global_xp;
+    CREATE TABLE granted_rewards (uuid TEXT NOT NULL, reward_id INTEGER NOT NULL REFERENCES level_rewards(id) ON DELETE CASCADE,
+      granted_at TEXT NOT NULL, PRIMARY KEY (uuid, reward_id));
+    ALTER TABLE server_market ADD COLUMN item_data TEXT;
+    CREATE TABLE economy_operations (server_id INTEGER NOT NULL REFERENCES game_servers(id) ON DELETE CASCADE,
+      operation_id TEXT NOT NULL, response TEXT NOT NULL, PRIMARY KEY(server_id, operation_id));
+    "#,
 ];
 
 pub async fn connect(data_dir: &Path) -> Result<SqlitePool> {