rs2 / restspace

11.3 Post-migration checklist

rs2 migrate gives you a validated tenant.json and a list of printed warnings. This checklist takes that from "loads" to "works." Do these in order.

1. Read every warning

The migrator prints a warning for everything it skipped or adjusted (11.2). Go through them one by one — each is either a no-op for your app or a thing you must re-implement. Don't deploy until you've accounted for all of them.

2. Seed the auth secret

The migrator cannot invent auth.jwtSecret. Set a strong key (via the secrets mechanism / PUT /services/raw, 10.6) before relying on auth. Without it, token verification isn't active.

3. Seed the users dataset

Users are records in the users dataset now (5.2). Populate it:

  • Existing bcrypt hashes verify as-is — you can import users without password resets.
  • New users get argon2id hashes.
  • Set each user's roles and kind.

4. Install pipelines

For each converted pipeline the migrator printed, PUT the typed envelope to its <mount>/.pipelines/.root (or named spec). These live in the instruction plane, not the tenant config (11.1) — installing them is a required step, not optional.

5. Re-PUT queries

v1 query files don't carry in the config. Re-author each as an RS2 query envelope (6.1) and PUT it to the query mount's .queries/ subtree. Check that ${name} placeholders behave structurally (6.3) and that subpath params map to trailing URL segments (6.2).

6. Re-implement skipped services

For each warned service the migrator could not translate (email, webhooks, templates, proxy, custom TS):

  • map it to the current building blocks first: file static-site mode, template, proxy, wrapper, or a scheduled/webhook pipeline,
  • use a custom service only for the remaining logic/integration,
  • build it (Parts 7/8),
  • mount it where the v1 service used to live.

Re-bundle any v1 Deno/TS services against the RS2 contract (rs2 new --js + rs2 deploy --bundle).

7. Verify the surface

Once it's running:

  • GET /.well-known/rs2/services — confirm the mounts and their patterns/facets look right (9.1).
  • Exercise auth: log in, hit a protected mount, confirm roles behave.
  • Walk a store, run a query, run a pipeline (?$plan first, 7.8).
  • Check the logs for a request via its X-Trace-Id (9.6).

8. Mind the behavioral deltas

A few things changed by design — verify clients cope:

  • dataset single-dataset mounts → records now sit under a dataset container (paths changed).
  • JWTs are invalidated — clients must re-authenticate.
  • ETags are always emitted now (you may rely on conditional GETs you didn't before).

Work the list top to bottom and you'll have a working RS2 tenant. That completes the manual body; the appendices are quick-reference tables for everything you've learned.

← Previous: 11.2 What's warned, adjusted, or skipped · Manual home · Next: Appendix A — Glossary →