From 1fb4361f96e501adee7e47d9f4198e5b5f482aa8 Mon Sep 17 00:00:00 2001
From: Lizandro Guarnizo <77708265+lizandrogd@users.noreply.github.com>
Date: Tue, 10 Mar 2026 22:23:30 -0500
Subject: [PATCH] fix: worker logs permission denied + migration AFTER password

---
 Dockerfile.worker           | 8 ++++++--
 database/06_master_sync.sql | 2 +-
 docker/worker-entrypoint.sh | 8 ++++++++
 3 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 docker/worker-entrypoint.sh

diff --git a/Dockerfile.worker b/Dockerfile.worker
index 929cb3e..ee5e8b2 100644
--- a/Dockerfile.worker
+++ b/Dockerfile.worker
@@ -7,6 +7,7 @@ ENV TZ=America/Bogota
 # Instalar dependencias
 RUN apk add --no-cache \
     bash \
+    su-exec \
     libzip \
     libzip-dev \
     icu \
@@ -59,10 +60,13 @@ RUN if [ -f composer.json ]; then \
 # Dar permisos
 RUN chmod +x worker.php
 
+# Entrypoint: arregla permisos del volumen montado y ejecuta como www
+COPY docker/worker-entrypoint.sh /usr/local/bin/worker-entrypoint.sh
+RUN chmod +x /usr/local/bin/worker-entrypoint.sh
+
 # Health check
 HEALTHCHECK --interval=60s --timeout=5s --start-period=30s --retries=3 \
     CMD pgrep -f "worker.php" || exit 1
 
-USER www
-
+ENTRYPOINT ["/usr/local/bin/worker-entrypoint.sh"]
 CMD ["php", "worker.php", "--daemon"]
diff --git a/database/06_master_sync.sql b/database/06_master_sync.sql
index bea5474..e80b9fa 100644
--- a/database/06_master_sync.sql
+++ b/database/06_master_sync.sql
@@ -164,7 +164,7 @@ CREATE TABLE IF NOT EXISTS `lab_config` (
 -- C1) COLUMNA: admin_users.role_id  (prod → local / instalaciones nuevas)
 -- =============================================================================
 ALTER TABLE `admin_users`
-  ADD COLUMN IF NOT EXISTS `role_id` int(11) DEFAULT NULL AFTER `password`;
+  ADD COLUMN IF NOT EXISTS `role_id` int(11) DEFAULT NULL;
 
 -- C1a) FK opcional: se añade solo si no existe ya
 -- (MariaDB/MySQL 10.x: ADD CONSTRAINT IF NOT EXISTS no es estándar,
diff --git a/docker/worker-entrypoint.sh b/docker/worker-entrypoint.sh
new file mode 100644
index 0000000..e6babdd
--- /dev/null
+++ b/docker/worker-entrypoint.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+# Entrypoint del worker: arregla permisos del volumen montado y ejecuta como www
+
+mkdir -p /var/www/html/logs /var/www/html/uploads
+chown -R www:www /var/www/html/logs /var/www/html/uploads
+chmod -R 775 /var/www/html/logs /var/www/html/uploads
+
+exec su-exec www "$@"