test(storage): cover applying migrations to an existing older DB

Adds a schema-presence guard (inbound_client_api_keys table + binding_type +
locked_space_id columns exist after a migrate) and reproduces the field upgrade
path that surfaced "no such table": a DB rolled back to pre-020, reopened, must
re-apply 020/021/022 and recreate the table. Our other migration tests only ever
used a fresh in-memory DB, so this migrate-an-existing-DB path was uncovered.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

tests/rust/tests/database/migrations.rs

@@ -151,3 +151,82 @@ fn test_018_rewrites_stale_starter_description_only() {
         "operator-customized copy must be preserved"
     );
 }
+
+// ---------------------------------------------------------------------------
+// Upgrade path — applying NEW migrations to an EXISTING (older) on-disk DB.
+//
+// Every other test here uses a FRESH in-memory DB, where all migrations run at
+// once — so they never catch a migration that fails to apply when a real user
+// opens a database created by a previous release. These two do.
+// ---------------------------------------------------------------------------
+
+fn table_exists(db: &Database, name: &str) -> bool {
+    db.connection()
+        .query_row(
+            "SELECT COUNT(*) > 0 FROM sqlite_master WHERE type='table' AND name=?1",
+            [name],
+            |r| r.get::<_, bool>(0),
+        )
+        .unwrap_or(false)
+}
+
+fn column_exists(db: &Database, table: &str, column: &str) -> bool {
+    let sql = format!("SELECT COUNT(*) > 0 FROM pragma_table_info('{table}') WHERE name=?1");
+    db.connection()
+        .query_row(&sql, [column], |r| r.get::<_, bool>(0))
+        .unwrap_or(false)
+}
+
+#[test]
+fn test_new_schema_objects_exist_after_migration() {
+    // A fresh migrate must produce every object the API-key + mapping features
+    // depend on — a regression guard against a migration being dropped or broken.
+    let db = Database::open_in_memory().expect("open");
+    assert!(
+        table_exists(&db, "inbound_client_api_keys"),
+        "migration 020 must create inbound_client_api_keys"
+    );
+    assert!(
+        column_exists(&db, "workspace_bindings", "binding_type"),
+        "migration 021 must add workspace_bindings.binding_type"
+    );
+    assert!(
+        column_exists(&db, "inbound_clients", "locked_space_id"),
+        "migration 022 must add inbound_clients.locked_space_id"
+    );
+}
+
+#[test]
+fn test_pending_migrations_apply_to_an_existing_older_database() {
+    // Reproduce the real upgrade that surfaced "no such table:
+    // inbound_client_api_keys" in the field: a DB created before 020/021/022
+    // existed, reopened by a newer build. The pending migrations MUST apply.
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("mcpmux.db");
+
+    // 1. Fully migrate, then roll the schema back to a pre-020 state.
+    {
+        let db = Database::open(&path).expect("open");
+        db.connection()
+            .execute_batch(
+                "DELETE FROM schema_migrations WHERE version >= 20;
+                 DROP TABLE IF EXISTS inbound_client_api_keys;
+                 ALTER TABLE workspace_bindings DROP COLUMN binding_type;
+                 ALTER TABLE inbound_clients DROP COLUMN locked_space_id;",
+            )
+            .expect("roll schema back to pre-020");
+        assert!(
+            !table_exists(&db, "inbound_client_api_keys"),
+            "precondition: the rolled-back DB is missing the table"
+        );
+    }
+
+    // 2. Reopen — run_migrations() must re-apply 020/021/022.
+    let db = Database::open(&path).expect("reopen older DB");
+    assert!(
+        table_exists(&db, "inbound_client_api_keys"),
+        "reopening an older DB must re-create inbound_client_api_keys"
+    );
+    assert!(column_exists(&db, "workspace_bindings", "binding_type"));
+    assert!(column_exists(&db, "inbound_clients", "locked_space_id"));
+}