feat: add read-only schema preflight

cmd/orbit-admin/main.go

@@ -23,15 +23,48 @@ func main() {
 }
 func run() error {
 	if len(os.Args) < 2 {
-		return errors.New("usage: orbit-admin bootstrap|credential status|rotate|revoke|apply")
+		return errors.New("usage: orbit-admin bootstrap|verify|credential status|rotate|revoke|apply")
 	}
 	switch os.Args[1] {
 	case "bootstrap":
 		return runBootstrap(os.Args[2:])
+	case "verify":
+		return runVerify(os.Args[2:])
 	case "credential":
 		return runCredential(os.Args[2:])
 	}
-	return errors.New("usage: orbit-admin bootstrap|credential status|rotate|revoke|apply")
+	return errors.New("usage: orbit-admin bootstrap|verify|credential status|rotate|revoke|apply")
+}
+
+func runVerify(args []string) error {
+	flags := flag.NewFlagSet("verify", flag.ContinueOnError)
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	if flags.NArg() != 0 {
+		return errors.New("verify does not accept positional arguments")
+	}
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	db, err := mysql.Open(ctx, cfg.MySQLDSN, 2, 1)
+	if err != nil {
+		return errors.New("database unavailable")
+	}
+	defer db.Close()
+	verification, err := mysql.VerifyOperationalSchema(ctx, db)
+	encoded, encodeErr := json.Marshal(verification)
+	if encodeErr != nil {
+		return encodeErr
+	}
+	fmt.Println(string(encoded))
+	if err != nil {
+		return err
+	}
+	return nil
 }
 
 func runBootstrap(args []string) error {