Positions
- Removed the "Besetzen" action, the StaffInternallyModal behind it and the
now-unreachable staffPositionInternally server action: a position is filled
through the hire process, not from the positions list. Note that
transfer_employee has no position_id at all and never touched `positions`,
so with staff_position_internally out of the UI, hire_employee is the only
thing that closes a position — a transfer into an open one leaves it open.
The RPC itself is still in the database and still covered by its tests.
SVNR
- Austrian social security numbers are now validated: ten digits, weighted
check digit mod 11, and the TTMMJJ tail cross-checked against birth_date,
which is what catches a transposed date that a valid check digit would let
through. A serial whose weighted sum lands on 11 is rejected rather than
wrapped — those are never issued.
- Applies to Austrian locations only; the German/Czech/Slovenian equivalents
have their own formats and stay free-form.
- Enforced by a trigger, not inside hire_employee/change_employee_data, for
the same reason as the assignment history: both have been redefined by
half a dozen migrations. Only a *newly written* value is checked, so a
legacy number never blocks an unrelated transfer or address change.
- The seed drew a random four-digit prefix, so its check digit was right
only by chance and every seeded Austrian row would now be rejected;
it computes the check digit properly now.
Tech stack
- next 16.2.11 closes nine advisories against 16.2.10, including a
middleware/proxy bypass in App Router apps on Turbopack — proxy.ts is this
app's entry gate. RLS remains the real boundary, so the blast radius was a
blank page rather than data, but it is a patch-level fix. Also react
19.2.8, tailwind 4.3.3, lucide-react 1.26, supabase-js/ssr, postcss.
- CI runs lint, typecheck, schema/type drift, tests and build; a second job
replays every migration onto an empty database and runs the integration
suite against it, so a migration that cannot be replayed from scratch
fails here instead of during a restore.
- scripts/check-schema-types.mjs diffs the hand-written lib/supabase/types.ts
against the migrations. Reading the SQL rather than a live database keeps
Postgres out of the fast CI job. Verified in both directions.
- vitest now runs two projects: node for logic, jsdom for components. The
first component test covers the org chart expand control, which broke
earlier this session when elementsSelectable={false} made React Flow
compute pointer-events:none for the whole node; re-introducing that prop
fails three of these tests.
- Content-Security-Policy is emitted report-only. Enforcing a policy derived
from inspection rather than from violation reports risks blanking the app;
'unsafe-inline' on script-src is required until a nonce is threaded through
proxy.ts, which is a separate change.
- Fixed supabase/seed.ts, which this session's SVNR change had broken: the
extensionless "../lib/svnr" import does not resolve under Node's ESM
loader, so the seed failed at startup.
- engines pinned to node >=22 <25, tsconfig target ES2022, and the dead
test:e2e script removed (no Playwright is installed).
159 lines
5.6 KiB
JavaScript
159 lines
5.6 KiB
JavaScript
#!/usr/bin/env node
|
|
// Guards lib/supabase/types.ts against drifting away from the migrations.
|
|
//
|
|
// That file is maintained by hand (its own header explains why: no DB
|
|
// connection string is available to run `supabase gen types`), so a new
|
|
// column reaches the database without the TypeScript side noticing — and
|
|
// `tsc` stays perfectly happy while the app reads a field that is typed but
|
|
// absent, or writes one that exists but is not typed.
|
|
//
|
|
// Reads the migrations rather than a live database on purpose: CI then needs
|
|
// no Postgres, and the migrations are the actual source of truth for what
|
|
// gets deployed.
|
|
|
|
import { readFileSync, readdirSync } from "node:fs";
|
|
import { dirname, join } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const root = join(dirname(fileURLToPath(import.meta.url)), "..");
|
|
const migrationsDir = join(root, "supabase", "migrations");
|
|
|
|
// Columns are compared, not their types: the hand-written file deliberately
|
|
// uses richer unions than the SQL (`EmploymentStatus` for a text column with
|
|
// a check constraint), and flagging those would be noise.
|
|
const NON_COLUMN_START =
|
|
/^(constraint|check|primary|unique|foreign|exclude|like|inherits|partition|)$/i;
|
|
|
|
function stripComments(sql) {
|
|
return sql.replace(/--[^\n]*/g, "");
|
|
}
|
|
|
|
/** Splits on top-level commas only, so `numeric(10,2)` stays in one piece. */
|
|
function splitTopLevel(body) {
|
|
const parts = [];
|
|
let depth = 0;
|
|
let current = "";
|
|
for (const ch of body) {
|
|
if (ch === "(") depth++;
|
|
if (ch === ")") depth--;
|
|
if (ch === "," && depth === 0) {
|
|
parts.push(current);
|
|
current = "";
|
|
continue;
|
|
}
|
|
current += ch;
|
|
}
|
|
if (current.trim()) parts.push(current);
|
|
return parts;
|
|
}
|
|
|
|
function parseMigrations() {
|
|
const tables = new Map();
|
|
const files = readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
|
|
|
|
for (const file of files) {
|
|
const sql = stripComments(readFileSync(join(migrationsDir, file), "utf8"));
|
|
|
|
for (const match of sql.matchAll(/create table (?:if not exists )?(\w+)\s*\(/gi)) {
|
|
const name = match[1];
|
|
// Walk from the opening paren to its match so nested parens in column
|
|
// definitions do not end the table early.
|
|
let depth = 0;
|
|
let end = match.index + match[0].length - 1;
|
|
for (let i = end; i < sql.length; i++) {
|
|
if (sql[i] === "(") depth++;
|
|
else if (sql[i] === ")") {
|
|
depth--;
|
|
if (depth === 0) {
|
|
end = i;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
const body = sql.slice(match.index + match[0].length, end);
|
|
const columns = new Set();
|
|
for (const part of splitTopLevel(body)) {
|
|
const first = part.trim().split(/\s+/)[0] ?? "";
|
|
if (!first || NON_COLUMN_START.test(first)) continue;
|
|
columns.add(first.toLowerCase());
|
|
}
|
|
tables.set(name, columns);
|
|
}
|
|
|
|
for (const m of sql.matchAll(/alter table (?:if exists )?(\w+)\s+add column (?:if not exists )?(\w+)/gi)) {
|
|
tables.get(m[1])?.add(m[2].toLowerCase());
|
|
}
|
|
for (const m of sql.matchAll(/alter table (?:if exists )?(\w+)\s+drop column (?:if exists )?(\w+)/gi)) {
|
|
tables.get(m[1])?.delete(m[2].toLowerCase());
|
|
}
|
|
for (const m of sql.matchAll(/alter table (?:if exists )?(\w+)\s+rename column (\w+) to (\w+)/gi)) {
|
|
const t = tables.get(m[1]);
|
|
if (t?.delete(m[2].toLowerCase())) t.add(m[3].toLowerCase());
|
|
}
|
|
for (const m of sql.matchAll(/drop table (?:if exists )?(\w+)/gi)) {
|
|
tables.delete(m[1]);
|
|
}
|
|
}
|
|
return tables;
|
|
}
|
|
|
|
function parseTypes() {
|
|
const source = readFileSync(join(root, "lib", "supabase", "types.ts"), "utf8");
|
|
const start = source.indexOf("Tables: {");
|
|
if (start === -1) throw new Error("Tables block not found in lib/supabase/types.ts");
|
|
|
|
const tables = new Map();
|
|
// Each entry looks like `name: NoRelationships & { Row: { … } … }`; the Row
|
|
// block is the one that has to match the database.
|
|
const entry = /^ {6}(\w+): /gm;
|
|
for (const m of source.slice(start).matchAll(entry)) {
|
|
const rest = source.slice(start + m.index);
|
|
const rowAt = rest.indexOf("Row: {");
|
|
if (rowAt === -1) continue;
|
|
let depth = 0;
|
|
let end = rowAt + "Row: ".length;
|
|
for (let i = end; i < rest.length; i++) {
|
|
if (rest[i] === "{") depth++;
|
|
else if (rest[i] === "}") {
|
|
depth--;
|
|
if (depth === 0) {
|
|
end = i;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
const body = rest.slice(rowAt + "Row: {".length, end);
|
|
const columns = new Set();
|
|
for (const f of body.matchAll(/(\w+)\s*\??\s*:/g)) columns.add(f[1].toLowerCase());
|
|
tables.set(m[1], columns);
|
|
}
|
|
return tables;
|
|
}
|
|
|
|
const sqlTables = parseMigrations();
|
|
const tsTables = parseTypes();
|
|
const problems = [];
|
|
|
|
for (const [name, columns] of tsTables) {
|
|
const sqlColumns = sqlTables.get(name);
|
|
if (!sqlColumns) {
|
|
problems.push(`Tabelle "${name}" ist in types.ts typisiert, existiert aber in keiner Migration.`);
|
|
continue;
|
|
}
|
|
for (const c of columns) {
|
|
if (!sqlColumns.has(c)) problems.push(`${name}.${c}: in types.ts typisiert, in den Migrationen nicht vorhanden.`);
|
|
}
|
|
for (const c of sqlColumns) {
|
|
if (!columns.has(c)) problems.push(`${name}.${c}: in den Migrationen vorhanden, in types.ts nicht typisiert.`);
|
|
}
|
|
}
|
|
|
|
if (problems.length > 0) {
|
|
console.error("Schema-Drift zwischen supabase/migrations und lib/supabase/types.ts:\n");
|
|
for (const p of problems.sort()) console.error(" - " + p);
|
|
console.error(`\n${problems.length} Abweichung(en). types.ts entsprechend nachziehen.`);
|
|
process.exit(1);
|
|
}
|
|
|
|
console.log(`Kein Schema-Drift: ${tsTables.size} typisierte Tabellen stimmen mit den Migrationen überein.`);
|