MattssonandClaude Opus 4.6
1756af6c5e
* fix: improve date filter UX with partial dates and Apply button (GNU-18) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: enhance banking settings with connection handling and integrity checks --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
65 lines
3.1 KiB
Markdown
65 lines
3.1 KiB
Markdown
# Database Prompt
|
|
|
|
## Perspective
|
|
|
|
You are scanning for database schema, migration, and query issues in a Supabase PostgreSQL application with RLS. Focus on data integrity, performance, security policies, and compliance with Swedish accounting law (BFL 7-year retention, period locks, immutable posted entries).
|
|
|
|
## Checklist
|
|
|
|
### Schema Design
|
|
- [ ] Tables have UUID primary keys (`DEFAULT uuid_generate_v4()`)
|
|
- [ ] `user_id UUID REFERENCES auth.users ON DELETE CASCADE NOT NULL` on all user-owned tables
|
|
- [ ] `updated_at` trigger using `update_updated_at_column()` on all tables
|
|
- [ ] Appropriate NOT NULL constraints on required fields
|
|
- [ ] CHECK constraints for enum-like fields (status, type columns)
|
|
- [ ] Foreign keys with appropriate ON DELETE behavior (CASCADE vs RESTRICT)
|
|
|
|
### Row Level Security
|
|
- [ ] RLS enabled on every table
|
|
- [ ] SELECT policy: `auth.uid() = user_id`
|
|
- [ ] INSERT policy: `auth.uid() = user_id`
|
|
- [ ] UPDATE policy: `auth.uid() = user_id`
|
|
- [ ] No overly permissive policies (e.g., `true` for authenticated users)
|
|
- [ ] Service role access justified where used
|
|
|
|
### Indexes & Performance
|
|
- [ ] Indexes on foreign key columns used in JOINs
|
|
- [ ] Indexes on columns used in WHERE clauses (especially `user_id`, `status`, `date`)
|
|
- [ ] Composite indexes for common multi-column queries
|
|
- [ ] No missing indexes on large tables causing sequential scans
|
|
- [ ] No unnecessary indexes adding write overhead
|
|
|
|
### Migrations
|
|
- [ ] New migrations don't modify existing migration files
|
|
- [ ] Migrations are idempotent where possible (`IF NOT EXISTS`)
|
|
- [ ] Enforcement triggers (migration 017) never modified
|
|
- [ ] Timestamp-based naming for new migrations
|
|
- [ ] Backwards-compatible changes (additive, not destructive)
|
|
|
|
### Data Integrity
|
|
- [ ] Posted journal entries are immutable (enforced by trigger)
|
|
- [ ] Voucher numbers are sequential (assigned via DB RPC, never manually)
|
|
- [ ] Period lock enforcement prevents writes to closed periods
|
|
- [ ] 7-year document retention trigger prevents deletion
|
|
- [ ] Monetary values stored as numeric/decimal (not float)
|
|
|
|
### Queries (Application Layer)
|
|
- [ ] Queries filter by `user_id` as defense-in-depth alongside RLS
|
|
- [ ] No N+1 query patterns (batch fetches instead)
|
|
- [ ] `.select()` specifies columns (not `select('*')` on wide tables)
|
|
- [ ] Supabase `.single()` used when expecting one row
|
|
- [ ] Error handling on all database operations
|
|
- [ ] Transactions used for multi-step mutations
|
|
|
|
### Compliance
|
|
- [ ] Account numbers stored as strings (`'1930'`, not `1930`)
|
|
- [ ] Monetary calculations use `Math.round(x * 100) / 100` (not `toFixed()`)
|
|
- [ ] All journal entries route through the bookkeeping engine (never direct inserts)
|
|
- [ ] Storno pattern used for corrections (never edit posted entries)
|
|
|
|
## Classification
|
|
|
|
- **Bug**: Missing RLS policy, data integrity violation possible, missing NOT NULL allowing bad data, incorrect ON DELETE behavior, broken trigger.
|
|
- **Feature**: New table needs migration, new index for a new query pattern, new RPC function needed.
|
|
- **Improvement**: Missing index on existing table, overly broad SELECT, N+1 query could be batched, schema could use a CHECK constraint.
|