Jakob Wennberg
338ac4e913
* fix(vat): make the ruta drill-down reconcile with the figure it explains get_vat_declaration_totals drops four classes of entry before summing: posted closing entries, source_type 'vat_settlement', the two kontantmetod year-end reversals, and anything shaped like a momsredovisning. The drill-down behind each ruta filtered on company, status and date only. So expanding a ruta listed verifikat that are not in the number it claims to explain, and the panel shows no total that would reveal the mismatch. On production, 322 posted/reversed entries carrying 26xx lines across 214 companies sit in those excluded classes. A momsdeklaration is räkenskapsinformation under BFL 5 kap. and this drill-down is what a consultant uses to substantiate a filed figure, so the two have to agree exactly. The exclusion CTEs are lifted verbatim from the figure rather than re-derived, because any divergence reintroduces exactly this bug. The new pg test asserts the equality for the whole account set at once, so editing one function and not the other fails CI instead of silently misreporting. opening_balance entries are deliberately kept: the figure exempts them from its `shaped` set, which leaves their lines in the totals, so excluding them here would break the equality in the other direction. That has its own test. Verified the test catches the defect by reinstalling the old function body and watching it fail with the real numbers (2611: drill-down 250/240 vs figure 0/200), then restoring. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(vat): update the existing drill-down pg test to the new signature get_vat_ruta_source_lines gained p_ruta_accounts / p_net_accounts, and production-error-regressions.pg.test.ts still called the old 9-argument form, so pg-real failed with 42883 "function does not exist". I had grepped app/, lib/ and extensions/ for callers and not tests/. Neither fixture in that paging test is settlement-shaped, so paging behaviour is unchanged; the equality itself is covered by the new reconcile test. Also documents, in the tool-pg reset script, that its blanket grant to `anon` (which PostgREST requires) makes that database invalid for the pg-real suite: ~29 of those files assert least privilege and fail there even on unmodified main. That cost a confusing local run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
88 lines
3.6 KiB
Bash
Executable File
88 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Rebuild the MCP tool-integration database from scratch.
|
|
#
|
|
# Mirrors the pg-real CI job step for step (bootstrap.sql, then every migration
|
|
# in filename order with ON_ERROR_STOP), so a schema that passes there passes
|
|
# here. Two additions:
|
|
#
|
|
# * The container is recreated rather than the schemas dropped. Dropping is the
|
|
# obvious approach and it does not work: `storage` is owned by
|
|
# supabase_storage_admin, so `DROP SCHEMA storage` fails as postgres, and
|
|
# dropping only `public` leaves the storage RLS policies that migration
|
|
# 20240101000024 creates unconditionally, which aborts the next replay
|
|
# partway through and leaves a half-migrated database that looks like a
|
|
# migration bug. A fresh volume costs about fifteen seconds and removes the
|
|
# entire class.
|
|
#
|
|
# * PostgREST caches the schema at boot, so a freshly-migrated database is
|
|
# invisible to it until it is told to look again.
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
COMPOSE_FILE="$REPO_ROOT/tests/tool-pg/docker-compose.yml"
|
|
|
|
compose() { docker compose -f "$COMPOSE_FILE" "$@"; }
|
|
|
|
psql_run() {
|
|
compose exec -T postgres \
|
|
psql "postgresql://postgres:postgres@localhost:5432/postgres" -v ON_ERROR_STOP=1 -q "$@"
|
|
}
|
|
|
|
echo "==> recreating containers with a fresh volume"
|
|
compose down -v --remove-orphans >/dev/null 2>&1 || true
|
|
compose up -d --wait >/dev/null
|
|
|
|
echo "==> waiting for postgres"
|
|
for _ in $(seq 1 90); do
|
|
if compose exec -T postgres pg_isready -U postgres >/dev/null 2>&1; then break; fi
|
|
sleep 1
|
|
done
|
|
|
|
echo "==> bootstrap storage schema"
|
|
psql_run -f - < "$REPO_ROOT/tests/pg/bootstrap.sql" >/dev/null 2>&1
|
|
|
|
# The image grants these at init, but DEFAULT PRIVILEGES are what make the
|
|
# grants apply to the ~400 tables the migrations are about to create. Without
|
|
# them PostgREST answers every request with 42501 "permission denied".
|
|
echo "==> default privileges for the supabase roles"
|
|
psql_run -c "
|
|
GRANT USAGE ON SCHEMA public TO postgres, anon, authenticated, service_role;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public
|
|
GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public
|
|
GRANT ALL ON ROUTINES TO postgres, anon, authenticated, service_role;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public
|
|
GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
|
|
" >/dev/null
|
|
|
|
echo "==> applying migrations"
|
|
count=0
|
|
for f in "$REPO_ROOT"/supabase/migrations/*.sql; do
|
|
if ! psql_run -f - < "$f" >/dev/null 2>/tmp/tool-pg-migrate.err; then
|
|
echo "FAILED on $(basename "$f")" >&2
|
|
tail -20 /tmp/tool-pg-migrate.err >&2
|
|
exit 1
|
|
fi
|
|
count=$((count + 1))
|
|
if [ $((count % 200)) -eq 0 ]; then echo " ... $count migrations applied"; fi
|
|
done
|
|
echo "==> $count migrations applied"
|
|
|
|
# NOTE: this blanket grant includes `anon`, which PostgREST needs to answer at
|
|
# all. It also means THIS DATABASE IS NOT VALID FOR THE pg-real SUITE: ~29 of
|
|
# those files assert least privilege ("does not grant EXECUTE to anon"), and
|
|
# they fail here on unmodified main. Point `npm run test:pg` at its own
|
|
# database, not at this one.
|
|
echo "==> granting on everything the migrations created"
|
|
psql_run -c "
|
|
GRANT ALL ON ALL TABLES IN SCHEMA public TO postgres, anon, authenticated, service_role;
|
|
GRANT ALL ON ALL ROUTINES IN SCHEMA public TO postgres, anon, authenticated, service_role;
|
|
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO postgres, anon, authenticated, service_role;
|
|
" >/dev/null
|
|
|
|
echo "==> reloading PostgREST schema cache"
|
|
psql_run -c "NOTIFY pgrst, 'reload schema';" >/dev/null
|
|
sleep 3
|
|
|
|
echo "==> ready"
|