Jakob WennbergandClaude Opus 4.7
ab63da8324
* test: add real-Postgres smoke gate (pg-real) Mocked Supabase tests cannot exercise triggers, RPCs, or RLS policies — a migration that drops enforce_period_lock, mangles user_company_ids(), or weakens an RLS policy ships green today. Closes that gap with a small Vitest project `pg-real` running 5 smoke tests against a real supabase/postgres:15 container in CI. Covers: closed-period INSERT rejection, commit_journal_entry voucher atomicity under concurrency, posted-entry immutability, RLS tenant isolation on journal_entries, and audit_log UPDATE/DELETE rejection. Also lands the bankid anonymization migration that was sitting untracked from a prior task. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(pg-real): fix storage schema bootstrap + de-scope + PR review fixes - Drop bankid anonymization migration from this PR. That change is separate scope (and has open compliance questions flagged by the Swedish review bot on #357); it will land in its own PR. - Add tests/pg/bootstrap.sql to align storage.buckets/objects/foldername with what migrations expect before the replay loop. The supabase/postgres image ships only a partial storage schema; the rest comes from the storage-api service at runtime, which CI does not run. First pg-real run failed at migration 24 on "column public of relation buckets does not exist". - Add concurrency group to the workflow so stacked PR commits cancel in-progress runs instead of queueing. - Gate the pg-real vitest project on DATABASE_URL so a bare `vitest run` with no DB configured runs only the unit project. npm run test:pg is the opt-in entry point. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(pg-real): widen JWT claim setup so auth.uid() resolves under RLS The rls.pg test came back with 0 rows instead of 1 — user_company_ids() returned empty because auth.uid() didn't resolve to the seeded user. Two fixes: - Set both request.jwt.claims (whole object) and request.jwt.claim.sub (individual claim). Different Supabase auth.uid() versions read one or the other. - Assert auth.uid() = expected userId immediately after the context switch, so the next failure points at the right layer instead of an unrelated empty-result assertion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
67 lines
1.9 KiB
YAML
67 lines
1.9 KiB
YAML
name: pg-real tests
|
|
|
|
on: [pull_request]
|
|
|
|
concurrency:
|
|
group: pg-real-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
pg-real:
|
|
runs-on: ubuntu-latest
|
|
|
|
services:
|
|
postgres:
|
|
# Supabase image ships the auth schema, auth.uid(), and the extensions
|
|
# (uuid-ossp, pg_cron, btree_gist, vector) this repo's migrations need.
|
|
# Plain postgres:15 would require manual bootstrap SQL.
|
|
image: supabase/postgres:15.8.1.060
|
|
env:
|
|
POSTGRES_PASSWORD: postgres
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U postgres"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
|
|
env:
|
|
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
|
|
PGPASSWORD: postgres
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
|
|
- run: npm ci
|
|
|
|
- name: Install psql client
|
|
run: sudo apt-get update && sudo apt-get install -y --no-install-recommends postgresql-client
|
|
|
|
- name: Bootstrap storage schema
|
|
# The supabase/postgres image ships a partial storage schema; the rest
|
|
# is provisioned by the storage-api service at runtime, which we do
|
|
# not run in CI. This aligns the schema with what migrations expect.
|
|
run: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -q -f tests/pg/bootstrap.sql
|
|
|
|
- name: Apply migrations
|
|
run: |
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
files=(supabase/migrations/*.sql)
|
|
if [ ${#files[@]} -eq 0 ]; then
|
|
echo "No migration files found"
|
|
exit 1
|
|
fi
|
|
for f in "${files[@]}"; do
|
|
echo "Applying $f"
|
|
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -q -f "$f"
|
|
done
|
|
|
|
- run: npm run test:pg
|