chore: update supabase config, docs, deps, and security overrides#141
Merged
gaboesquivel merged 4 commits intomainfrom Mar 23, 2026
Merged
chore: update supabase config, docs, deps, and security overrides#141gaboesquivel merged 4 commits intomainfrom
gaboesquivel merged 4 commits intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
WalkthroughIntroduces a unified local DB reset workflow ( Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer (CLI)
participant Supabase as Supabase CLI
participant DB as Local Postgres
participant Drizzle as Drizzle Migrations
participant Seed as scripts/seed.ts
Dev->>Supabase: pnpm reset -> supabase db reset
Supabase->>DB: recreate database
Dev->>Drizzle: RUN_PG_MIGRATE=true pnpm db:migrate (uses DATABASE_URL)
Drizzle->>DB: apply migrations
Drizzle-->>Dev: migrations complete
Dev->>Seed: node ... scripts/seed.ts (runSeed)
Seed->>DB: connect and apply idempotent seed operations
Seed-->>Dev: seed complete
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/docu/content/docs/adrs/008-database.mdx (1)
197-197: Consider removing hardcodedproject_id.Hardcoding
project_id: basilic-apicreates maintenance overhead if the project is renamed again. Consider referencing the config file location instead:-For local Postgres via Supabase CLI (`project_id: basilic-api` in `apps/api/supabase/config.toml`): +For local Postgres via Supabase CLI (see `project_id` in `apps/api/supabase/config.toml`):🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@apps/docu/content/docs/adrs/008-database.mdx` at line 197, Remove the hardcoded project_id value "project_id: basilic-api" and instead point readers to the Supabase CLI configuration (the config.toml) or show a placeholder/env-var (e.g., ${PROJECT_ID}) so the ADR references the config location rather than a literal project name; update the line containing "project_id: basilic-api" to either reference the config file location or use a placeholder/env variable and add a short note on where to set it.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/api/README.md`:
- Around line 35-37: The README incorrectly claims "Seeding via Drizzle" while
no seed implementation exists; either update docs or add a proper Drizzle seed
flow: create a new seed script (e.g. scripts/seed.ts) that exports a seed
function and inserts required rows using your Drizzle client, add seed
configuration to drizzle.config.ts (or ensure the seed runner references the
seed file), update scripts/migrate.ts (or package.json scripts referenced by
pnpm db:reset-and-migrate) to invoke the seed runner after migrations, and then
update the README to accurately state whether seeding is automatic or manual;
reference drizzle.config.ts, scripts/migrate.ts, and the new scripts/seed.ts (or
the updated package.json script) when making changes.
---
Nitpick comments:
In `@apps/docu/content/docs/adrs/008-database.mdx`:
- Line 197: Remove the hardcoded project_id value "project_id: basilic-api" and
instead point readers to the Supabase CLI configuration (the config.toml) or
show a placeholder/env-var (e.g., ${PROJECT_ID}) so the ADR references the
config location rather than a literal project name; update the line containing
"project_id: basilic-api" to either reference the config file location or use a
placeholder/env variable and add a short note on where to set it.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4d642628-8d5d-4954-99ea-e31ad4633531
⛔ Files ignored due to path filters (2)
apps/web/.env.developmentis excluded by!**/.env*pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!**/pnpm-lock.yaml
📒 Files selected for processing (6)
apps/api/README.mdapps/api/supabase/config.tomlapps/docu/content/docs/adrs/008-database.mdxapps/docu/package.jsonapps/web/package.jsonpackage.json
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/api/package.json`:
- Line 38: The reset npm script ("reset") currently hardcodes DB credentials in
the DATABASE_URL; remove the inline "postgres:postgres@.../postgres" and instead
read DATABASE_URL from the environment (or a secure .env) at runtime: update the
"reset" script to reference the existing environment variable (or use a
mechanism like cross-env if needed) so no credentials are committed, and ensure
downstream commands (pnpm db:migrate and scripts/seed.ts) continue to rely on
process.env.DATABASE_URL rather than an inline URL.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 38c2f436-cc08-48ce-b656-f54e7c4cffa8
📒 Files selected for processing (17)
README.mdapps/api/README.mdapps/api/drizzle.config.tsapps/api/package.jsonapps/api/scripts/migrate.tsapps/api/scripts/seed.tsapps/api/supabase/config.tomlapps/docu/README.mdapps/docu/content/docs/adrs/008-database.mdxapps/docu/content/docs/architecture/api.mdxapps/docu/content/docs/development/index.mdxpackage.jsonpackages/react/src/hooks/use-link-email.test.tsxpackages/react/src/hooks/use-verify-link-wallet.test.tsxpackages/react/src/hooks/use-verify-web3-auth.test.tsxpackages/react/vitest.config.tsscripts/README.md
💤 Files with no reviewable changes (3)
- packages/react/src/hooks/use-link-email.test.tsx
- packages/react/src/hooks/use-verify-web3-auth.test.tsx
- packages/react/src/hooks/use-verify-link-wallet.test.tsx
✅ Files skipped from review due to trivial changes (8)
- apps/docu/README.md
- apps/api/drizzle.config.ts
- packages/react/vitest.config.ts
- scripts/README.md
- apps/docu/content/docs/architecture/api.mdx
- README.md
- apps/api/scripts/migrate.ts
- apps/docu/content/docs/development/index.mdx
🚧 Files skipped from review as they are similar to previous changes (3)
- apps/api/supabase/config.toml
- apps/api/README.md
- package.json
- Add scripts/seed.ts (runSeed) after Drizzle migrate in apps/api reset - Root pnpm reset delegates to @repo/api; remove db:reset-and-migrate - Document in README, docu ADR 008, api architecture, scripts README - Drop @repo/react hook tests that failed (duplicate React under Vitest/pnpm); passWithNoTests aligned with vencura
Restore use-link-email, use-verify-link-wallet, and use-verify-web3-auth tests from before 86b75ae. Drop passWithNoTests. Vitest + pnpm: use preserveSymlinks, dedupe, and realpath-backed aliases for react/react-dom so react-dom and @tanstack/react-query share one React instance (fixes invalid hook call). Add @vitejs/plugin-react for TSX.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
apps/api/package.json (1)
38-38:⚠️ Potential issue | 🟠 MajorRemove inline DB credentials from the reset script.
Line 38 hardcodes
postgres:postgresinsideDATABASE_URL. Even for local-only values, this should come from env to avoid committed credentials and scanner noise.🔧 Proposed fix
- "reset": "supabase db reset && RUN_PG_MIGRATE=true DATABASE_URL=\"postgresql://postgres:postgres@127.0.0.1:54322/postgres\" sh -c 'pnpm db:migrate && node --import tsx scripts/seed.ts'", + "reset": "supabase db reset && sh -c ': \"${DATABASE_URL:?Set DATABASE_URL}\" && RUN_PG_MIGRATE=true pnpm db:migrate && node --import tsx scripts/seed.ts'",As per coding guidelines, “Validate env vars with t3-oss and prefer app-local env (
apps/api/lib/env.ts) with defaults over scattered global constants.”🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@apps/api/package.json` at line 38, The "reset" npm script in package.json currently embeds DB creds in the DATABASE_URL string; remove the hardcoded credentials and wire the script to use the validated env value from your app-local env (apps/api/lib/env.ts) or a DATABASE_URL environment variable instead. Update the "reset" script (the "reset" entry in package.json) to reference process env rather than inline credentials and ensure apps/api/lib/env.ts (t3-oss validation) provides a safe default for local dev, then run pnpm db:migrate and node --import tsx scripts/seed.ts using that env value so no credentials are committed.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@apps/api/package.json`:
- Line 38: The "reset" npm script in package.json currently embeds DB creds in
the DATABASE_URL string; remove the hardcoded credentials and wire the script to
use the validated env value from your app-local env (apps/api/lib/env.ts) or a
DATABASE_URL environment variable instead. Update the "reset" script (the
"reset" entry in package.json) to reference process env rather than inline
credentials and ensure apps/api/lib/env.ts (t3-oss validation) provides a safe
default for local dev, then run pnpm db:migrate and node --import tsx
scripts/seed.ts using that env value so no credentials are committed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2a51cdd2-5daa-4603-bcc6-9d5fbc65d340
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!**/pnpm-lock.yaml
📒 Files selected for processing (15)
README.mdapps/api/README.mdapps/api/drizzle.config.tsapps/api/package.jsonapps/api/scripts/migrate.tsapps/api/scripts/seed.tsapps/api/supabase/config.tomlapps/docu/README.mdapps/docu/content/docs/adrs/008-database.mdxapps/docu/content/docs/architecture/api.mdxapps/docu/content/docs/development/index.mdxpackage.jsonpackages/react/package.jsonpackages/react/vitest.config.tsscripts/README.md
✅ Files skipped from review due to trivial changes (10)
- packages/react/package.json
- apps/docu/README.md
- apps/api/drizzle.config.ts
- apps/docu/content/docs/architecture/api.mdx
- scripts/README.md
- README.md
- apps/api/scripts/migrate.ts
- apps/docu/content/docs/development/index.mdx
- apps/api/README.md
- apps/docu/content/docs/adrs/008-database.mdx
🚧 Files skipped from review as they are similar to previous changes (2)
- apps/api/supabase/config.toml
- apps/api/scripts/seed.ts
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/api/test/swagger-login.e2e.spec.ts (1)
26-28: Use explicitPagetype from@playwright/testinstead ofReturnType<typeof test>['page'].Lines 10 and 27 use
ReturnType<typeof test>['page']for helper function parameters. Importtype { Page } from '@playwright/test'directly—it's more readable and idiomatic in Playwright tests.import type { Page } from '@playwright/test'Then replace both instances with the
Pagetype.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@apps/api/test/swagger-login.e2e.spec.ts` around lines 26 - 28, Replace the non-idiomatic parameter typing that uses ReturnType<typeof test>['page'] with Playwright's explicit Page type: add import type { Page } from '@playwright/test' at the top of the file and update the helper function signatures (e.g., waitForReferenceAuthSettled and the other helper at the top of the file) to accept page: Page instead of ReturnType<typeof test>['page'].
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/api/test/swagger-login.e2e.spec.ts`:
- Around line 33-39: The page.evaluate callback that currently checks
localStorage.getItem('scalar-token') and that u.pathname === '/reference' only
asserts that the 'token' query param is removed; update the assertion inside the
page.evaluate (the function using new URL(window.location.href) and
u.searchParams.has('token')) to also verify that 'verificationId' has been
removed (i.e., ensure both !u.searchParams.has('token') and
!u.searchParams.has('verificationId')) so the callback URL cleanup is fully
validated.
---
Nitpick comments:
In `@apps/api/test/swagger-login.e2e.spec.ts`:
- Around line 26-28: Replace the non-idiomatic parameter typing that uses
ReturnType<typeof test>['page'] with Playwright's explicit Page type: add import
type { Page } from '@playwright/test' at the top of the file and update the
helper function signatures (e.g., waitForReferenceAuthSettled and the other
helper at the top of the file) to accept page: Page instead of ReturnType<typeof
test>['page'].
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9950ded5-e223-4d37-8bdd-6eb8477bdd05
📒 Files selected for processing (2)
apps/api/src/routes/reference/template.tsapps/api/test/swagger-login.e2e.spec.ts
✅ Files skipped from review due to trivial changes (1)
- apps/api/src/routes/reference/template.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Documentation
Chores
Tests