tiennm99
0a08f80450
feat(phase-1): db schema init (bsk_init migration + roles)
...
- supabase/migrations/20260525163300_bsk_init.sql: bsk schema, app_role
enum, app_users enrollment table, current_role() SECURITY DEFINER
STABLE helper, RLS enabled with two SELECT policies (own row + admin)
- types/supabase-bsk.ts: hand-written placeholder mirroring canonical
supabase gen output; regenerate via pnpm db:gen-types after migration
applied
- lib/db/roles.ts: appRoles tuple + AppRole union + satisfies guard
against generated enum + isAppRole type guard
- package.json: db:gen-types script
- README: one-line note on regenerating types after db:push
- plans/: include phase 02/04/06 detail files alongside the existing
01/03/05 (planner output that wasn't committed with the trim)
2026-05-25 17:23:08 +07:00
tiennm99
eeda68c34a
chore(ci): add NEXT_PUBLIC_*=sb_secret_* leak guard
...
Defense-in-depth check that fails the build (and the local pre-push
workflow) if a server secret value is assigned to a NEXT_PUBLIC_*
variable — those get bundled into the browser by Next.js.
- scripts/check-no-secret-leak.mjs: git grep for the assignment shape,
excluding lockfiles and the script itself
- package.json: pnpm check:no-secret-leak
- .github/workflows/ci.yml: run the guard right after install, before
format/lint/typecheck/build
- docs/threat-model.md: close the last Unresolved item
2026-05-25 16:19:43 +07:00
tiennm99
0393ddf6ec
docs(infra): add shared-supabase config, restore runbook, threat model, db preflight
...
- docs/supabase-shared-config.md: registry of project-wide Supabase
settings (auth, JWT, email, keys, storage, realtime) shared across
sibling apps; change-coordination protocol
- docs/runbooks/restore-from-bad-migration.md: per-schema recovery via
pg_dump --schema=bsk that avoids project-wide PITR (which would also
wipe sibling apps)
- docs/threat-model.md: trust model, sibling-app invite-only policy
(mitigates auth.users blast radius), R1-R8 residual risks, unresolved
questions for Phase 1
- scripts/preflight-supabase.ts: refuses 'supabase db push' unless the
linked project ref is in ALLOWED_PROJECT_REFS; wired via pnpm db:push
- package.json: tsx devDep, db:preflight + db:push scripts
- pnpm-workspace.yaml: allowBuilds esbuild=true (required for tsx)
2026-05-25 15:57:10 +07:00
tiennm99
b88147059e
feat: scaffold Phase 0 foundation (Next.js 16 + Tailwind v4 + Supabase/Upstash)
...
Initial code drop for the BSK educational rewrite. Repo previously held only
docs (PLAN.md, README, NOTICE, LICENSE, RESEARCH_REPORT). This commit lands
the App Router shell, i18n route group, and shared-infra factories per the
Phase 0 plan.
Scaffold:
- Next.js 16 + React 19 + TypeScript 5.9, App Router, Turbopack defaults
- Tailwind v4 via @tailwindcss/postcss with CSS-first @theme block
- shadcn/ui CLI v4 (components.json + cn helper); components install lazily
- next-intl v4 with vi default + en fallback; async-params-aware routing
- proxy.ts (Next 16's renamed middleware) wired to next-intl
- lib/supabase/{server,client,admin,session}.ts on @supabase/ssr, schema-scoped
to 'bsk', async cookies(), server factory unsafe inside 'use cache'
- lib/upstash.ts: prefixed cache helpers and Ratelimit v2, QStash signature
verifier; future code cannot write unprefixed Redis keys
- lib/env/{client,server}.ts split so the secret key types stay server-side
- ESLint flat config (eslint-config-next/core-web-vitals + typescript +
prettier), Prettier with tailwindcss plugin, .npmrc + pnpm-workspace.yaml
for pnpm 11 native-build approval
- CI runs format:check, lint, typecheck, build on PR with dummy env
PLAN.md updates:
- §1 reconciled to TypeScript 5.9 (TS 6 is GA but lacks ecosystem support)
- §3.1 notes middleware → proxy file rename and removal of `next lint`
All four gates pass locally: format:check, lint, typecheck, build (SSG for
/vi and /en, Proxy detected). Code-reviewer findings applied: env split,
session helper renamed and docstring fixed, cache.set/del types tightened,
prettierignore scope reduced, bilingual GlobalNotFound, explanatory comments
on no-op layouts and duplicate setRequestLocale.
Deferred to Phase 1: wiring updateSupabaseSession into proxy.ts (needs auth
flow first), schema migrations, sign-in form.
2026-05-25 10:58:04 +07:00
tiennm99