Merge remote-tracking branch 'origin/main' into fix/security-3-new-alerts

Author: ogabasseyy

.github/scripts/apply-pending-migrations-gigl-history.test.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -euo pipefail
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+fixture_root="$(mktemp -d)"
+trap 'rm -rf "$fixture_root"' EXIT
+mkdir -p "$fixture_root/bin" "$fixture_root/migrations"
+export FAKE_QUERY_LOG="$fixture_root/queries.log"
+export MIGRATIONS_DIR="$fixture_root/migrations"
+export SUPABASE_ACCESS_TOKEN=test SUPABASE_PROJECT_REF=test
+export PATH="$fixture_root/bin:$PATH"
+cat >"$fixture_root/bin/curl" <<'CURL'
+#!/usr/bin/env bash
+payload="$(cat)"
+printf '%s\n' "$payload" >>"$FAKE_QUERY_LOG"
+if jq -e '.query | startswith("SELECT version, name")' >/dev/null <<<"$payload"; then
+  printf '%s\n' "$FAKE_INITIAL_RESPONSE"
+else
+  printf '%s\n' '[]'
+fi
+CURL
+chmod +x "$fixture_root/bin/curl"
+converge=20260805091000_converge_gigl_tracking_worker_nologin
+restore=20260805113000_restore_gigl_tracking_postgrest_capability
+isolate=20260805170000_isolate_gigl_tracking_postgrest_capability
+for migration in "$converge" "$restore" "$isolate"; do
+  cp "$script_dir/../../supabase/migrations/$migration.sql" "$MIGRATIONS_DIR/"
+done
+export FAKE_INITIAL_RESPONSE='[{"version":"20260805091000","name":"enable_least_privilege_gigl_tracking_login"}]'
+export MIGRATION_MAX_VERSION=20260805113000
+bash "$script_dir/apply-pending-migrations.sh" >"$fixture_root/output"
+grep -q "reconciled by repair migration $restore.sql" "$fixture_root/output"
+grep -q 'ALTER ROLE gigl_tracking_worker NOLOGIN' "$FAKE_QUERY_LOG"
+grep -q 'enforce_gigl_tracking_worker_request_scope' "$FAKE_QUERY_LOG"
+if grep -q 'GRANT gigl_tracking_worker TO authenticator' "$FAKE_QUERY_LOG" || \
+   grep -q 'INSERT INTO supabase_migrations.schema_migrations.*20260805091000' "$FAKE_QUERY_LOG"; then
+  echo 'Must preserve historical record and defer membership until the hook probe' >&2
+  exit 1
+fi
+
+expect_refusal() {
+  : >"$FAKE_QUERY_LOG"
+  if bash "$script_dir/apply-pending-migrations.sh" >"$fixture_root/refusal" 2>&1; then
+    echo 'Expected invalid history or missing repair to fail closed' >&2
+    exit 1
+  fi
+  [ "$(jq -s length "$FAKE_QUERY_LOG")" = 1 ]
+}
+export FAKE_INITIAL_RESPONSE='[{"version":"20260805091000","name":"unexpected"}]'
+expect_refusal
+export FAKE_INITIAL_RESPONSE='[{"version":"20260805091000","name":"enable_least_privilege_gigl_tracking_login"},{"version":"20260805113000","name":"unexpected"}]'
+expect_refusal
+export FAKE_INITIAL_RESPONSE='[{"version":"20260805091000","name":"enable_least_privilege_gigl_tracking_login"}]'
+mv "$MIGRATIONS_DIR/$restore.sql" "$fixture_root/restore.sql"
+expect_refusal
+
+# Once the actual repair is recorded, a retry must not replay either old role
+# transition or require the historical repair file to remain in a sparse tree.
+export FAKE_INITIAL_RESPONSE='[{"version":"20260805091000","name":"enable_least_privilege_gigl_tracking_login"},{"version":"20260805113000","name":"restore_gigl_tracking_postgrest_capability"}]'
+: >"$FAKE_QUERY_LOG"
+bash "$script_dir/apply-pending-migrations.sh" >"$fixture_root/retry"
+[ "$(jq -s length "$FAKE_QUERY_LOG")" = 1 ]
+printf '%s\n' 'GIGL migration history reconciliation tests passed'

.github/scripts/historical-migration-repair-spec.sh

@@ -68,6 +68,15 @@ historical_collision_repair_spec() {
     20260805090000:complete_merchant_invoice_partial_payments)
       printf '%s\t%s\n' '20260805090002' 'reapply_complete_merchant_invoice_partial_payment'
       ;;
+    # Production recorded the interim LOGIN revision under this version.
+    # These are different role contracts, not spelling aliases: require the
+    # later NOLOGIN + scope-hook repair before treating history as reconciled.
+    # The applier preserves the old row; deploy still probes the loaded hook
+    # before the separate isolate migration grants authenticator membership.
+    20260805091000:enable_least_privilege_gigl_tracking_login | \
+    20260805091000:converge_gigl_tracking_worker_nologin)
+      printf '%s\t%s\n' '20260805113000' 'restore_gigl_tracking_postgrest_capability'
+      ;;
     20260811120000:quiz_leaderboard_and_claim_projections_v2 | \
     20260811120000:allow_reviewed_paystack_email_mismatch)
       printf '%s\t%s\n' '20260813144355' 'reapply_allow_reviewed_paystack_email_mismatch'
@@ -78,7 +87,7 @@ historical_collision_repair_spec() {
 
 historical_collision_version_is_known() {
   case "$1" in
-    20260615120000 | 20260713130000 | 20260805090000 | 20260811120000) return 0 ;;
+    20260615120000 | 20260713130000 | 20260805090000 | 20260805091000 | 20260811120000) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -91,6 +100,8 @@ historical_collision_name_is_valid() {
     20260713130000:quiz_finalize_rank_winners | \
     20260805090000:add_least_privilege_gigl_tracking_worker | \
     20260805090000:complete_merchant_invoice_partial_payments | \
+    20260805091000:enable_least_privilege_gigl_tracking_login | \
+    20260805091000:converge_gigl_tracking_worker_nologin | \
     20260811120000:quiz_leaderboard_and_claim_projections_v2 | \
     20260811120000:allow_reviewed_paystack_email_mismatch)
       return 0

.github/scripts/inject-prebuilt-env-secret.jwk.test.mjs

@@ -173,10 +173,10 @@ test('generated JWK stand-in accepts a fully resolved nonempty fallback', () =>
   assert.match(stdout, /verified.*legacy signing-secret fallback/i);
 });
 
-test('generated JWK stand-in accepts only explicit blank dotenv forms', () => {
+test('generated JWK stand-in accepts explicit blanks and the CLI sensitive marker', () => {
   const generatedValues = [];
 
-  for (const blankValue of ['', "''", '""']) {
+  for (const blankValue of ['', "''", '""', '"[SENSITIVE]"']) {
     const file = makePulledJwkEnvFile(blankValue);
     const stdout = run([JWK_KEY, file, GENERATE_ES256_JWK_STANDIN]);
     const generatedValue = parseSingleQuotedValue(file, JWK_KEY);

.github/scripts/inject-prebuilt-env-secret.mjs

@@ -1,20 +1,22 @@
 #!/usr/bin/env node
 // Ensure a single key is present in a Vercel-pulled dotenv file so the local
 // prebuilt `vercel build` passes env.ts's build-time presence validation for a
-// *sensitive* (write-only) Vercel env var — which `vercel pull` returns EMPTY
-// (`KEY=""`). The value is consumed only at RUNTIME, where Vercel injects the
-// real sensitive value and env.ts re-validates against it. The injected key is
+// *sensitive* (write-only) Vercel env var — which `vercel pull` redacts as
+// `KEY=""` or, since CLI 57, `KEY="[SENSITIVE]"`. The value is consumed only at
+// RUNTIME, where Vercel injects the real value and env.ts re-validates it.
+// The injected key is
 // server-only (not `NEXT_PUBLIC_`), so it is never bundled client-side.
 //
 // Usage: node inject-prebuilt-env-secret.mjs <KEY> <ENV_FILE> [STANDIN]
 //   process.env[<KEY>]  real value (for example, a GitHub Actions secret). If
 //                       non-empty, it is injected unconditionally.
 //   [STANDIN]           optional build-time stand-in. Used only when the real
 //                       value is empty and Vercel pulled exactly one explicitly
-//                       blank `<KEY>=`, `<KEY>=''`, or `<KEY>=""` entry.
+//                       blank `<KEY>=`, `<KEY>=''`, or `<KEY>=""` entry, or
+//                       the exact CLI marker `<KEY>="[SENSITIVE]"`.
 //   --generate-es256-jwk-standin
 //                       generate an ephemeral ES256 private JWK only after the
-//                       same explicit-blank check. When the optional key is
+//                       same redaction check. When the optional key is
 //                       absent, leave the file unchanged so production can use
 //                       the configured legacy signing-secret fallback. The JWK
 //                       is written directly to the pulled file and is never
@@ -50,8 +52,10 @@ function findDotenvAssignments(lines, targetKey) {
   });
 }
 
-function isExplicitlyBlankDotenvValue(value) {
-  return value === '' || value === "''" || value === '""';
+function isRedactedDotenvValue(value) {
+  return (
+    value === '' || value === "''" || value === '""' || value === '"[SENSITIVE]"'
+  );
 }
 
 function readExpandedDotenvValue(contents, file, targetKey) {
@@ -143,19 +147,19 @@ if (usingGeneratedStandin && assignments.length === 0) {
   process.exit(0);
 }
 
-// A stand-in may only substitute for Vercel's write-only blank placeholder.
-// Refusing absent, duplicated, nonblank, or malformed-looking entries avoids
+// A stand-in may only substitute for Vercel's exact write-only placeholders.
+// Refusing absent, duplicated, non-redacted, or malformed-looking entries avoids
 // replacing a value that Vercel pull did expose or an opaque dotenv construct.
 if (
   usingStandin &&
-  (assignments.length !== 1 || !isExplicitlyBlankDotenvValue(assignments[0].value))
+  (assignments.length !== 1 || !isRedactedDotenvValue(assignments[0].value))
 ) {
   const state =
     assignments.length === 0
       ? 'absent'
       : assignments.length > 1
         ? 'ambiguous'
-        : 'not explicitly blank';
+        : 'not explicitly blank or a recognized sensitive marker';
   console.error(
     `${key} is ${state} in ${file}. Refusing to replace it with a build-time ` +
       'stand-in; configure Vercel with a write-only sensitive value or provide a real value.',

.github/scripts/inject-prebuilt-env-secret.test.mjs

@@ -99,6 +99,22 @@ test('stand-in is refused when the sensitive var is absent from Vercel', () => {
   assert.equal(fs.readFileSync(file, 'utf8'), before);
 });
 
+test('refuses marker lookalikes, real values, and duplicate redacted entries', () => {
+  for (const assignment of [
+    `${KEY}="[SENSITIVE]extra"`,
+    `${KEY}=" [SENSITIVE] "`,
+    `${KEY}="[sensitive]"`,
+    `${KEY}="actual-runtime-value"`,
+    `${KEY}="[SENSITIVE]"\n${KEY}=""`,
+  ]) {
+    const contents = `${assignment}\n`;
+    const file = makeEnvFile(contents);
+    const { status } = runExpectFailure([KEY, file, STANDIN]);
+    assert.equal(status, 1);
+    assert.equal(fs.readFileSync(file, 'utf8'), contents);
+  }
+});
+
 test('refuses a value containing a dollar sign because dotenv-expand can mangle it', () => {
   const file = makeEnvFile();
   const before = fs.readFileSync(file, 'utf8');

.github/scripts/refuse-publish-on-promote-overlap.sh

@@ -45,7 +45,8 @@ esac
 `
   );
   chmodSync(stubPath, 0o755);
-  const result = spawnSync('bash', [scriptPath], {
+  // Execute exactly as deploy.yml does so a missing executable bit fails CI.
+  const result = spawnSync(scriptPath, [], {
     cwd: workDir,
     encoding: 'utf8',
     env: {

.github/scripts/refuse-publish-on-promote-overlap.test.mjs

@@ -58,6 +58,7 @@ node --test "$repo_root/supabase/tests/serialized_variant_inventory_concurrency_
 node --test "$repo_root/supabase/tests/serialized_variant_inventory_concurrency_fixture_functions.test.mjs"
 bash "$script_dir/apply-pending-migrations.test.sh"
 bash "$script_dir/apply-pending-migrations-max-version.test.sh"
+bash "$script_dir/apply-pending-migrations-gigl-history.test.sh"
 node --test "$script_dir/repair-sales-migration-collision.test.mjs"
 node --test "$script_dir/repair-sales-migration-collision.sql.test.mjs"
 node --test "$script_dir/shipping-policy-audit-repair.test.mjs" "$script_dir/shipping-policy-audit-repair.sql.test.mjs"

.github/scripts/run-migration-applier-tests.sh

@@ -27,15 +27,34 @@ async function readWebFilter(filterPath = '.github/filters/ci.yml') {
   return { webFilter, webFilterIndex, workflow };
 }
 
-test('the Quality Gate generates route types and reaches the tools and worker TypeScript project', async () => {
+test('the Quality Gate generates route types and reaches the tools, worker, and MCP TypeScript projects', async () => {
   const pkg = JSON.parse(await readFile('apps/web/package.json', 'utf8'));
   const toolsTsconfig = JSON.parse(await readFile('apps/web/tsconfig.tools-workers.json', 'utf8'));
+  const mcpTsconfig = JSON.parse(await readFile('apps/web/tsconfig.mcp.json', 'utf8'));
+  const webTsconfig = JSON.parse(await readFile('apps/web/tsconfig.json', 'utf8'));
   const configTest = await readFile('.github/scripts/resolve-ci-test-plan-config.test.mjs', 'utf8');
   const { webFilter, webFilterIndex, workflow } = await readWebFilter();
 
   assert.notEqual(webFilterIndex, -1);
-  assert.equal(pkg.scripts.typecheck, 'next typegen && tsc --noEmit && pnpm typecheck:tools-workers');
+  assert.equal(pkg.scripts.typecheck, 'next typegen && tsc --noEmit && pnpm typecheck:tools-workers && pnpm typecheck:mcp');
   assert.equal(pkg.scripts['typecheck:tools-workers'], 'tsc --noEmit -p tsconfig.tools-workers.json');
+  assert.equal(pkg.scripts['typecheck:mcp'], 'tsc --noEmit -p tsconfig.mcp.json');
+  assert.equal(mcpTsconfig.extends, './tsconfig.json');
+  assert.equal(webTsconfig.compilerOptions.strict, true);
+  assert.notEqual(mcpTsconfig.compilerOptions.strict, false);
+  assert.deepEqual(mcpTsconfig.include, [
+    'mcp-server/server.ts',
+    'mcp-server/server-output-schema.test.ts',
+    'mcp-server/product-variants-output.test.ts',
+    'mcp-server/product-variants-color-evidence.test.ts',
+    'mcp-server/browse-catalog-facets.test.ts',
+    'mcp-server/server-cart-handoff.test.ts',
+    'mcp-server/variant-attribute-text-value.test.ts',
+    'mcp-server/delivery-fee-quotes.test.ts',
+    'mcp-server/delivery-gigl-quotes.test.ts',
+    'mcp-server/server-delivery-gigl.test.ts',
+  ]);
+  assert.ok(!mcpTsconfig.exclude.includes('mcp-server'));
   assert.deepEqual(toolsTsconfig.compilerOptions.types, [
     'node', 'vitest/globals', '@testing-library/jest-dom', 'google.maps',
   ]);

.github/scripts/tools-worker-typecheck-contract.test.mjs

@@ -5,7 +5,8 @@
 # Mirror isExplicitlyDisabledEnv: only 0/false/off bypass this gate; an
 # unset flag counts as enabled, matching the runtime default.
 # The injector proves the Production key is DEFINED (Vercel pulls sensitive
-# values blank); it cannot prove the value is real or unexpired. Operators
+# values blank or as the CLI 57 [SENSITIVE] marker); it cannot prove the value
+# is real or unexpired. Operators
 # must keep the same rotated worker JWT in Vercel Production and the VPS
 # worker .env, or the retained manual fallback route returns 500.
 # Rotation procedure (expiry check + rotate steps):