feat(audit): sessão Maestro 2026-05-12 — RLS 100%, FK órfãos limpos, guardas anti-órfão#147
Conversation
…guardas anti-órfão - 5 migrations SQL: RLS partições, smoke test v2 refs, FK órfãos, MV metrics, instance auth events - scripts/check-references.ts: guarda anti-órfão no CI (detecta referências quebradas) - scripts/smoke-pre-deploy.sh: smoke pre-deploy (env → tsc → eslint → build → RPC smoke) - scripts/reconnect-wpp2.sh: helper de reconexão da instância wpp2 - CI: step "Check for orphaned references" adicionado após Install - Remove apply-chatpanel-fixes.yml (workflow one-shot já consumado, ref órfã) - docs/audit/*: 9 arquivos de auditoria e plano de remediação - docs/INBOX_READ_CONTRACT.md: contrato real alinhado com regra ESLint no-restricted-imports Closes #129
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (21)
WalkthroughSessão de remediação autônoma (Maestro 2026-05-12) implementando plano pós-auditoria: 6 migrations SQL executam 51 tabelas com RLS, removem 7.249 FK órfãos, corrigem smoke test quebrado e otimizam índice. Scripts e CI adicionam guardas anti-órfão, pré-deploy e RPC compliance. Docs consolidam achados, playbooks e contrato Inbox. Removido workflow obsoleto. ChangesRemediação pós-auditoria e guardas anti-regressão
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes PR é grande (3000+ linhas) com mudanças heterogêneas (SQL migrations, shell scripts, TypeScript, 11 docs Markdown). Esforço concentra-se em: (1) validar 6 migrations SQL (idempotência, guards com Possibly related issues
Possibly related PRs
✨ Finishing Touches📝 Generate docstrings
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39b404dbdb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ALTER TABLE public.instance_auth_events | ||
| ALTER COLUMN event_type DROP NOT NULL; |
There was a problem hiding this comment.
This migration unconditionally executes ALTER COLUMN event_type DROP NOT NULL, but in this repo's own migration chain public.instance_auth_events is initially created without an event_type column (and later CREATE TABLE IF NOT EXISTS statements do not backfill missing columns). On a clean supabase db reset/replay, this statement fails with column "event_type" does not exist, which blocks this migration and all subsequent migrations.
Useful? React with 👍 / 👎.
|
|
||
| -- T10: CORRIGIDO (rpc_dashboard_home → rpc_zapp_dashboard) | ||
| RETURN QUERY SELECT '10_rpc_dashboard'::text, 'rpc'::text, | ||
| CASE WHEN (SELECT count(*) FROM public.rpc_zapp_dashboard()) > 0 THEN 'PASS' ELSE 'FAIL' END, |
There was a problem hiding this comment.
Test 10_rpc_dashboard now calls public.rpc_zapp_dashboard(), but there is no migration in the repository that defines this function (the only occurrence is this call site). In environments provisioned from migrations, executing fn_zapp_web_smoke_test_v2 will error with function ... does not exist at this step, aborting the smoke function instead of returning results.
Useful? React with 👍 / 👎.
|
|
||
|
|
||
| - name: Check for orphaned references | ||
| run: bunx tsx scripts/check-references.ts |
There was a problem hiding this comment.
Adding this CI gate makes the pipeline fail on the current repository state, because scripts/check-references.ts validates package.json script targets and package.json still contains perf:budget/perf:budget:baseline pointing to scripts/check-performance-budget.mjs, which is not present. As a result, every PR run will fail at this new step before lint/build/tests.
Useful? React with 👍 / 👎.
| -- T07: CORRIGIDO (v_webhook_health → v_webhook_events_last_hour) | ||
| RETURN QUERY SELECT '07_webhook_saude_1h'::text, 'webhook'::text, | ||
| 'PASS'::text, | ||
| 'evt_1h=' || COALESCE((SELECT count(*) FROM public.v_webhook_events_last_hour)::text, '0'), |
There was a problem hiding this comment.
The updated smoke function now queries public.v_webhook_events_last_hour, but this view is not defined anywhere in the repository's migration set (its only SQL occurrence is this call). In migration-provisioned environments, fn_zapp_web_smoke_test_v2() fails at test T07 with relation does not exist, so the pre-deploy smoke gate aborts before reporting downstream checks.
Useful? React with 👍 / 👎.
| RETURN QUERY SELECT '15_migration_audit_registros'::text, 'governance'::text, | ||
| CASE WHEN count(*) >= 40 THEN 'PASS' ELSE 'WARN' END, | ||
| count(*)::text, '✅'::text | ||
| FROM archive.migration_audit; |
There was a problem hiding this comment.
T15 now reads from archive.migration_audit, but there is no migration in the repo that creates that table, so this reference is unresolved in a clean database built from versioned SQL. When execution reaches this branch, fn_zapp_web_smoke_test_v2() errors and stops instead of returning a full smoke result set.
Useful? React with 👍 / 👎.
2 participants
Versão limpa de #129 rebaseada no main atual. Arquivos já presentes no main foram omitidos (
scripts/verify_rls_compliance.tsjá mergeado via #143,vite.config.tsvia #145,package.jsonsem mudanças reais).Incluído
Migrations SQL (5 arquivos):
20260512170857— RLS nas partições + RPCrpc_check_rls_compliance20260512170900— Corrige referências quebradas no smoke test v220260512170915— Limpeza de 7.249 FK órfãos + constraintfk_evolution_messages_contact20260512170920— Otimização do refresh da MVmv_daily_metrics20260512201500— Fix schemainstance_auth_eventsScripts:
scripts/check-references.ts— guarda anti-órfão integrado no CIscripts/smoke-pre-deploy.sh— smoke pre-deploy (5 etapas)scripts/reconnect-wpp2.sh— helper de reconexão da instância wpp2CI:
apply-chatpanel-fixes.yml(workflow one-shot, ref órfã)Docs (9 arquivos
docs/audit/):Closes #129
Generated by Claude Code
Summary by cubic
Hardened the database and CI after the Maestro 2026-05-12 audit: 100% RLS on evolution partitions, orphan FKs cleaned and prevented, faster daily metrics, and new guards in CI and pre-deploy. Adds docs and operational scripts; removes a stale workflow.
New Features
scripts/check-references.tsto fail on broken file/script/doc references; wired into CI viabunx tsx scripts/check-references.ts.scripts/smoke-pre-deploy.sh(types, lint, build, RPC smoke).scripts/reconnect-wpp2.sh.docs/audit/*,docs/INBOX_READ_CONTRACT.md)..github/workflows/apply-chatpanel-fixes.yml.Migration
public.rpc_check_rls_compliance.fn_zapp_web_smoke_test_v2broken references and thresholds.evolution_messages.contact_idand added FK withON DELETE SET NULL.mv_daily_metricsrefresh with targeted partial index and ANALYZE.public.instance_auth_eventsschema to match Edge Function writes.Written for commit 39b404d. Summary will update on new commits. Review in cubic
Summary by CodeRabbit
Release Notes
Documentation
Refactor
Infrastructure
Chores