Add robust domain validation, Supabase contracts, generation safety, CI, and E2E tests

[Armand9999]

Motivation

• Harden domain logic and date handling so daily keys are derived from local calendar values instead of UTC serialization.
• Validate and canonicalize generated AI content and user input to prevent invalid persistence and improve UX for profile, password recovery, and reset flows.
• Make Supabase client usage and server/middleware contracts strongly typed, preserve database contract, and reconcile the existing remote schema safely.
• Add deterministic quality checks and Playwright end-to-end coverage in CI to prevent regressions in public authentication journeys.

Description

• Introduces a local date domain and utilities in app/lib/date.ts and replaces ad-hoc toISOString().split('T')[0] usage across client-database, workout and meal-plan flows to use getLocalDateKey/parseDateKey and week ranges; updates components and actions to accept validated date keys.
• Adds strict Zod schemas and parsing for sign-up/login/profile/workout/meal-plan generation in app/lib/* (generated-plans.ts, profile.ts, definitions.ts, auth.ts) and enforces validation before saving or generating plans; generated plans are parsed and validated before persistence.
• Reworks workout and meal generation to use the OpenAI SDK safely, persist generated results non-destructively with upsert on user_id,date, and adds a server-side atomic save_profile_with_tde RPC with a reconciliation migration under supabase/migrations to harden RLS, constraints, indices, and ownership.
• Strengthens Supabase helpers and middleware typing (utils/supabase/*) to import the generated Database contract, improves middleware behavior for protected vs public routes, and updates server/browser helpers to cast to SupabaseClient<Database>.
• Adds password recovery and reset flows (/forgot-password, /reset-password, app/auth/confirm/route.ts) with safe redirect handling and UI pages/actions, plus UI improvements (logo next/image, accessible links) and removes bundled Google font variables in favor of system fonts.
• Adds project and CI infra: .env.example, .github/workflows/quality.yml, playwright.config.ts, package.json scripts for lint, typecheck, test, Playwright E2E, eslint.config.mjs ignore entries, tsconfig.test.json, and ignores for generated artifacts; includes Playwright spec e2e/public-auth.spec.ts and many unit tests under tests/ that exercise schemas, date logic, TDE, migration contract, and generation persistence.

Testing

• Lint and type checks were run via npm run check (which runs npm run lint and npm run typecheck) and completed successfully.
• Unit tests were executed via npm test (Node built-in test runner compiling tsconfig.test.json) and the test suite for schemas, date utilities, TDE, and migration contract passed.
• The production build was validated with npm run build and succeeded.
• Playwright end-to-end scenarios were added and exercised via npm run test:e2e in the CI workflow (.github/workflows/quality.yml), and the public authentication journeys completed successfully with failure artifacts configured to upload on failure.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fitness-app	Ready	Preview, Comment	Jun 15, 2026 10:17pm

[chatgpt-codex-connector]

💡 Codex Review

fitness-app/supabase/preflight/20260611170000_reconcile_fitness_schema.sql

Lines 25 to 27 in ca739ba

	where user_id is null or date is null or workout_type is null or duration_minutes is null
	or duration_minutes <= 0 or difficulty is null or exercises is null
	or jsonb_typeof(exercises) <> 'array';

Add enum checks to migration preflight

In an existing project where a legacy workout row has a non-null but unsupported workout_type or difficulty value (possible because the previous AI output was persisted without schema validation), this preflight query still returns zero rows, but the migration later adds workout_plans_workout_type_check and workout_plans_difficulty_check and aborts during db push. Please mirror those enum checks here, and do the same for the analogous meal_plans.goal and tde_estimates.method constraints, so operators can find and clean data before applying the migration.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".