Add validation, date domain, Supabase schema reconciliation, Playwright E2E, and type-safe Supabase clients

[Armand9999]

Motivation

• Harden the application by introducing explicit validation for auth, profile, generated plans, and dates to prevent invalid user or AI-generated data from being persisted.
• Make daily keys timezone-safe by deriving database date keys from the local calendar instead of UTC serialization to avoid off-by-one errors.
• Reconcile and harden the existing Supabase schema with safe migrations, Row Level Security policies, and an atomic server-side save_profile_with_tde function.
• Add deterministic end-to-end coverage and CI quality gating to catch regressions in authentication and protected flows.

Description

• Added domain and validation libraries: app/lib/date.ts, app/lib/auth.ts, app/lib/profile.ts, app/lib/generated-plans.ts, app/lib/profile-options.ts, and app/lib/definitions.ts to centralize schemas and date handling.
• Refactored TDEE calculation to a typed API in app/lib/tde.ts and wired profile saving to a database RPC save_profile_with_tde used by app/protected/profile/action.ts.
• Reworked generation persistence to validated upserts and strict parsing of AI responses in app/lib/workout-generator.ts and app/protected/profile/meal-plan/action.ts, using parseGeneratedContent and zod schemas to enforce structure.
• Introduced a typed Supabase database contract app/lib/database.types.ts and updated Supabase helper wrappers (utils/supabase/*.ts) to preserve the Database generic across server, client, and middleware boundaries.
• Replaced UTC-derived daily keys with local-date helpers (getLocalDateKey, parseDateKey, getLocalWeekRange) and updated callers (client-database.ts, WeeklyProgress.tsx, WorkoutTemplates.tsx, meal-plan UI) to use validated date keys.
• Added auth UX flows and server actions for password recovery and reset (app/forgot-password/*, app/reset-password/*) and hardened the auth callback (app/auth/confirm/route.ts) to accept both OTP and code exchanges with safe redirect handling.
• UI tweaks: switched logo to next/image in NavBar.tsx, removed external Google font usage and rely on system fonts via globals.css, and improved profile setup and form error handling in app/protected/profile/*.
• Added a comprehensive Supabase reconciliation migration and preflight checks under supabase/migrations and supabase/preflight to safely alter existing tables, add constraints, indexes, policies, and the save_profile_with_tde function.
• Testing, CI, and E2E: added unit tests (tests/*.test.ts), Playwright harness and specs (e2e/*.ts), Playwright config (playwright.config.ts), a GitHub workflow (.github/workflows/quality.yml) to run lint/typecheck/build and Playwright, and helper scripts and .env.example updates for CI secrets and local development.
• Tooling: updated package.json scripts (lint, typecheck, test, test:e2e, ci), tsconfig.test.json for test compilation, eslint.config.mjs ignores, .gitignore entries for test and Playwright artifacts, and added Playwright dev dependency to package.json/package-lock.json.

Testing

• Ran repository quality checks locally: npm run lint, npm run typecheck, and the unit suite via npm test; the lint/type-check/unit pipeline completed successfully.
• Executed Playwright end-to-end suites with npm run test:e2e (public journeys and conditional authenticated flows when E2E_AUTH_* are provided); Playwright tests ran under the configured local harness and the public auth scenarios passed in the configured test runs.
• Added a CI workflow file (.github/workflows/quality.yml) that replicates the local quality gate and uploads Playwright artifacts on failure to assist debugging.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fitness-app	Ready	Preview, Comment	Jun 16, 2026 3:46am

[chatgpt-codex-connector]

💡 Codex Review

fitness-app/supabase/preflight/20260611170000_reconcile_fitness_schema.sql

Lines 24 to 27 in 99b685f

	select * from public.workout_plans
	where user_id is null or date is null or workout_type is null or duration_minutes is null
	or duration_minutes <= 0 or difficulty is null or exercises is null
	or jsonb_typeof(exercises) <> 'array';

Add enum checks to the preflight script

If existing workout_plans rows contain non-null but unsupported values such as workout_type = 'yoga' or difficulty = 'expert', this preflight query still returns no rows because it only checks nulls/ranges/json shape, but the migration later adds workout_type and difficulty CHECK constraints and will abort during db push after operators were told the preflight was clean. Please mirror the new enum constraints here; the same gap exists for meal_plans.goal and tde_estimates.method.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".