Harden generation, validation, observability and add E2E harness with CI quality pipeline

[Armand9999]

Motivation

• Harden AI generation and persistence paths to validate and safely persist workout and meal plans and to protect against abuse and outages.
• Improve input validation and date handling to ensure deterministic per-day keys and safer profile/TDEE calculations.
• Add structured observability and safer error handling so sensitive values are never printed in logs or readiness responses.
• Provide deterministic end-to-end test coverage and a CI quality workflow that runs linting, type-checking, unit tests and Playwright tests with optional authenticated flows.

Description

• Added validation and domain libraries: app/lib/date.ts, app/lib/profile.ts, app/lib/generated-plans.ts, app/lib/auth.ts, app/lib/profile-options.ts, and a generated app/lib/database.types.ts contract for Supabase typing.
• Reworked generation flows to validate inputs, enforce rate limits (app/lib/rate-limit.ts, app/lib/generation-rate-limit.ts), parse/validate model outputs, and support deterministic E2E fixtures (app/lib/e2e-ai-fixtures.ts), and updated app/lib/workout-generator.ts and app/protected/profile/meal-plan/action.ts to non-destructively upsert generated plans.
• Introduced structured logging and sanitization in app/lib/logger.ts, and replaced ad-hoc console calls with logError/logWarning/logInfo across server code and middleware (middleware.ts, utils/supabase/*, layout, auth flows).
• Added health and readiness endpoints at GET /api/health and GET /api/readiness, plus environment validation and a scripts/check-env.mjs helper and .env.example with CI-friendly placeholders.
• Added Playwright E2E harness, tests, and config (e2e/*.ts, playwright.config.ts), CI workflow (.github/workflows/quality.yml) to run npm run env:check, npm run check, npm run build and npm run test:e2e, and Playwright auth setup with an optional mocked-AI mode.
• Expanded type-checking and test infra: tsconfig.test.json, new test suite using Node's test runner (tests/*.test.ts) and package.json scripts (test, check, test:e2e, env:check), plus Git ignore and ESLint updates.
• Database migration and release docs: added Supabase project config and reconciliation migration (supabase/migrations/...) with preflight SQL, docs/release.md, and related seed/config files.
• Small UI and behavior fixes: switched logo to next/image in NavBar, added forgot/reset password pages and flows, improved profile form UX and validation, and fixed various date/key usages in client DB helpers and components.

Testing

• Unit and integration tests were added under tests/ and executed via npm test; the new test suite (validation, date utilities, tde, generated plans, rate limiter, DB migration contract, observability, and env-check) ran successfully in the local test run.
• Linting and type checks were run via npm run check and completed successfully during the quality run configuration.
• Playwright E2E coverage is integrated into CI via npm run test:e2e and playwright.config.ts, with authenticated protected-flow and mocked-AI scenarios gated by E2E_AUTH_EMAIL, E2E_AUTH_PASSWORD, and E2E_MOCK_AI environment variables; the CI workflow will upload failure artifacts (playwright-report/, test-results/) when tests fail.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fitness-app	Ready	Preview, Comment	Jun 23, 2026 3:43am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d67ff55a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use real Supabase credentials for authenticated E2E

When E2E_AUTH_EMAIL and E2E_AUTH_PASSWORD secrets are configured, playwright.config.ts enables the authenticated projects, but this job still starts the app with the placeholder Supabase URL/key here. In that advertised CI configuration the auth setup tries to sign in against example.supabase.co with test-anon-key, so npm run test:e2e fails before protected/mocked tests can run; use real Supabase CI secrets for these vars, or only set the auth secrets when the matching Supabase env is present.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep E2E_MOCK_AI out of copied env files

README tells developers to cp .env.example .env.local, and the app's isE2EAIMockEnabled() switches generation to fixtures whenever E2E_MOCK_AI === '1'. With this value present in the template, any dev/deploy that follows setup will silently save deterministic E2E meal/workout plans instead of calling OpenAI; leave this unset/commented by default and set it only in the Playwright environment.

Useful? React with 👍 / 👎.