Add generation, validation, observability, and E2E harness with CI checks

[Armand9999]

Motivation

• Harden the app for production by adding deterministic generation contracts, request rate-limits, and structured logging for observability.
• Make generated meal/workout content and date handling robust by validating inputs and using browser-local date keys to avoid UTC drift.
• Add CI and Playwright E2E coverage (public and optional authenticated/mock-AI flows) and an environment validation step to prevent secret leakage in logs.
• Reconcile and document the Supabase schema and deployment/runbook to enable safe migrations and rollbacks.

Description

• Introduces typed domain libraries and validators: app/lib/date.ts, app/lib/generated-plans.ts, app/lib/profile.ts, app/lib/profile-options.ts, and app/lib/auth.ts, plus a generated-compatible app/lib/database.types.ts contract.
• Adds observability and safety primitives: structured app/lib/logger.ts, a fixed-window limiter in app/lib/rate-limit.ts, generation guard app/lib/generation-rate-limit.ts, and defensive middleware/error-logging in middleware.ts and Supabase helpers in utils/supabase/*.
• Reworks generation and persistence flows to be validated and non-destructive: app/lib/workout-generator.ts and app/protected/profile/meal-plan/action.ts now parse/validate model JSON, support deterministic E2E fixtures, and use upsert semantics; client helpers in app/lib/client-database.ts were updated to use local date keys.
• Adds user flows and UX improvements: password recovery and reset pages/actions, auth/confirm improvements, profile form and meal/workout UI changes, NavBar image loading, and global layout fixes.
• Adds infra and quality automation: scripts/check-env.mjs, playwright.config.ts, Playwright tests under e2e/, unit tests under tests/, package.json scripts for test, check, and test:e2e, CI workflow .github/workflows/quality.yml, vercel.json security headers, and Supabase migration and preflight SQL under supabase/ with docs/release.md.
• Misc: .env.example, .gitignore updates, tsconfig.test.json, ESLint ignores, and package lock updates to include Playwright.

Testing

• Ran the local quality gate including npm run env:check, lint and type checking via npm run check, and unit tests via npm test, which completed successfully in the validation run.
• Added comprehensive unit tests under tests/ that exercise date handling, schema/validation, generation parsing, rate-limiter behavior, Supabase migration contract, and observability helpers and these test suites passed in the CI-quality workflow.
• Configured Playwright E2E runs via npm run test:e2e and the CI workflow (.github/workflows/quality.yml) to run public journeys plus optional authenticated and mocked-AI flows, and the CI job was validated to execute npm run build and npm run test:e2e with failure artifact upload enabled.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fitness-app	Ready	Preview, Comment	Jun 24, 2026 3:37am

[chatgpt-codex-connector]

💡 Codex Review

fitness-app/.github/workflows/quality.yml

Lines 13 to 14 in 98798a6

	NEXT_PUBLIC_SUPABASE_URL: https://example.supabase.co
	NEXT_PUBLIC_SUPABASE_ANON_KEY: test-anon-key

Use real Supabase config for authenticated CI E2E

When E2E_AUTH_EMAIL and E2E_AUTH_PASSWORD secrets are configured, playwright.config.ts adds the authenticated and mocked-generation projects, and e2e/auth.setup.ts tries to log that user in. In this workflow those tests still run against https://example.supabase.co with test-anon-key, so CI will fail as soon as the optional E2E secrets are added rather than exercising the intended test Supabase project; wire these values from matching Supabase secrets or avoid setting the E2E credentials in this job.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".