[JOY (JOY)]

Closes #1147

Task 1 (M0) of the item / variant / listing plan (#1129).

What

Mirrors into supabase/migrations the DOS/DOS.Me rate migrations that were missing from the reference copy. Each file is byte-identical to DOS-Me dev (same git blob SHA, same file name). Then it regenerates packages/shared-data/src/database.types.ts.

Files added (verbatim from DOS/DOS.Me@dev)

• supabase/migrations/20261018153000_rate_row_provenance.sql
• supabase/migrations/20261018160000_rate_audit_aggregate_rpcs.sql
• supabase/migrations/20261018183000_rate_worker_role.sql
• supabase/migrations/20261020230000_rate_listing_availability.sql
• supabase/migrations/20261022140000_rate_move_iphone_16e_offer.sql
• supabase/migrations/20261023090000_rate_review_vote_eligibility.sql
• supabase/migrations/20261024060000_rate_master_min_price_plausible.sql

Before copying, every file was scanned for secrets, passwords, keys, tokens and internal hostnames. None were found. The only URLs are public marketplace product links in fixture-URL backfill rules.

Skipped

• 20261025090000_rate_product_images_bucket.sql touches only the storage schema: a bucket plus restrictive policies on storage.objects and storage.buckets. It does not touch rate, and the hermetic stack has no storage schema.
  scripts/check-migration-drift.mjs will keep listing it as only in ledger. That line is informational, does not fail the check, and is expected.
• Every other DOS-Me migration newer than the copy is a dosai or other non-rate migration. I grepped all of them for rate.; the only matches were the English word "rate" in comments and a PL/pgSQL loop variable.

Other changes (no copied SQL is edited)

• scripts/lib/rate-db.mjs: the Supabase-shaped fixture gains two things the new migrations need. First, an authenticator role, which rate_worker_role grants rate_worker to. Second, the auth.users columns is_anonymous, phone_confirmed_at and created_at, which rate_review_vote_eligibility reads.
• scripts/e2e/run.mjs: since the fixture now creates authenticator, the E2E stack runs ALTER ROLE ... LOGIN PASSWORD on it instead of CREATE ROLE.
• packages/shared-data/src/database.types.ts: regenerated by pnpm gen:db-types. The change is additive only: origin and crawl lineage columns, products.availability and availability_checked_at, master_products.spec_provenance, and the RPCs current_user_can_vote_reviews, listing_price_context, mark_listing_unavailable, merchant_review_counts and stamp_crawl_provenance. There are no new required insert fields.

Known remaining drift (out of scope, flagged)

node scripts/check-migration-drift.mjs still reports two older files that exist in both repos but differ:

• 20261013192302_jreviews_rating_and_review_flags.sql
• 20261014011054_review_votes.sql

They differ in more than comments. The DOS-Me ledger uses IF NOT EXISTS blocks for its policies and triggers, while this copy uses DROP ... IF EXISTS + CREATE. This copy also has REVOKE ALL ON rate.review_votes FROM anon and REVOKE EXECUTE on rate.refresh_master_product_rating and rate.refresh_review_vote_counts, which the ledger file lacks. The task only covers newer or missing files, so this PR leaves them untouched. Someone needs to check whether prod has those REVOKEs, perhaps through a later migration.

Verification

• CI workflow_dispatch on a throwaway branch with these commits, before this PR: the migration replay passed (two passes), and E2E (Playwright) passed on the new schema (run 40552176040). This machine has no Docker, so the types file is the CI pnpm gen:db-types output, unchanged. The throwaway branch is deleted.
• This PR's own CI is green on its head: replay, pnpm check:db-types on the committed file, and E2E (Playwright).

PR #1164 availability fallback

After this merges, the reference schema, the generated types and the E2E stack all have rate.products.availability. Prod already has it, from DOS-Me 20261020230000. anon has table-level SELECT on rate.products, so #1164's separate, error-tolerant getListingAvailabilityForMaster query can be folded into the main offer select. This PR does not drop the fallback.

No DDL against any live database. Nothing was written to DOS/DOS.Me.

🤖 Generated with Claude Code

---

📌 TL;DR

This PR implements a comprehensive data provenance and security hardening layer for the Rate database, introducing origin tracking to distinguish crawled data from synthetic/seed data, and establishing a least-privilege rate_worker role to isolate the crawler from the shared service_role.

🎯 Type of Change

• 🚀 New feature
• 🐛 Bugfix
• ⚙️ CI / Configuration

🔍 Changes Walkthrough

File	Summary of Changes
packages/shared-data/src/database.types.ts	Updated TypeScript interfaces to reflect new database columns (origin, last_crawled_at, spec_provenance, etc.) and new RPCs (listing_price_context, merchant_review_counts, stamp_crawl_provenance).
scripts/e2e/run.mjs	Fixed E2E database setup to ALTER ROLE authenticator instead of CREATE ROLE, aligning with the new Supabase-shaped fixture where authenticator is pre-created by startRateDb.
scripts/lib/rate-db.mjs	Updated the local database fixture to create the authenticator role (NOINHERIT) and expanded the auth.users table schema to include phone_confirmed_at, is_anonymous, and created_at for accurate JWT claim simulation.
supabase/migrations/20261018153000_rate_row_provenance.sql	Core Migration: Added origin columns to products, reviews, and price_history. Implemented triggers to auto-label synthetic/fixture data. Created stamp_crawl_provenance RPC for lineage tracking. Updated RLS policies and aggregate functions to exclude non-crawled data from public views and ratings.
supabase/migrations/20261018160000_rate_audit_aggregate_rpcs.sql	Added listing_price_context and merchant_review_counts RPCs to perform complex price and review aggregations in SQL, preventing the Node.js auditor from pulling capped/incomplete data pages.
supabase/migrations/20261018183000_rate_worker_role.sql	Created a least-privilege rate_worker role. Granted specific table/RPC permissions required for the crawl cycle (ingest, queue, audit) while explicitly denying access to PII, destructive operations, and community review modifications.

📊 Architectural Flow

flowchart TD
    subgraph Crawler [Rate-Services Crawler]
        A[Chromium Worker] -->|1. Ingest Data| B[rate_worker Role]
    end

    subgraph Database [PostgreSQL / Supabase]
        B -->|2. Write| C[(rate.products / reviews / price_history)]
        C -->|3. Trigger| D[Origin Labeling]
        D -->|4. Stamp| E[stamp_crawl_provenance RPC]
        
        subgraph Public [Public Read Layer]
            F[RLS Policies] -->|5. Filter origin='crawl'| G[Public API / Views]
            H[Aggregate RPCs] -->|6. Compute Stats| I[Master Products]
        end
        
        subgraph Auditor [Rate-Services Auditor]
            J[Node.js Auditor] -->|7. Call SQL Aggregates| H
        end
    end

    subgraph Security [Security Boundary]
        K[service_role] -.->|Blocked| B
        L[rate_worker] -.->|Least Privilege| C
    end

Loading

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
rate	Ready	Preview	Oct 27, 2026 5:42pm UTC

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 90cfbb54-243c-4cf5-b91d-9f4275921591

Commits

Reviewing files that changed from the base of the PR and between 645c155 and 3ff9177.

Files selected for processing: 10

• packages/shared-data/src/database.types.ts
• scripts/e2e/run.mjs
• scripts/lib/rate-db.mjs
• supabase/migrations/20261018153000_rate_row_provenance.sql
• supabase/migrations/20261018160000_rate_audit_aggregate_rpcs.sql
• supabase/migrations/20261018183000_rate_worker_role.sql
• supabase/migrations/20261020230000_rate_listing_availability.sql
• supabase/migrations/20261022140000_rate_move_iphone_16e_offer.sql
• supabase/migrations/20261023090000_rate_review_vote_eligibility.sql
• supabase/migrations/20261024060000_rate_master_min_price_plausible.sql

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dos]

⏱️ Code Review completed (10 eligible files · 88,507 chars · 4 model call(s) · 3 PR unit(s))

Whole diff with bounded context at base 645c155 / head 3ff9177.

✅ No verified defects

1 possible issue(s) could not be grounded in or verified against the snapshot source, so they are not published.

Context investigation was bounded to the explicitly requested snapshot paths.