Add the missing rem_lines foreign key, index every FK, gate migrations on pgTAP.

rem_lines.user_id was the only non-PK uuid column missing a foreign key that
should have had one. It holds a company_members user id on a financial ledger,
so a deleted auth user left dangling rows forever. Orphans are cleaned before
the constraint is added, which is safe because rem_lines is fully derived:
compute_rem_month deletes and rebuilds every line of a month.

Many other uuid columns look unconstrained in the Supabase dashboard. They are
not. 31 of the foreign keys target auth.users(id) and the schema visualizer only
draws public to public edges. The migration header records this so the next
person does not redo the investigation. The two remaining FK-less uuid columns
are deliberate: companies.product_pool_project_id (circular dependency, trigger
enforced) and audit_log.entity_id (polymorphic).

Postgres does not index the referencing side of a foreign key. Deleting one
auth.users row sequential-scanned 13 tables and deleting one companies row
scanned 8 more, including a nested cascade into jungle_tjm_queue_settlements.
This adds 25 indexes, partial on "col is not null" for the nullable actor
columns so they stay small. EXPLAIN under force_generic_plan confirms the
planner uses those for the referential-integrity probe. One case was an outright
regression: 20260806000000 replaced the unique constraint backing
revenue_entries.revenue_source_id with a partial index, which cannot serve an
integrity check.

CI now replays every migration into an empty database and runs the pgTAP suite,
on pull requests as well as pushes, with the deploy job gated behind it. db push
only applies what production is missing, so it never validated the schema as a
whole, and no test had ever run in CI.

That first run surfaced two stale assertions in 010-company_invites_accept. They
used a "second user" that had already become a member earlier in the file, so it
hit the already-a-member branch added in 20260812000000 instead of the
invite-used guard. The happy-path redemptions now use their own throwaway users,
and two added tests pin that a used admin invite cannot escalate an existing
member.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Herklos

.github/workflows/supabase.yml

@@ -31,9 +31,38 @@ on:
         default: false
 
 jobs:
+  # Gate: replay every migration into an empty database and run the pgTAP suite.
+  # `db push` only applies what production is missing, so it never re-checks the
+  # schema as a whole — a migration that is invalid from scratch (a foreign key
+  # referencing a table created later, a constraint no existing row satisfies)
+  # would otherwise be discovered in production. Runs on pull requests too, where
+  # the deploy job is skipped, so a branch gets validated before it lands.
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: supabase/setup-cli@v1
+        with:
+          version: latest
+
+      # Boots the full local stack (the auth container creates the auth schema
+      # that migrations and tests reference). Runners already have Docker.
+      - name: Start local stack
+        run: supabase --workdir backend start
+
+      - name: Replay migrations from scratch
+        run: supabase --workdir backend db reset
+
+      # Same command as `pnpm test` in backend/supabase/package.json.
+      - name: pgTAP
+        run: supabase --workdir backend test db
+
   deploy:
     # Run only on push / manual dispatch; on PRs the workflow reports a check but skips the deploy.
     if: github.event_name != 'pull_request'
+    needs: test
     runs-on: ubuntu-latest
     environment:
       name: Production - Supabase

backend/supabase/migrations/20260814000000_fk_integrity_and_indexes.sql

@@ -0,0 +1,151 @@
+-- ============================================================================
+-- Foreign-key integrity gap + index coverage behind every foreign key
+--
+-- READ THIS BEFORE "FIXING" MISSING FOREIGN KEYS FROM THE DASHBOARD:
+-- the Supabase schema visualizer only draws public → public relationships.
+-- 31 of this schema's foreign keys target auth.users(id), so every user_id /
+-- created_by / approved_by / actor_id column *looks* unconstrained there while
+-- the constraint is in fact present. Check pg_constraint, not the diagram.
+--
+-- After this migration exactly two non-PK uuid columns have no FK, both on
+-- purpose:
+--   companies.product_pool_project_id — would re-create the circular
+--     companies ↔ projects dependency rejected in 20260803000000; enforced by
+--     the enforce_product_pool_project trigger instead.
+--   audit_log.entity_id — polymorphic, discriminated by entity_type.
+--
+-- Postgres does not index the referencing side of a foreign key. Without one,
+-- every parent delete sequential-scans the child: deleting one auth.users row
+-- scanned 13 tables and deleting one companies row scanned 8 more, including a
+-- nested cascade into jungle_tjm_queue_settlements. This adds the missing
+-- indexes.
+--
+-- Plain `create index` (not `concurrently`): db push runs each migration in a
+-- transaction, where concurrently is illegal. It takes a write lock for the
+-- duration, which is fine at current table sizes.
+-- ============================================================================
+
+-- ----------------------------------------------------------------------------
+-- 1) rem_lines.user_id — the one real gap
+--
+-- Declared bare in 20260803000000 (`user_id uuid,  -- null for company_fee
+-- bucket`) while its sibling project_id got a FK. It holds a company_members
+-- user id, i.e. an auth.users id, on a financial ledger.
+--
+-- Orphans are cleaned first so the constraint cannot block the push. This is
+-- safe: rem_lines is fully derived — compute_rem_month opens by deleting every
+-- line of the month and rebuilding it. A line whose user no longer exists in
+-- auth.users has already lost its company_members row (that FK cascades), so it
+-- can never be recomputed and carries nothing worth keeping. Same precedent as
+-- the zero-cent cleanup in 20260806000000.
+-- ----------------------------------------------------------------------------
+delete from public.rem_lines l
+where l.user_id is not null
+  and not exists (select 1 from auth.users u where u.id = l.user_id);
+
+alter table public.rem_lines
+  drop constraint if exists rem_lines_user_id_fkey;
+
+alter table public.rem_lines
+  add constraint rem_lines_user_id_fkey
+  foreign key (user_id) references auth.users (id) on delete cascade;
+
+-- auth.users, not profiles(user_id): that matches every other person column
+-- that is not PostgREST-embedded (time_entries.user_id, notifications.user_id,
+-- time_off.user_id, project_costs.user_id). The four profiles mirrors added in
+-- 20260719000000 exist only to make `profiles(...)` embeds resolve; adding more
+-- of those to a table with several actor columns causes PGRST201 ambiguity.
+--
+-- The column stays nullable — null means the company_fee bucket, which has no
+-- person attached. A nullable FK ignores null rows.
+
+-- ----------------------------------------------------------------------------
+-- 2) Index coverage: NOT NULL foreign-key columns
+--
+-- revenue_entries.revenue_source_id is a regression, not an oversight:
+-- 20260806000000 dropped `unique (revenue_source_id, period_month)` and
+-- replaced it with a partial unique index (where auto_generated and not
+-- deleted). A partial index cannot serve a referential-integrity check, so the
+-- column silently lost its coverage. The partial unique index stays — it still
+-- enforces one auto row per source-month.
+-- ----------------------------------------------------------------------------
+create index if not exists revenue_entries_company_idx
+  on public.revenue_entries (company_id);
+create index if not exists revenue_entries_source_idx
+  on public.revenue_entries (revenue_source_id);
+
+create index if not exists revenue_sources_company_idx
+  on public.revenue_sources (company_id);
+
+create index if not exists referral_earnings_company_idx
+  on public.referral_earnings (company_id);
+
+create index if not exists project_referrals_company_idx
+  on public.project_referrals (company_id);
+
+create index if not exists notifications_company_idx
+  on public.notifications (company_id);
+
+create index if not exists time_off_company_idx
+  on public.time_off (company_id);
+
+-- The jungle queue's two existing indexes are both partial (where deleted =
+-- false) and neither leads with user_id, so all three of its FK columns are
+-- uncovered.
+create index if not exists jungle_queue_company_idx
+  on public.jungle_tjm_queue_entries (company_id);
+create index if not exists jungle_queue_project_idx
+  on public.jungle_tjm_queue_entries (project_id);
+create index if not exists jungle_queue_user_idx
+  on public.jungle_tjm_queue_entries (user_id);
+
+create index if not exists jungle_queue_settlements_company_idx
+  on public.jungle_tjm_queue_settlements (company_id);
+create index if not exists jungle_queue_settlements_entry_idx
+  on public.jungle_tjm_queue_settlements (queue_entry_id);
+
+-- ----------------------------------------------------------------------------
+-- 3) Index coverage: nullable actor columns
+--
+-- Partial `where <col> is not null` keeps these small — most rows are null.
+-- The RI probe is `col = $1`, which implies `col is not null`, so the planner
+-- can still use them.
+-- ----------------------------------------------------------------------------
+create index if not exists projects_created_by_idx
+  on public.projects (created_by) where created_by is not null;
+
+create index if not exists time_entries_approved_by_idx
+  on public.time_entries (approved_by) where approved_by is not null;
+
+create index if not exists revenue_sources_created_by_idx
+  on public.revenue_sources (created_by) where created_by is not null;
+
+create index if not exists company_invites_invited_by_idx
+  on public.company_invites (invited_by) where invited_by is not null;
+create index if not exists company_invites_accepted_by_idx
+  on public.company_invites (accepted_by) where accepted_by is not null;
+
+create index if not exists invoice_payments_recorded_by_idx
+  on public.invoice_payments (recorded_by) where recorded_by is not null;
+
+create index if not exists audit_log_actor_idx
+  on public.audit_log (actor_id) where actor_id is not null;
+
+-- project_costs.company_id is already covered by project_costs_company_status_idx
+-- (company_id leading). These four are not.
+create index if not exists project_costs_user_idx
+  on public.project_costs (user_id) where user_id is not null;
+create index if not exists project_costs_approved_by_idx
+  on public.project_costs (approved_by) where approved_by is not null;
+create index if not exists project_costs_reimbursed_by_idx
+  on public.project_costs (reimbursed_by) where reimbursed_by is not null;
+create index if not exists project_costs_created_by_idx
+  on public.project_costs (created_by) where created_by is not null;
+
+-- rem_lines_user_idx is (company_id, user_id), so user_id is not leading and
+-- cannot serve the FK added above. rem_lines_month_idx does not cover
+-- project_id either.
+create index if not exists rem_lines_user_fk_idx
+  on public.rem_lines (user_id) where user_id is not null;
+create index if not exists rem_lines_project_idx
+  on public.rem_lines (project_id) where project_id is not null;

backend/supabase/tests/database/010-company_invites_accept.test.sql

@@ -1,5 +1,5 @@
 begin;
-select plan(22);
+select plan(24);
 
 -- Happy path + lifecycle for accept_company_invite
 select tests.create_auth_user('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1', 'admin1@test.local');
@@ -8,6 +8,13 @@ select tests.create_auth_user('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa3', 'invitee-m
 select tests.create_auth_user('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa4', 'invitee-free@test.local');
 select tests.create_auth_user('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa5', 'other-co-admin@test.local');
 select tests.create_auth_user('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa6', 'second-redeemer@test.local');
+-- aaa6 must never join the company: it is the "outsider" probe for the
+-- used-invite guards. Redeeming an invite as aaa6 would make it a member, and
+-- accept_company_invite treats an active member re-redeeming a used invite as
+-- success (20260812000000), so the guard would stop being exercised. The
+-- happy-path redemptions below therefore get their own throwaway users.
+select tests.create_auth_user('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa7', 'pad-redeemer@test.local');
+select tests.create_auth_user('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa8', 'boundary-redeemer@test.local');
 
 select tests.clear_auth();
 
@@ -131,12 +138,14 @@ select throws_ok(
 );
 
 -- 9 padded token is accepted after server trim
+select tests.authenticate_as('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa7');
 select lives_ok(
   format($f$select public.accept_company_invite('  %s  ')$f$, (select tok_pad from inv_ctx)),
   'padded token accepted via server trim'
 );
 
--- 10–15 lifecycle guards
+-- 10–15 lifecycle guards, run as the outsider so `invite-used` is reachable
+select tests.authenticate_as('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa6');
 select throws_ok(
   format($f$select public.accept_company_invite('%s')$f$, (select tok_revoked from inv_ctx)),
   'P0001',
@@ -163,6 +172,7 @@ select throws_ok(
 );
 
 -- 13 boundary: expires_at = now() is still valid (< now() required to expire)
+select tests.authenticate_as('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa8');
 select lives_ok(
   format($f$select public.accept_company_invite('%s')$f$, (select tok_boundary from inv_ctx)),
   'expires_at = now() still redeemable'
@@ -200,5 +210,22 @@ select is(
   'same acceptor redeem is idempotent'
 );
 
+-- 20–21 a different active member may re-redeem a used invite (the branch added
+-- in 20260812000000), but it must not inherit that invite's role. aaa7 joined as
+-- a freelancer via tok_pad; tok_admin is a used ADMIN invite.
+select tests.authenticate_as('aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa7');
+select is(
+  public.accept_company_invite((select tok_admin from inv_ctx)),
+  (select company_id from inv_ctx),
+  'active member re-redeeming a used invite succeeds'
+);
+select is(
+  (select role::text from public.company_members
+   where company_id = (select company_id from inv_ctx)
+     and user_id = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa7'),
+  'freelancer',
+  'a used admin invite cannot escalate an existing member'
+);
+
 select * from finish();
 rollback;