Fix RLS context initialization in seed and validation scripts

[gilgardosh]

Summary

Fixes a critical bug where seed and validation scripts fail on deployed (non-superuser) database connections due to uninitialized Row-Level Security context. The issue was invisible locally because dev/CI connect as the postgres superuser, which bypasses RLS regardless of FORCE ROW LEVEL SECURITY.

Key Changes

• New integration test (seed-admin-context-rls.integration.test.ts): Regression guard that runs seedAdminCore under a non-superuser role to catch RLS context issues before deployment
• seed-demo-data.ts: Pin app.current_business_id session variable to the admin business ID before any domain table writes; validate the context is set before destructive reset
• seed.ts: Derive the admin business ID deterministically and pin RLS context before inserting the admin entity (changed from relying on RETURNING id)
• validate-demo-data.ts: Pin RLS context before reading any domain tables
• fixture-loader.ts: Remove try-catch that was silently swallowing RLS context errors; let failures surface clearly
• demo-staging-guide.md: Document the RLS context requirement, how to reproduce locally as a non-superuser, and the new test coverage

Implementation Details

• All scripts now derive the admin business ID using makeUUID('business', 'Admin Business') — the same deterministic approach used by seedAdminCore and bootstrapNewClient
• Context is set at session level (is_local = false) since scripts run statements outside transactions
• The allow_bootstrap_root RLS policy permits inserting/updating the admin entity with id = get_current_business_id() even before it exists, enabling context to be pinned before the entity is created
• The new test covers both success (context pinned) and failure (context unset) cases, with the failure case reproducing the exact P0001: No business context set error that occurred in production

https://claude.ai/code/session_01Kuz9izFq9MQLVae4NvVLah

[github-actions]

The latest changes of this PR are not available as alpha, since there are no linked changesets for this PR.

[Copilot]

🟢 Approval recommended

The changes consistently pin the RLS tenant context before any tenant-scoped operations and add a targeted non-superuser regression test that should prevent the production failure from recurring.

Pull request overview

This PR fixes demo seed and validation scripts failing on deployed (non-superuser) Postgres connections by explicitly pinning the RLS tenant context (app.current_business_id) before any tenant-scoped reads/writes, and adds an integration regression test that exercises seedAdminCore under a non-superuser role so CI catches missing-context failures.

Changes:

• Pin app.current_business_id early in scripts/seed.ts, scripts/seed-demo-data.ts, and validate-demo-data.ts using the deterministic admin business UUID (makeUUID('business', 'Admin Business')).
• Make root admin business insertion deterministic in scripts/seed.ts (explicit id, no RETURNING) so context can be pinned before the row exists.
• Add seed-admin-context-rls.integration.test.ts to verify seedAdminCore succeeds with context pinned and fails with the expected P0001 when unset; also stop swallowing RLS-context failures in fixture-loader.ts.

File summaries

File	Description
scripts/seed.ts	Pins RLS context up-front and inserts the admin business with a deterministic UUID to avoid RETURNING reliance under RLS.
scripts/seed-demo-data.ts	Pins RLS context before TRUNCATE/seed steps and validates deterministic admin ID consistency with seedAdminCore.
packages/server/src/demo-fixtures/validate-demo-data.ts	Pins RLS context before any reads to prevent P0001 on non-superuser connections.
packages/server/src/tests/seed-admin-context-rls.integration.test.ts	Adds a non-superuser RLS regression test covering both the “pinned succeeds” and “unset fails with P0001” cases.
packages/server/src/tests/helpers/fixture-loader.ts	Removes best-effort try/catch so RLS context setup failures surface immediately.
packages/server/docs/demo-staging-guide.md	Documents the RLS context requirement and how to reproduce the deployed behavior locally.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The new integration test should close the shared test DB pool to avoid open-handle hangs, and the production seed path should be made rerunnable/idempotent now that it uses deterministic IDs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

packages/server/src/tests/seed-admin-context-rls.integration.test.ts:63

• This test creates the shared test pool via TestDatabase/connectTestDb but never closes it in afterAll; relying on “global vitest setup” is inconsistent with other suites and can leave open handles when running this file in isolation. Close the shared pool via db.close() (or closeTestDb()) after dropping the RLS role.

  afterAll(async () => {
    if (pool) await dropRlsRole(pool);
    // Pool is managed by the global vitest setup — do not close it here.
  });

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite