fix(scripts): convert reset-db.js to ESM + require ADMIN_INITIAL_PASSWORD #25

Merged

varutasu merged 1 commit from convoy/fix-reset-db-script into main

2026-05-26 23:08:46 -04:00

varutasu commented

2026-05-26 23:07:12 -04:00

(Migrated from github.com)

Summary

Folds two queued follow-ups from the pick-a-name architect audit (convert-reset-db-to-esm + purge-weak-creds-from-helpers) into a single P2 hygiene convoy. Three bugs in scripts/reset-db.js, all fixed atomically by mirroring the proven post-drop-public-setup shape of setup-neon-db.js (commit b63b509).

Bugs fixed

CJS-in-ESM (lines 10, 12, 142): require('dotenv'), require('@neondatabase/serverless'), inline require('bcryptjs'). package.json has "type": "module" since bump-next-js, so npm run reset-db threw ReferenceError on Node 22.x. Same bug pattern that hit setup-neon-db.js pre-drop-public-setup B2.
Hardcoded weak admin password (line 143: bcrypt.hash('admin123', 12)). Same anti-pattern drop-public-setup B1 removed from setup-neon-db.js.
Password echoed to stdout (line 156: console.log('Admin Password: admin123')). Security anti-pattern; post-DPS setup-neon-db.js does NOT echo passwords.

Fix shape (verbatim mirror of `setup-neon-db.js`)

ESM top-level imports (dotenv, neon, bcrypt)
Fail-loud ADMIN_INITIAL_PASSWORD env-var check at function top with helpful error message pointing to README "First-time admin setup"
bcrypt.hash(adminPassword, 12) instead of literal
ON CONFLICT (email) DO NOTHING on INSERT (defensive against double-run, matches setup-neon-db.js line 149)
No password echo in success block; admin email logged for confirmation
Updated docstring to flag DESTRUCTIVE + reference required env

Verification

node --check scripts/reset-db.js: exit 0
npm run lint: 128 problems (baseline preserved, no regression)
npm run test:run: 21/21 pass
Grep: 0 require( | 0 admin123 | 0 'Admin Password' in scripts/reset-db.js
Grep: 3 ADMIN_INITIAL_PASSWORD references (docstring, const, error msg)

NOT live-tested — script is destructive (drops all tables). Operator can optionally run npm run reset-db against a non-prod Neon branch post-merge to verify end-to-end.

Test plan

CI green (lint + vitest + smoke + visual-skip)
Optional: operator runs npm run reset-db against a throwaway Neon branch with ADMIN_INITIAL_PASSWORD set
Optional: confirm without the env var, the script exits 1 with the helpful error message before touching the DB

Follow-ups surfaced

lint-against-cjs-in-esm-scripts (P3 polish — add ESLint rule to prevent any future require() in scripts/** under "type": "module"). Surfaced for future convoy queue.

Convoy: .convoys/fix-reset-db-script.md

Made with Cursor

## Summary Folds two queued follow-ups from the `pick-a-name` architect audit (`convert-reset-db-to-esm` + `purge-weak-creds-from-helpers`) into a single P2 hygiene convoy. Three bugs in `scripts/reset-db.js`, all fixed atomically by mirroring the proven post-`drop-public-setup` shape of `setup-neon-db.js` (commit `b63b509`). ## Bugs fixed 1. **CJS-in-ESM** (lines 10, 12, 142): `require('dotenv')`, `require('@neondatabase/serverless')`, inline `require('bcryptjs')`. `package.json` has `"type": "module"` since `bump-next-js`, so `npm run reset-db` threw `ReferenceError` on Node 22.x. Same bug pattern that hit `setup-neon-db.js` pre-`drop-public-setup` B2. 2. **Hardcoded weak admin password** (line 143: `bcrypt.hash('admin123', 12)`). Same anti-pattern `drop-public-setup` B1 removed from `setup-neon-db.js`. 3. **Password echoed to stdout** (line 156: `console.log('Admin Password: admin123')`). Security anti-pattern; post-DPS `setup-neon-db.js` does NOT echo passwords. ## Fix shape (verbatim mirror of `setup-neon-db.js`) - ESM top-level imports (`dotenv`, `neon`, `bcrypt`) - Fail-loud `ADMIN_INITIAL_PASSWORD` env-var check at function top with helpful error message pointing to README "First-time admin setup" - `bcrypt.hash(adminPassword, 12)` instead of literal - `ON CONFLICT (email) DO NOTHING` on INSERT (defensive against double-run, matches `setup-neon-db.js` line 149) - No password echo in success block; admin email logged for confirmation - Updated docstring to flag DESTRUCTIVE + reference required env ## Verification - `node --check scripts/reset-db.js`: exit 0 - `npm run lint`: 128 problems (baseline preserved, no regression) - `npm run test:run`: 21/21 pass - Grep: 0 `require(` | 0 `admin123` | 0 `'Admin Password'` in `scripts/reset-db.js` - Grep: 3 `ADMIN_INITIAL_PASSWORD` references (docstring, const, error msg) NOT live-tested — script is destructive (drops all tables). Operator can optionally run `npm run reset-db` against a non-prod Neon branch post-merge to verify end-to-end. ## Test plan - [ ] CI green (lint + vitest + smoke + visual-skip) - [ ] Optional: operator runs `npm run reset-db` against a throwaway Neon branch with `ADMIN_INITIAL_PASSWORD` set - [ ] Optional: confirm without the env var, the script exits 1 with the helpful error message before touching the DB ## Follow-ups surfaced - `lint-against-cjs-in-esm-scripts` (P3 polish — add ESLint rule to prevent any future `require()` in `scripts/**` under `"type": "module"`). Surfaced for future convoy queue. Convoy: `.convoys/fix-reset-db-script.md` Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-05-26 23:07:21 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	May 27, 2026 3:07am

[vc]: #HYtT0zL+GMWv0luuQeqSLv0ZrJQbYW/Mv9Gjt9SUUHg=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWNvbnZveS1maXgtcmVzLTYzZmJmZS1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCJ9LCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20vcmFuZGFsbC1zdGlsbHdlbGxzLXByb2plY3RzL3RjZy12YXVsdC8zdnp6TGpiY1FVamhNY3BQeVFHTm9FcXZIZ0dzIiwicHJldmlld1VybCI6InRjZy12YXVsdC1naXQtY29udm95LWZpeC1yZXMtNjNmYmZlLXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIn1dLCJyZXF1ZXN0UmV2aWV3VXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3ZlcmNlbC1hZ2VudC9yZXF1ZXN0LXJldmlldz9vd25lcj12YXJ1dGFzdSZyZXBvPXRjZy12YXVsdCZwcj0yNSJ9 The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/3vzzLjbcQUjhMcpPyQGNoEqvHgGs) | [Preview](https://tcg-vault-git-convoy-fix-res-63fbfe-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-convoy-fix-res-63fbfe-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | May 27, 2026 3:07am | <a href="https://vercel.com/vercel-agent/request-review?owner=varutasu&repo=tcg-vault&pr=25" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-05-26 23:07:24 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	✅ pass
Visual diff	⏭ skipped or pending

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ✅ pass | | Visual diff | ⏭ skipped or pending | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.