[JOY (JOY)]

Refs #1606

DOS/DOS.Me is the only deployable ledger for the rate schema. scripts/check-migration-drift.mjs listed four older differences, none from M2. This PR mirrors them from DOS.Me dev, byte for byte, and applies nothing.

What

• Two reference copies that differed, now replaced by DOS.Me's version, which is the one on Production:
  • 20261013192302_jreviews_rating_and_review_flags.sql: DOS.Me has no explanatory comments, and creates the two review_flags policies only when missing, where the copy here dropped one.
  • 20261014011054_review_votes.sql: DOS.Me has no explanatory comments.
• Two migrations that were only in DOS.Me:
  • 20261025090000_rate_product_images_bucket.sql (the product image mirror bucket, fix(web): TGDD listing thumbnails are blocked by the CDN's hotlink protection #887). It needs the Supabase storage schema, which the throwaway database does not have. scripts/lib/rate-db.mjs gets a NOT_REPLAYED list, as DOS.Me's own replay has, naming the test that covers it instead (scripts/ci/rate-product-images-bucket.integration.test.mjs in DOS.Me). The replay, the type generator and the E2E stack skip it.
  • 20261106150000_rate_listing_price_context_peer_max_history_first.sql (the Rate-Services price context).
• packages/shared-data/src/database.types.ts, regenerated with pnpm gen:db-types. It adds history_first_at and peer_reference_max, the two outputs of the price context function.

Checks (local)

• scripts/test-migration-replay.mjs: 36 migrations applied twice on PostgreSQL 17, passed.
• All eight proposal replays pass against the mirrored stack: criteria ratings, Item migration, M0 seed re-key, M3/M4 Item RPCs, review AI points, review submission v2, review value, and search rating score.
• The drift check, run against DOS.Me dev, now lists only the four M2 migrations, which chore(db): mirror the m2 extension observation migrations from dos-me #1611 mirrors.

Notes

• This PR and chore(db): mirror the m2 extension observation migrations from dos-me #1611 both touch database.types.ts in different places. Whichever merges second needs a regeneration (pnpm gen:db-types), which is deterministic.
• Nothing here changes a runtime path: the web code does not call the two price context outputs yet.

Codex not run.

🤖 Generated with Claude Code

---

📌 TL;DR

This PR enhances the price anomaly detection system by adding peer_reference_max and history_first_at metrics to the listing_price_context function, allowing auditors to better distinguish legitimate MSRP strikes from inflated fake sales. It also introduces a new Supabase storage bucket for product image mirroring and refactors existing migrations to be idempotent for safe replay.

🎯 Type of Change

• 🚀 New feature
• 🧹 Refactor
• 🐛 Bugfix
• ⚡ Performance
• 📚 Documentation
• ⚙️ CI / Configuration

🔍 Changes Walkthrough

File	Summary of Changes
packages/shared-data/src/database.types.ts	Updated TypeScript types to include the new history_first_at and peer_reference_max fields in the database schema.
scripts/lib/rate-db.mjs	Added a NOT_REPLAYED map to exclude specific migrations (like the storage bucket one) from the throwaway test database replay, as they require specific Supabase storage schemas.
supabase/migrations/20261013192302_jreviews_rating_and_review_flags.sql	Refactored RLS policy creation to be idempotent (using IF NOT EXISTS checks) and removed verbose comments to ensure safe re-execution.
supabase/migrations/20261014011054_review_votes.sql	Refactored trigger and RLS policy creation to be idempotent, preventing errors if the migration is run multiple times.
supabase/migrations/20261025090000_rate_product_images_bucket.sql	New Migration: Creates a public rate-product-images storage bucket with strict RLS policies to prevent non-service roles from accessing or modifying the bucket, supporting image mirroring for hotlink protection.
supabase/migrations/20261106150000_rate_listing_price_context_peer_max_history_first.sql	New Migration: Drops and recreates the rate.listing_price_context function to include peer_reference_max (highest peer price) and history_first_at (oldest price point timestamp), enabling more accurate fake sale detection.

📊 Architectural Flow

flowchart TD
    subgraph "Rate-Services / Auditors"
        A[Price Anomaly Auditor] -->|Queries| B[rate.listing_price_context]
    end

    subgraph "Supabase Database"
        B -->|Reads| C[rate.products]
        B -->|Reads| D[rate.merchants]
        B -->|Reads| E[rate.price_history]
        
        C -->|Joins| F[Cluster Peers]
        E -->|Aggregates| G[History Metrics]
        
        F -->|Calculates| H[peer_reference_max]
        G -->|Calculates| I[history_first_at]
        
        H --> B
        I --> B
    end

    subgraph "Storage"
        J[rate-product-images Bucket] -->|Serves| K[rate.vn Frontend]
        L[Service Role] -->|Writes| J
    end

Loading

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
rate	Ready	Preview	Nov 5, 2026 4:25pm UTC

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 514d78c7-323a-458a-bc0a-704bc90501df

Commits

Reviewing files that changed from the base of the PR and between d2445e2 and 32225f2.

Files selected for processing: 6

• packages/shared-data/src/database.types.ts
• scripts/lib/rate-db.mjs
• supabase/migrations/20261013192302_jreviews_rating_and_review_flags.sql
• supabase/migrations/20261014011054_review_votes.sql
• supabase/migrations/20261025090000_rate_product_images_bucket.sql
• supabase/migrations/20261106150000_rate_listing_price_context_peer_max_history_first.sql

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[dos]

⏱️ Code Review completed (6 eligible files · 24,003 chars · 2 model call(s) · 1 PR unit(s))

Whole diff with bounded context at base d2445e2 / head 32225f2.

✅ No verified defects

1 possible issue(s) could not be grounded in or verified against the snapshot source, so they are not published.