fix: close review gaps in admin deployment

Author: Programcode

AGENTS.md

@@ -59,7 +59,7 @@ The suite rejects the production project, checks that the anon key belongs to th
 
 GitHub runs staging only for `main` push or a main-branch manual dispatch, through the protected `staging` environment, after the credential-free build job passes. Set the repository variable `STAGING_E2E_ENABLED=true` only after the protected environment has the three secrets, current staging functions, schema, provider secret, dedicated unlimited-use test code, and a main-only deployment rule. A skipped staging job is not a pass.
 
-The staging origin `http://127.0.0.1:18080` must be deployed in the CORS allowlists for `demo-code-login`, `ai`, `ai-stream`, and `announcements` before enabling the gate. Do not deploy those functions or apply migrations to an unverified project.
+The staging origin `http://127.0.0.1:18080` must be deployed in the CORS allowlists for `demo-code-login`, `ai`, `ai-stream`, `admin`, and `announcements` before enabling the gate. Do not deploy those functions or apply migrations to an unverified project.
 
 ## Working rules
 

plans/release-checklist.md

@@ -22,13 +22,18 @@ Run every step before merging this branch. Nothing here deploys anything; deploy
 
 ## 2. Migration review (before any deploy)
 
-Two prepared migrations ship on this branch; neither is applied by the branch:
+The two Quality & Truth migrations below are recorded in section 0 as applied:
 
 - `20260822000000_ai_request_cost_audit.sql` — audit columns on `ai_requests`
 - `20260822000001_source_provenance_metadata.sql` — `metadata` jsonb on `sources`
 
-- [ ] Confirm both files reviewed against current schema, migration order, and RLS (`ai_requests` stays service-role-write-only; `sources` keeps per-user policies)
-- [ ] Apply order: migrations first, then edge functions (`ai`, `ai-stream`, `admin`), then frontend
+The audit follow-up adds one migration that must run before the updated `admin`
+function or frontend is deployed:
+
+- `20260831191838_deactivate_announcements.sql` — adds `deactivated_at` and excludes deactivated announcements from authenticated reads without deleting dismissal history
+
+- [ ] Confirm all changed migration files are reviewed against current schema, migration order, and RLS (`ai_requests` stays service-role-write-only; `sources` keeps per-user policies; announcement deactivation preserves dismissal rows)
+- [ ] Apply order: pending migrations first, then edge functions (`ai`, `ai-stream`, `admin`, `announcements` as changed), then frontend
   - both edge functions fall back to a base insert if audit columns are missing, so a deploy-order mistake degrades logging instead of breaking requests
   - the frontend sends `metadata` on source saves; deploying it before the `sources` migration will fail those writes
 

supabase/functions/_shared/native-cors.test.ts

@@ -20,10 +20,12 @@ for (const functionName of browserCalledFunctions) {
   });
 }
 
-Deno.test("announcements allows the isolated staging browser origin", async () => {
-  const source = await Deno.readTextFile(new URL("../announcements/index.ts", import.meta.url));
-  assertStringIncludes(source, '"http://127.0.0.1:18080"');
-});
+for (const functionName of ["admin", "announcements"]) {
+  Deno.test(`${functionName} allows the isolated staging browser origin`, async () => {
+    const source = await Deno.readTextFile(new URL(`../${functionName}/index.ts`, import.meta.url));
+    assertStringIncludes(source, '"http://127.0.0.1:18080"');
+  });
+}
 
 Deno.test("native share links use the public HTTPS origin", async () => {
   const source = await Deno.readTextFile(new URL("../share/index.ts", import.meta.url));

supabase/functions/admin/index.ts

@@ -12,6 +12,7 @@ const ALLOWED_ORIGINS = [
     "https://debate.pi-stack.org",
     "http://localhost:8080",
     "http://127.0.0.1:8080",
+    "http://127.0.0.1:18080",
     "http://localhost:5173",
     "http://127.0.0.1:54321",
     "capacitor://localhost"
@@ -30,6 +31,9 @@ const supabaseUrl = Deno.env.get("SUPABASE_URL")!;
 const supabaseServiceKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
 const supabase = createClient(supabaseUrl, supabaseServiceKey);
 
+const ADMIN_ANNOUNCEMENT_COLUMNS =
+    "id,title,body,target_type,target_user_ids,starts_at,expires_at,deactivated_at,created_by,created_at";
+
 type UsageByUserRow = {
     user_id: string;
     email?: string | null;
@@ -158,7 +162,7 @@ Deno.serve(async (req) => {
         if (action === "announcements" && req.method === "GET") {
             const { data, error } = await supabase
                 .from("admin_announcements")
-                .select("id,title,body,target_type,target_user_ids,starts_at,expires_at,deactivated_at,created_by,created_at")
+                .select(ADMIN_ANNOUNCEMENT_COLUMNS)
                 .order("created_at", { ascending: false });
 
             if (error) {
@@ -203,7 +207,7 @@ Deno.serve(async (req) => {
                     expires_at: value.expiresAt,
                     created_by: user.id,
                 })
-                .select("id,title,body,target_type,target_user_ids,starts_at,expires_at,deactivated_at,created_by,created_at")
+                .select(ADMIN_ANNOUNCEMENT_COLUMNS)
                 .single();
 
             if (error) {
@@ -242,7 +246,7 @@ Deno.serve(async (req) => {
                 .update({ deactivated_at: new Date().toISOString() })
                 .eq("id", announcementId.value)
                 .is("deactivated_at", null)
-                .select("id,title,body,target_type,target_user_ids,starts_at,expires_at,deactivated_at,created_by,created_at")
+                .select(ADMIN_ANNOUNCEMENT_COLUMNS)
                 .maybeSingle();
 
             if (error) {