From 3454c71218e6cbbcd6458393fc6839a677bdea03 Mon Sep 17 00:00:00 2001
From: Francisco de Guzman <17106076+franciszver@users.noreply.github.com>
Date: Fri, 24 Jul 2026 04:43:30 -0700
Subject: [PATCH 1/2] test(server): seed must execute when run directly on
 Windows (red)

Co-Authored-By: Claude Code (Haiku) <noreply@anthropic.com>
---
 server/prisma/seed.test.js | 42 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 server/prisma/seed.test.js

diff --git a/server/prisma/seed.test.js b/server/prisma/seed.test.js
new file mode 100644
index 0000000..1db208d
--- /dev/null
+++ b/server/prisma/seed.test.js
@@ -0,0 +1,42 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const seedFilePath = path.join(__dirname, 'seed.js');
+
+describe('seed.js guard clause', () => {
+  it('should use pathToFileURL for cross-platform direct execution guard', () => {
+    const source = readFileSync(seedFilePath, 'utf-8');
+
+    // Must contain the correct pattern (with null check for process.argv[1])
+    expect(source).toContain('process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href');
+
+    // Must NOT contain the broken Windows pattern (concatenation with backticks)
+    expect(source).not.toContain('file://${process.argv[1]}');
+    expect(source).not.toContain("`file://${process.argv[1]}`");
+  });
+
+  it('should exit with error when run directly with invalid DATABASE_URL', () => {
+    const seedScriptPath = path.join(__dirname, 'seed.js');
+    const env = { ...process.env, DATABASE_URL: 'postgresql://invalid:invalid@localhost:1/na' };
+
+    let error;
+    let exitCode;
+
+    try {
+      execFileSync('node', [seedScriptPath], { env, timeout: 5000, stdio: 'pipe' });
+      exitCode = 0;
+    } catch (e) {
+      error = e;
+      exitCode = e.status;
+    }
+
+    // With the broken guard, this exits 0 silently (seed never runs)
+    // With the correct guard, seed runs and tries to connect, exiting non-zero with error
+    expect(exitCode).not.toBe(0);
+    expect(error).toBeDefined();
+  });
+});

From e8e1ded31d49793a20ccca767015e7f1d4d9c06e Mon Sep 17 00:00:00 2001
From: Francisco de Guzman <17106076+franciszver@users.noreply.github.com>
Date: Fri, 24 Jul 2026 04:43:33 -0700
Subject: [PATCH 2/2] fix(server): cross-platform direct-execution guard in
 seed script

Co-Authored-By: Claude Code (Haiku) <noreply@anthropic.com>
---
 server/prisma/seed.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/prisma/seed.js b/server/prisma/seed.js
index c5bc828..5d0aadb 100644
--- a/server/prisma/seed.js
+++ b/server/prisma/seed.js
@@ -6,6 +6,7 @@
 // No live DB is available in this environment — this script is written and
 // reviewed but intentionally NOT run here.
 
+import { pathToFileURL } from 'node:url';
 import { PrismaClient } from '@prisma/client';
 import bcrypt from 'bcryptjs';
 
@@ -400,7 +401,7 @@ export async function seed(prisma) {
 
 // Only run when executed directly (`node prisma/seed.js` / `prisma db seed`),
 // never as a side effect of importing this module.
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   const prisma = new PrismaClient();
   seed(prisma)
     .then(() => prisma.$disconnect())