spb/autoscholar

1# UI notes — needs outside the UI scope (for the control-plane owner)23## BLOCKER — `packages/core/src/papers.ts` related-papers query45`getPaperBySlug` builds `sql\`${paperVersions.keywords} && ${row.v.keywords}\``. Drizzle expands the JS array as a tuple6(`&& ($4,$5,$6)`), so PostgreSQL rejects the query and **every paper page returns 500/404** (`/research/[slug]`and`/api/public/papers/[slug]`). Verified fix (one line, import `arrayOverlaps`from`drizzle-orm`):78```ts9or(eq(papers.discipline, row.p.discipline), arrayOverlaps(paperVersions.keywords, row.v.keywords));10```1112The e2e suite was run with this fix applied temporarily (25/25 pass); the original file was restored afterwards and13`packages/core` rebuilt from it, so the paper page is broken again until the fix lands.1415## Tooling1617- `biome.json`: add `"css": { "parser": { "tailwindDirectives": true } }` so `apps/web/src/app/globals.css` (`@import "tailwindcss"`, `@theme`, `@apply`, `@custom-variant`) parses; today `pnpm lint` reports parse errors there. Also `biome migrate` (schema 2.4.0 vs CLI 2.6.4; `recommended` deprecated).18- pnpm 11 "deps status check" aborted `pnpm start` / `pnpm exec playwright` after dependencies changed (`ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY` → it tried `pnpm install --production`). Workaround used: run binaries directly (`apps/web/node_modules/.bin/next`, `node_modules/.bin/playwright`). Consider `verify-deps-before-run=false` in `.npmrc` for non-interactive hosts (pm2).19- `next start` warns that `output: "standalone"` expects `node .next/standalone/server.js` (copy `.next/static` and `public` into the standalone dir on deploy). It still serves correctly; the pm2 manifest should pick one of the two.20- Rebuilding `.next` while a `next start` process is still serving leaves it with a stale client manifest ("Could not find the module …link.js in the React Client Manifest" → 500 on every page with `next/link`). Always stop the server before `next build` (or build to a fresh dir and swap).21- `packages/db/package.json`: added `pdf-lib` (used only by `src/seed.ts` to generate the staging PDF).2223## Server helpers / API observations (not changed)2425- `clientIp()` returns `null` when `TRUST_PROXY=0` and no proxy header is present (Next does not expose the socket address), so locally all visitors share the limiter keys `"unknown"`/`"public"`, and for `/api/internal/*` the CIDR allow-list is skipped (only the bearer token protects it). In production the worker reaches the control plane directly on the LAN (no proxy headers) → same situation. If a LAN-only guard is wanted, bind the internal API to a separate port/listener or set the socket address via a custom server.26- Internal worker routes answer **403** (`viaPublicProxy`) to Playwright's request context because it sends `x-forwarded-*`-free requests… actually they return 403 for any request whose headers include forwarded hints; the e2e asserts 401 _or_ 403 for those routes.27- The in-memory login limiter (10 logins / 15 min per username) is easy to hit while developing/testing; the e2e suite reuses one signed-in storage state to stay below it. A restart of the web process resets it.28- `listEvents()` returns `Date` objects; `redact()` turns a `Date` into `{}` (it walks it as a plain object). The run page converts dates before redacting; the `/api/admin/runs/[id]/events` route passes rows straight through `redact()` → `at` becomes `{}` in the JSON. Suggest `redact()` to pass `Date`/`Buffer` instances through unchanged, or serialise before redacting in that route.29- Public artifact route sets `accept-ranges: none`; the browser PDF viewer works but cannot seek by byte range on large PDFs.3031## Seed3233`pnpm db:seed` → `seedTopicsAndSeries()` always (17 disciplines + 10 subfields + series `as-wp`), `seedStagingPaper()` only with `STAGING_MODE=1` (one synthetic paper `AS-WP-2026-0000`, `papers.synthetic=true`, 6-page PDF written under `ARTIFACT_ROOT/public/AS-WP-2026-0000/v1/manuscript/main.pdf` with a `.sha256` sidecar). Production (`STAGING_MODE=0`) never lists, serves or indexes it. Remove it before launch with `delete from papers where public_id='AS-WP-2026-0000'` (cascades) + delete the public object.34