Testing Migrations

shell.nix

@@ -11,6 +11,17 @@ pkgs.mkShell {
     pm2
     mariadb
     openssl
+
+    # Schema migrations and DB scaffolding only -- the running server never
+    # imports Prisma. The nixpkgs wrapper is self-configuring: it exports
+    # PRISMA_SCHEMA_ENGINE_BINARY pointing at a nix-built prisma-engines and
+    # execs the bundled CLI, so there is no engine download and none of the
+    # usual NixOS prebuilt-binary trouble.
+    #
+    # Pinned to prisma_7 deliberately, NOT the `prisma` alias: Prisma 8 has no
+    # MariaDB support yet, so if nixpkgs moves that alias to v8 this project's
+    # database would stop being supported underneath us.
+    prisma_7
   ];
 
   shellHook = ''
@@ -79,8 +90,21 @@ pkgs.mkShell {
       done
       echo "MySQL ready."
 
+      #
+      # Collation is explicit because the server default here is
+      # utf8mb4_unicode_ci while every application table is
+      # utf8mb4_general_ci. Without this, a table created later without an
+      # explicit COLLATE would silently inherit the wrong one, changing string
+      # comparison and FULLTEXT ranking. Prisma does not model collation and
+      # `prisma migrate diff` does not report the difference.
+      #
+      # Existing databases need a one-time, non-destructive fix:
+      #   ALTER DATABASE application
+      #     CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
+      #
       mysql -u root --socket="$MYSQL_SOCKET" \
-        -e "CREATE DATABASE IF NOT EXISTS application;" 2>/dev/null
+        -e "CREATE DATABASE IF NOT EXISTS application \
+              CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;" 2>/dev/null
     fi
 
     #
@@ -98,6 +122,24 @@ pkgs.mkShell {
       export DB_USER=root
       export DB_PASS=
 
+      #
+      # Prisma CLI connection string, for migrations and scaffolding.
+      #
+      # The warning above about shadowing ~/.env does NOT apply here:
+      # DATABASE_URL is read only by the Prisma CLI, never by
+      # server/config/database.js, so it cannot affect the running server.
+      #
+      # Deliberately NOT derived from DB_USER/DB_PASS. Prisma needs DDL
+      # rights, and in production those variables hold the least-privilege
+      # `app` account. Admin credentials are composed by migrateDatabase.sh
+      # instead, which is why this export lives only in the dev branch.
+      #
+      export DATABASE_URL="mysql://root@127.0.0.1:3306/application"
+
+      # Stop the Prisma CLI phoning checkpoint.prisma.io for update checks.
+      # Keeps the schema tests network-free and the output uncluttered.
+      export CHECKPOINT_DISABLE=1
+
       # Stable dev JWT key, persisted across shell sessions
       if [ -z "''${JSON_KEY:-}" ]; then
         if [ -s "$PWD/.mysql/jwt_key" ]; then