Skip to content

Connection and migration recovery

14 September 2026. Sprint 2 deadline confirmed by the project owner: 15 September 2026.

Verified public endpoints

Request Observed response before redeployment
https://toodle-neon.vercel.app/api/v1/auth/me HTTP 200, text/html, React index page; incorrect API routing
https://toodle-api-e61a.onrender.com/health HTTP 200, JSON health response
https://toodle-api-e61a.onrender.com/api/v1/auth/me with frontend Origin, no token HTTP 401, JSON authentication error; allowed origin is https://toodle-neon.vercel.app

The frontend's catch-all Vercel rewrite sent API requests to index.html. Toodle/vercel.json now places an external /api/v1/:path* rewrite to the Render API before the SPA fallback. API caching is disabled. This uses Vercel's documented external rewrite mechanism. The fix is local and must be included in the frontend deployment.

Production settings

Keep the existing Auth0 client ID in the Vercel project. It is configured locally; its presence in the hosted project's settings was not verified.

VITE_API_URL=https://toodle-neon.vercel.app/api/v1
VITE_AUTH0_DOMAIN=toodle-dev.uk.auth0.com
VITE_AUTH0_AUDIENCE=https://api.toodle.com

With the new rewrite deployed, this API URL is valid. For a direct-backend setup, VITE_API_URL=https://toodle-api-e61a.onrender.com/api/v1 is an alternative; the tested backend CORS configuration already permits the production frontend.

The frontend derives its callback from window.location.origin + '/callback'. It does not read VITE_AUTH0_CALLBACK_URL. Register https://toodle-neon.vercel.app/callback as an Auth0 allowed callback, and the frontend origin as an allowed logout/web origin. Preserve the existing client ID; never put an Auth0 client secret or database credentials in VITE variables.

Migration recovered

The owner confirmed creating the migration and then deleting local work during cleanup after teammate changes. The original SQL was recovered from the saved 13 September project session. Its SHA-256 checksum with original LF line endings matches the database's recorded checksum exactly.

Restored: toodle-api/prisma/migrations/20260913190000_course_applications/migration.sql. The incompatible, unapplied replacement 20260914140000_course_applications was moved into prisma/recovery/superseded-20260914140000_course_applications for reference. It is no longer in Prisma's executable migration history. .gitattributes preserves the restored SQL's LF line endings.

Prisma now includes the original reviewer's ON DELETE SET NULL relation and omits an index that the original migration never created. Existing mappings for reviewReason and ApplicationStatus are preserved. No live data, migrations or database history records were written, reset or altered during recovery.

Read-only verification:

# Run in toodle-api
node prisma/check-connection.js
npx.cmd prisma migrate status
npx.cmd prisma migrate diff --from-schema-datasource prisma/schema.prisma --to-schema-datamodel prisma/schema.prisma --script

Observed: checksum matches; application/course reads pass; all seven migrations are applied; Prisma reports the database up to date; schema diff is empty. The previous migration-history blocker is resolved for this checked database.

Deploy and verify

The owner believes both deployments track main. The API GitHub workflow has a main-only deployment trigger, but this does not establish which repository the hosted Render/Vercel projects currently track. Verify their project settings.

  1. Confirm which repositories/branches each hosted project deploys. Neither a linked Vercel CLI project nor a callable Vercel/Render deployment tool was available in this workspace at verification time.
  2. Include the recovered migration, Prisma schema and current API workflow code in the backend release. Generate the client and run the normal checks. For the checked database, there are no new migrations to apply; other environments must run migration status first.
  3. Include Toodle/vercel.json and current frontend workflow code in the frontend release. Preserve the Auth0 settings above and rebuild/redeploy.
  4. Recheck the Vercel /api/v1/auth/me URL without a token: it must return JSON 401, not HTML 200. Verify /callback and page deep links still load the SPA.
  5. Sign in with each test role and follow the course workflow acceptance script. Check authenticated GET and mutation requests, role refresh after approval, and application data after reload. No live authenticated acceptance pass is claimed by the health/CORS/schema checks above.