payday tests

frontend/src/lib/server/migrate.ts

@@ -526,7 +526,7 @@ export async function migrate(): Promise<void> {
 	await ensureBonusFields();
 	await ensureTemplateFields();
 	await ensureAssignedChoreFields();
-	await ensureAccessCodes();
+	await ensureFamReadRules();	await ensureAccessCodes();
 	await ensurePlatform();
 	// Superuser-only collections also land on EXISTING installs (ensureSchema's
 	// early return skips them). Like ensureOtp before it, ensurePins no-ops when
@@ -540,6 +540,23 @@ export async function migrate(): Promise<void> {
 	console.log('[migrate] Done');
 }
 
+// Children toggle chores with their own token, so fam-scoped collections need
+// fam read rules on EXISTING installs (fresh installs get them via
+// SCHEMA_PLAN). Without these, the chore lookup returns empty and the
+// completions create fails relation validation ("resource cannot be found").
+// Idempotent.
+async function ensureFamReadRules(): Promise<void> {
+	const readRule = 'famId = @request.auth.famId';
+	for (const name of ['assigned_chores', 'completions', 'rewards']) {
+		const col = await getCollection(name);
+		if (!col) continue;
+		if (col.listRule !== readRule || col.viewRule !== readRule) {
+			await updateCollection(col.id, { ...col, listRule: readRule, viewRule: readRule });
+			console.log(`[migrate] Fixed read rules on ${name}.`);
+		}
+	}
+}
+
 // Add colour / icon / description to `assigned_chores` on existing installs so
 // family-admins can override a template's look per assignment. Idempotent.
 async function ensureAssignedChoreFields(): Promise<void> {