fix(db): wrap withOrgContext in $transaction so session var survives …

[webdevcom01-cell]

…pool (Phase 0a)

Previously withOrgContext called client.$executeRawUnsafe to SET app.current_org_id, then ran fn(client) as a separate call. With Prisma connection pooling and Railway's 2 replicas, these two operations can land on different connections — the session variable evaporates between the set_config and the user's queries, and any RLS policy that reads app.current_org_id sees NULL.

Today this bug is masked because the application connects as a superuser (RLS bypassed at role level). Once Phase 0b introduces the non-bypass app_user role, every tenant-scoped query under this helper would silently return [].

The fix wraps the helper in client.$transaction(...), which pins a single connection for the duration of the callback. set_config is invoked on the tx client (not the outer pooled client) using $executeRaw with a tagged template (safer than the previous $executeRawUnsafe). Isolation, maxWait, and timeout are set per the rollout plan.

The callback signature changes from
fn: (client: PrismaClient) => Promise
to
fn: (tx: Prisma.TransactionClient) => Promise
because callers MUST use the tx for their queries — using the outer client would bypass the org context. withOrgContext is not yet called from any production route, so this signature change does not break any consumer in this repo.

Tests:

• 5 existing unit tests rewritten against the new $transaction-based shape. They verify: options bag is correct (ReadCommitted, maxWait=5000, timeout=30000), set_config runs on the tx (not the outer client), the callback receives the tx instance, the callback's return value is propagated, errors propagate.
• 1 new regression-guard test ensures the callback receives the tx, not the outer client — guards against accidentally reverting to the pool-leak shape.
• 1 it.skip() integration placeholder with TODO for Phase 1+ real-Postgres harness. The mocked unit tests verify SHAPE of the fix but cannot verify the underlying pool-survival semantics — that requires a real connection pool.
• 3 registerRLSMiddleware tests left untouched (legacy $use path, now marked @deprecated in JSDoc).

Refs:

• skill-rls-rollout-PLAN-V2.md §4.1 (Phase 0a, CRITICAL chore(deps): bump actions/setup-node from 4.4.0 to 6.3.0 #1)
• skill-rls-rollout-FORENSIC-REPORT.md §1 bullet 1, §3 chore(deps): bump actions/setup-node from 4.4.0 to 6.3.0 #1, HAL-1

Verification:

• vitest src/lib/db/tests/rls-middleware.test.ts: 8 passed, 1 skipped
• tsc --noEmit: exit 0

Description

Briefly describe the changes in this PR and the motivation behind them.

Type of change

• New feature
• Bug fix
• Documentation update
• Refactor (no behavior change)
• Test update
• Chore (build, CI, dependencies)

Checklist

• I have read the Contributing Guide
• My code follows the project code standards (TypeScript strict, no any, Tailwind only)
• I have added tests that cover my changes
• All tests pass (pnpm test)
• Linting passes (pnpm lint)
• Type checking passes (pnpm typecheck)
• I have updated documentation if needed
• No console.log statements left in code
• No hardcoded secrets or internal URLs

[webdevcom01-cell]

Self-review

Solo repo — no second reviewer available. Documenting due diligence
before admin merge.

Diff verification

• Re-read src/lib/db/rls-middleware.ts diff end-to-end
• Callback signature change from PrismaClient to
  Prisma.TransactionClient matches PLAN-V2 §4.1
• $executeRaw tagged-template (not $executeRawUnsafe)
• Transaction options: ReadCommitted, maxWait: 5000,
  timeout: 30000

Caller verification

• grep -rn "withOrgContext(" src --include="*.ts" returns only
  the definition, the JSDoc reference in src/lib/prisma.ts, and the
  test file. Zero production callers — signature change cannot break
  any consumer.

Test verification

• Baseline (pre-patch) local: 8 passed
• Post-patch local: 8 passed | 1 skipped (intentional integration
  TODO for Phase 1+)
• Local tsc --noEmit: exit 0

CI verification

• CI / Build: green (4m)
• CI / Lint: green (35s)
• CI / Typecheck: green (48s)
• CI / Unit Tests: green (1m)
• CodeQL: no new alerts in code changed by this PR
• CI / E2E: intentionally skipped — withOrgContext has no
  production callers, no surface to exercise. Phase 0b+ PRs that
  wire the helper into routes will carry the e2e label.
• [n/a] Docker Build & Push: cancelled by 30-min CI timeout during
  post-build Collecting build traces step. Not a Required check
  on this repo, not specific to this PR (Next.js compile alone
  takes 15.3 min on main today). Tracked separately for CI infra
  workstream.

Scope verification

• 2 files changed (production helper + its unit test)
• No schema migrations
• No env var changes
• No dependency changes

Proceeding with admin merge (bypass rules) under solo-repo policy.