thrilltrack-explorer/docs/versioning/BEST_PRACTICES.md

Best Practices

When to Create Versions

✅ DO: Let triggers handle versioning automatically
❌ DON'T: Manually call versioning functions
❌ DON'T: Bypass triggers with direct SQL

Performance

• Run cleanup_old_versions() monthly
• Keep 50-100 versions per entity
• Use indexes for queries
• Implement pagination for large version lists

Security

• Never expose created_by user IDs to public
• Always check RLS policies
• Validate rollback permissions server-side
• Use session variables for attribution

Testing

Test version creation on:

• INSERT (creates version_number: 1)
• UPDATE (increments version_number)
• Rollback (creates new version with change_type='restored')

Attribution

Always set app.current_user_id to original submitter, NOT moderator.

// ✅ CORRECT
await supabase.rpc('set_session_variable', {
  key: 'app.current_user_id',
  value: submission.user_id,  // Original submitter
});

// ❌ WRONG
await supabase.rpc('set_session_variable', {
  key: 'app.current_user_id',
  value: auth.uid(),  // Moderator who approved
});