groceries: fix search 500 (pg_trgm word_similarity lives in public, app search_path is $user); guard test for unqualified trgm calls

src/lib/server/groceries/trgm-guard.test.ts

@@ -0,0 +1,27 @@
+// The app role's search_path is "$user" only, while pg_trgm lives in schema public, so an
+// unqualified similarity()/word_similarity() call fails in prod with "function ... does not
+// exist" (it broke grocery search on 2026-10-24). Every pg_trgm function must be public.-qualified.
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+// Bare similarity( is also a JS name, so only flag it when it takes a SQL parameter.
+const TRGM =
+	/(?<![\w.])(?:strict_word_similarity|word_similarity|show_trgm|show_limit)\s*\(|(?<![\w.])similarity\s*\(\$\{/g;
+
+function files(dir: string): string[] {
+	return readdirSync(dir).flatMap((f) => {
+		const p = join(dir, f);
+		if (statSync(p).isDirectory()) return files(p);
+		return /\.(ts|js|svelte)$/.test(f) && !/\.test\.ts$/.test(f) ? [p] : [];
+	});
+}
+
+describe('pg_trgm calls', () => {
+	it('are schema-qualified with public.', () => {
+		const bad = files('src').flatMap((p) =>
+			[...readFileSync(p, 'utf8').matchAll(TRGM)].map((m) => `${p}: ${m[0]}`)
+		);
+		expect(bad).toEqual([]);
+	});
+});