From 79fe9c406d2a402fc87f83c91045b211dfed6a94 Mon Sep 17 00:00:00 2001
From: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
 <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>
Date: Sun, 28 Jun 2026 14:00:59 -0400
Subject: [PATCH] fix(dev): seed local community hosts

Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>
Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>
---
 Justfile                        |  3 +-
 scripts/dev-setup.sh            |  1 +
 scripts/seed-local-community.sh | 91 +++++++++++++++++++++++++++++++++
 3 files changed, 94 insertions(+), 1 deletion(-)
 create mode 100755 scripts/seed-local-community.sh

diff --git a/Justfile b/Justfile
index 6427c9660c..7b814e5140 100644
--- a/Justfile
+++ b/Justfile
@@ -169,9 +169,10 @@ _ensure-services:
     echo " timed out"
     exit 1
 
-# Apply database migrations if the dev database is running
+# Apply database migrations and seed the local dev community if the dev database is running
 _ensure-migrations: _ensure-services
     cargo run -p buzz-admin -- migrate
+    ./scripts/seed-local-community.sh
 
 # Run clippy on the desktop Tauri Rust crate
 desktop-tauri-clippy: _ensure-sidecar-stubs
diff --git a/scripts/dev-setup.sh b/scripts/dev-setup.sh
index 0815d48b48..09f22703d0 100755
--- a/scripts/dev-setup.sh
+++ b/scripts/dev-setup.sh
@@ -129,6 +129,7 @@ until postgres_accepting_connections; do
 done
 
 "${REPO_ROOT}/bin/cargo" run -p buzz-admin -- migrate
+"${REPO_ROOT}/scripts/seed-local-community.sh"
 success "Database migrations complete"
 
 # ---- Install desktop dependencies -------------------------------------------
diff --git a/scripts/seed-local-community.sh b/scripts/seed-local-community.sh
new file mode 100755
index 0000000000..1eb9a220f6
--- /dev/null
+++ b/scripts/seed-local-community.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Seed local dev host -> community rows for row-zero host binding.
+#
+# The relay intentionally fails closed when the request Host header is not in
+# `communities`. Local dev uses loopback hosts, so bootstrap must create those
+# rows after migrations before desktop/Tauri HTTP bridge calls can succeed.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+cd "${REPO_ROOT}"
+
+if [[ -f ".env" ]]; then
+  set -o allexport
+  # shellcheck disable=SC1091
+  source .env
+  set +o allexport
+fi
+
+export PGHOST="${PGHOST:-localhost}"
+export PGPORT="${PGPORT:-5432}"
+export PGUSER="${PGUSER:-buzz}"
+export PGPASSWORD="${PGPASSWORD:-buzz_dev}"
+export PGDATABASE="${PGDATABASE:-buzz}"
+export RELAY_URL="${RELAY_URL:-ws://localhost:3000}"
+
+hosts_sql=$(python3 - <<'PY'
+import os
+from urllib.parse import urlparse
+
+relay_url = os.environ.get("RELAY_URL", "ws://localhost:3000")
+parsed = urlparse(relay_url)
+
+host = (parsed.hostname or "").rstrip(".").lower()
+port = parsed.port
+scheme = parsed.scheme.lower()
+
+def authority(host, port, scheme):
+    if not host:
+        return ""
+    display_host = f"[{host}]" if ":" in host and not host.startswith("[") else host
+    default_port = (scheme == "ws" and port == 80) or (scheme == "wss" and port == 443)
+    if port and not default_port:
+        return f"{display_host}:{port}"
+    return display_host
+
+primary = authority(host, port, scheme)
+hosts = []
+if primary:
+    hosts.append(primary)
+
+# Local desktop/dev tooling has historically used both localhost and 127.0.0.1.
+# Under row-zero host binding those are distinct hosts, so seed both loopback
+# spellings for local dev to avoid a fail-closed 404 when one side uses the
+# alternate authority. Non-loopback deployments seed only RELAY_URL's authority.
+if host in {"localhost", "127.0.0.1"} and port:
+    hosts.extend([f"localhost:{port}", f"127.0.0.1:{port}"])
+
+seen = []
+for h in hosts:
+    if h and h not in seen:
+        seen.append(h)
+
+if not seen:
+    raise SystemExit("could not derive a host from RELAY_URL")
+
+print(",\n".join(f"    ('{h.replace("'", "''")}')" for h in seen))
+PY
+)
+
+sql="
+INSERT INTO communities (host)
+SELECT host
+FROM (VALUES
+${hosts_sql}
+) AS v(host)
+ON CONFLICT (lower(host)) DO NOTHING;
+"
+
+if command -v psql >/dev/null 2>&1; then
+  PGPASSWORD="${PGPASSWORD}" psql -h "${PGHOST}" -p "${PGPORT}" -U "${PGUSER}" -d "${PGDATABASE}" -v ON_ERROR_STOP=1 -c "${sql}"
+elif docker exec buzz-postgres psql --version >/dev/null 2>&1; then
+  docker exec -i -e PGPASSWORD="${PGPASSWORD}" buzz-postgres \
+    psql -U "${PGUSER}" -d "${PGDATABASE}" -v ON_ERROR_STOP=1 -c "${sql}"
+else
+  echo "error: neither psql nor buzz-postgres docker psql is available" >&2
+  exit 1
+fi
+
+echo "Seeded local dev community host(s):"
+echo "${hosts_sql}" | sed -E "s/^ +\('(.+)'\),?$/  - \1/"