Harden PathLab reset flow to prevent unintended destructive enrollment wipes

[Copilot]

A recent change introduced a test-only reset path that performs destructive deletes (path_activity_progress, path_assessment_submissions, path_reflections). This PR tightens that flow so reset cannot run broadly in production-like environments and cannot target another user’s enrollment.

• Reset safety gate (runtime-config)

  • Added isEnrollmentResetEnabled() in lib/runtime-config.ts.
  • Reset is enabled only when:
    • __DEV__ === true, or
    • EXPO_PUBLIC_ENABLE_ENROLLMENT_RESET=true.

• Ownership + auth enforcement before destructive operations

  • Updated resetEnrollment() in lib/pathlab.ts to fail fast unless:
    • reset is enabled,
    • a user is authenticated,
    • the enrollment belongs to that user (path_enrollments.user_id === auth.user.id).

• UI guard for test-only action

  • Updated app/seed/[id].tsx to disable “Restart (for test only)” when reset is not enabled by runtime policy.

• Focused config coverage

  • Extended tests/runtime-config.test.ts with cases validating reset gate defaults and explicit enablement.

// lib/pathlab.ts (core guard pattern)
if (!isEnrollmentResetEnabled()) {
  throw new Error("Enrollment reset is disabled in this environment.");
}

const { data: { user } } = await supabase.auth.getUser();
if (!user) throw new Error("You must be signed in to reset progress.");

const { data: enrollment } = await supabase
  .from("path_enrollments")
  .select("id, user_id")
  .eq("id", enrollmentId)
  .single();

if (!enrollment || enrollment.user_id !== user.id) {
  throw new Error("You can only reset your own enrollment.");
}

Provided screenshot artifact (suitable to attach in PR context):
https://github.com/user-attachments/assets/a1a855f0-b652-4679-aa77-bd070c57617b

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cdp.expo.dev
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/ps_app/ps_app/node_modules/.bin/expo start --web (dns block)
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/ps_app/ps_app/node_modules/.bin/expo start --web conf�� get 72a419d5 de/node/bin/bash credential.usernbash (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Reference: 092e895

Look into last night's commit, is there any intention or any code that might lead to database deletion because I see that I wake up and the databases is fully blank

[xb1g]

So the reset is not in the code, but from the dev fault