Skip to content

docs(start): add tested PostgreSQL and Prisma recipe - #8374

Open
tannerlinsley wants to merge 4 commits into
mainfrom
taren/start-postgres-recipe
Open

docs(start): add tested PostgreSQL and Prisma recipe#8374
tannerlinsley wants to merge 4 commits into
mainfrom
taren/start-postgres-recipe

Conversation

@tannerlinsley

@tannerlinsley tannerlinsley commented Sep 11, 2026

Copy link
Copy Markdown
Member

🎯 Changes

Replace the database guide's abstract query snippet with a complete PostgreSQL + Prisma path while retaining the provider overview. Add a runnable local example with schema migrations, server-only database access, loader reads, validated server functions, transaction rollback, and deployment notes.

The example creates a category and note in one transaction. A duplicate note slug rolls back the new category and shows a useful error. This is a shared local demo with no accounts, and its documentation states that scope.

Validation: initialized an isolated native PostgreSQL 17.11 database and applied the committed migration. The example build and TypeScript check passed. Two browser tests passed in development and production, covering persisted SSR data, reloads, server validation, and rollback. Production response assertions and a client asset scan found no test database credentials. Reviewed the guide and production app in Chrome. Required ESLint (39 projects), type (42 projects), and unit (35 projects) checks passed. Existing dependency resolutions are preserved; only the new example's dependency graph was added.

The Docker Compose convenience path was not run because this machine lacks the Compose plugin. The documented native PostgreSQL path was used for database validation. No hosted-provider verification is claimed.

✅ Checklist

  • I have followed the steps in the Contributing guide.
  • I have tested code changes locally with the relevant test commands, or tests do not apply to this pull request.
  • I fully understand the code in this pull request.

🚀 Release Impact

  • This change affects published code, and I have generated a changeset.
  • This change is docs/CI/dev-only (no release).

Summary by CodeRabbit

  • New Features

    • Added a runnable TanStack Start React example demonstrating PostgreSQL integration with Prisma.
    • Added a notes interface for viewing and creating categorized notes.
    • Added local PostgreSQL setup with Docker Compose, migrations, validation, transactions, and CSRF protection.
    • Added end-to-end tests covering persistence, validation, duplicate handling, security, and rollback behavior.
    • Added an isolated PostgreSQL test runner with automatic setup and cleanup.
  • Documentation

    • Updated the database guide with PostgreSQL/Prisma setup, server access, authorization, testing, and deployment guidance.

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 09e530e8-bc35-435a-828f-c218191f3e58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f64c17d1-0d86-4d22-a9b3-1925311dbd30

📥 Commits

Reviewing files that changed from the base of the PR and between c8ab1f7 and 8455aba.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (6)
  • docs/start/framework/react/guide/databases.md
  • examples/react/start-postgres/README.md
  • examples/react/start-postgres/package.json
  • examples/react/start-postgres/prisma.config.ts
  • examples/react/start-postgres/tests/run.mjs
  • pnpm-workspace.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/start/framework/react/guide/databases.md

Included review availability: Your plan provides up to 10 included reviews per hour; 3 remain after this review.


📝 Walkthrough

Walkthrough

The PR adds a runnable TanStack Start PostgreSQL and Prisma example. It includes schema migrations, server-only database access, validated transactional mutations, CSRF handling, a notes UI, end-to-end tests, and setup and deployment documentation.

Changes

PostgreSQL notes example

Layer / File(s) Summary
Database and project foundation
examples/react/start-postgres/.env.example, examples/react/start-postgres/.gitignore, examples/react/start-postgres/compose.yaml, examples/react/start-postgres/prisma/*, examples/react/start-postgres/package.json, examples/react/start-postgres/tsconfig.json, examples/react/start-postgres/vite.config.ts
The example adds PostgreSQL configuration, Prisma models and migrations, local database storage, build scripts, generated-file exclusions, and project tooling.
Server database functions
examples/react/start-postgres/src/server/*, examples/react/start-postgres/src/start.ts
Server-only Prisma access, validated note reads and writes, transactional category creation, duplicate-key handling, and server-function CSRF protection are added.
Router and notes interface
examples/react/start-postgres/src/routeTree.gen.ts, examples/react/start-postgres/src/router.tsx, examples/react/start-postgres/src/routes/*
The example adds the route tree, document shell, notes loader, note form, submission handling, and note list rendering.
Example validation and usage guidance
examples/react/start-postgres/playwright.config.ts, examples/react/start-postgres/tests/*, examples/react/start-postgres/tests/run.mjs, examples/react/start-postgres/README.md, docs/start/framework/react/guide/databases.md, pnpm-workspace.yaml
Playwright covers persistence, CSRF rejection, secret isolation, validation, and transaction rollback. The test runner provisions and removes an isolated PostgreSQL server. The example and guide document setup, testing, and deployment.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant NotesRoute
  participant createNote
  participant Prisma
  participant PostgreSQL
  Browser->>NotesRoute: Submit note form
  NotesRoute->>createNote: Send slug, title, and category
  createNote->>Prisma: Validate input and start transaction
  Prisma->>PostgreSQL: Upsert category and create note
  PostgreSQL-->>Prisma: Commit or constraint error
  Prisma-->>createNote: Transaction result
  createNote-->>NotesRoute: Success or error
  NotesRoute-->>Browser: Refresh notes or display error
Loading

Merge Risk: ⚪ Minimal · up to 8455a

No concrete merge-blocking risk remains in the reviewed changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 12 files. (4 skipped: 4… Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: adding a tested PostgreSQL and Prisma recipe to the Start documentation.
Description check ✅ Passed The description follows the required template, explains the changes and validation, completes the checklist, and identifies the change as docs/dev-only. It also documents the untested Docker Compose a…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 12 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches 💡 2
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
⚔️ Resolve merge conflicts 💡
  • Resolve merge conflict in branch taren/start-postgres-recipe
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch taren/start-postgres-recipe

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Sep 11, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedembedded-postgres@​17.10.0-beta.178010010096100
Added@​prisma/​adapter-pg@​7.0.01001008398100

View full report

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Changeset Version Preview

3 package(s) bumped directly, 21 bumped as dependents.

🟩 Patch bumps

Package Version Reason
@tanstack/history 1.162.3 → 1.162.4 Changeset
@tanstack/router-core 1.171.29 → 1.171.30 Changeset
@tanstack/start-server-core 1.169.34 → 1.169.35 Changeset
@tanstack/react-router 1.170.35 → 1.170.36 Dependent
@tanstack/react-start 1.168.52 → 1.168.53 Dependent
@tanstack/react-start-client 1.168.33 → 1.168.34 Dependent
@tanstack/react-start-rsc 0.1.51 → 0.1.52 Dependent
@tanstack/react-start-server 1.167.40 → 1.167.41 Dependent
@tanstack/router-cli 1.167.35 → 1.167.36 Dependent
@tanstack/router-generator 1.167.35 → 1.167.36 Dependent
@tanstack/router-plugin 1.168.37 → 1.168.38 Dependent
@tanstack/router-vite-plugin 1.167.37 → 1.167.38 Dependent
@tanstack/solid-router 1.170.33 → 1.170.34 Dependent
@tanstack/solid-start 1.168.50 → 1.168.51 Dependent
@tanstack/solid-start-client 1.168.32 → 1.168.33 Dependent
@tanstack/solid-start-server 1.167.39 → 1.167.40 Dependent
@tanstack/start-client-core 1.170.29 → 1.170.30 Dependent
@tanstack/start-plugin-core 1.171.42 → 1.171.43 Dependent
@tanstack/start-static-server-functions 1.167.34 → 1.167.35 Dependent
@tanstack/start-storage-context 1.167.31 → 1.167.32 Dependent
@tanstack/vue-router 1.170.32 → 1.170.33 Dependent
@tanstack/vue-start 1.168.49 → 1.168.50 Dependent
@tanstack/vue-start-client 1.167.35 → 1.167.36 Dependent
@tanstack/vue-start-server 1.167.39 → 1.167.40 Dependent

@nx-cloud

nx-cloud Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

View your CI Pipeline Execution ↗ for commit 3194fec

Command Status Duration Result
nx affected --targets=test:eslint,test:unit,tes... ✅ Succeeded 8m 50s View ↗
nx run-many --target=build --exclude=examples/*... ✅ Succeeded 2m 22s View ↗

☁️ Nx Cloud last updated this comment at 2026-09-11 23:54:41 UTC

@pkg-pr-new

pkg-pr-new Bot commented Sep 11, 2026

Copy link
Copy Markdown
More templates

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@8374

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8374

@tanstack/eslint-plugin-start

npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8374

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@8374

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8374

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@8374

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@8374

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8374

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@8374

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@8374

@tanstack/react-start-rsc

npm i https://pkg.pr.new/@tanstack/react-start-rsc@8374

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@8374

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@8374

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@8374

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@8374

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@8374

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@8374

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@8374

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8374

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@8374

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8374

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@8374

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8374

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8374

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@8374

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@8374

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@8374

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@8374

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8374

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@8374

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@8374

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8374

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@8374

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@8374

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8374

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@8374

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8374

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8374

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@8374

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@8374

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@8374

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@8374

commit: 3194fec

@github-actions github-actions Bot added the documentation Everything documentation related label Sep 11, 2026

@nx-cloud nx-cloud Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important

At least one additional CI pipeline execution has run since the conclusion below was written and it may no longer be applicable.

Nx Cloud has identified a possible root cause for your failed CI:

We classified both tanstack-start-example-postgres:build and tanstack-start-example-postgres:test:e2e as environment failures rather than code issues. The build fails immediately because prisma generate requires DATABASE_URL, which is not set in our CI environment, and the e2e web server times out for the same reason. Our CI would need a PostgreSQL service and the DATABASE_URL secret provisioned before these tasks can pass.

No code changes were suggested for this issue.

Trigger a rerun:

Rerun CI

Nx Cloud View detailed reasoning on Nx Cloud ↗


🎓 Learn more about Self-Healing CI on nx.dev

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Medium
Low adoption: npm @embedded-postgres/darwin-arm64

Location: Package overview

From: pnpm-lock.yamlnpm/embedded-postgres@17.10.0-beta.17npm/@embedded-postgres/darwin-arm64@17.10.0-beta.17

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@embedded-postgres/darwin-arm64@17.10.0-beta.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @embedded-postgres/linux-arm

Location: Package overview

From: pnpm-lock.yamlnpm/embedded-postgres@17.10.0-beta.17npm/@embedded-postgres/linux-arm@17.10.0-beta.17

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@embedded-postgres/linux-arm@17.10.0-beta.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @embedded-postgres/linux-arm64

Location: Package overview

From: pnpm-lock.yamlnpm/embedded-postgres@17.10.0-beta.17npm/@embedded-postgres/linux-arm64@17.10.0-beta.17

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@embedded-postgres/linux-arm64@17.10.0-beta.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @embedded-postgres/linux-ia32

Location: Package overview

From: pnpm-lock.yamlnpm/embedded-postgres@17.10.0-beta.17npm/@embedded-postgres/linux-ia32@17.10.0-beta.17

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@embedded-postgres/linux-ia32@17.10.0-beta.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @embedded-postgres/linux-ppc64

Location: Package overview

From: pnpm-lock.yamlnpm/embedded-postgres@17.10.0-beta.17npm/@embedded-postgres/linux-ppc64@17.10.0-beta.17

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@embedded-postgres/linux-ppc64@17.10.0-beta.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @embedded-postgres/windows-x64

Location: Package overview

From: pnpm-lock.yamlnpm/embedded-postgres@17.10.0-beta.17npm/@embedded-postgres/windows-x64@17.10.0-beta.17

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@embedded-postgres/windows-x64@17.10.0-beta.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Everything documentation related

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant