t_d1600327 added a standalone scope=user-subset, but a full reset (scope=all)
and scope=exam-corpus still left the --user-subset cc.users storage objects
orphaned (files rows are wiped by the table clear, but the Storage API objects
are not). Call the same _clear_user_subset_files() helper in both paths so the
finding-#2 gap is fully closed: storage removed before rows, idempotent.
Closes overwatch review finding #2 (user-subset not cleaned by reset).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
/admin/reset and reset_environment.reset() act on os.environ['SUPABASE_URL'].
A platform-admin call on a prod-deployed API would wipe prod data + exam
corpus + storage. Refuse when the target matches a known prod marker
(.156 / supabase.classroomcopilot) unless RESET_ALLOW_PROD=1 is set.
Addresses overwatch review finding #1 on feature/exam-seeding-overhaul.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- reset_environment: profiles PATCH now sets only school_id=null (removing invalid
user_type='platform_admin' that violated profiles_user_type_check constraint)
- seed_environment: same profiles PATCH fix; admin_profiles upsert now uses correct
column names (admin_role, is_super_admin, display_name) matching 002_schema.sql
- Platform admin status is correctly tracked via admin_profiles.is_super_admin=true
and JWT user_metadata.user_type='platform_admin', not profiles.user_type
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>