🛡️ Sentinel: [기능 향상] ERD 엔지니어링 도구 기능 확장 및 참조 무결성 검증 추가

[seonghobae]

🚨 심각도: 향상

💡 취약점 및 개선 사항:

기존 ERD 도구에는 테이블, 컬럼, 외래 키를 제거하는 기능이 없었으며, 시각화를 위한 Mermaid 형태의 출력 기능도 부재했습니다. 특히 제거 기능 부재 시 모델을 재생성해야 하는 불편함과 함께, 참조 중인 엔티티가 불완전한 상태로 삭제되는 '참조 무결성 위반' 상태가 발생할 가능성이 있었습니다.

🎯 영향:

참조 무결성이 확보되지 않으면 도메인 설계 시 데이터 불일치가 발생할 수 있으며, 이는 후속 DDL 스크립트 실행 시 런타임 에러나 예상치 못한 보안상 악용 가능한 엣지 케이스를 유발할 수 있습니다.

🔧 해결 방안:

• removeTable, removeColumn, removeForeignKey 메서드 추가
• 다른 엔티티에서 참조하고 있는 테이블이나 컬럼을 삭제하려고 할 때 예외를 발생시키는 방어적 검증 로직(Defensive Validation) 적용
• generateMermaid 메서드를 통해 시각화 기능 지원

✅ 검증 방법:

• 100% 테스트 커버리지 달성 (pnpm coverage:erd)
• CI 파이프라인의 모든 테스트와 린팅 검사 통과 완료

---

PR created automatically by Jules for task 17449793604625455777 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

Expands the in-memory ERD modeling utility (ERDModel) used in @argos/web to support schema element deletion (tables/columns/foreign keys), enforce referential-integrity constraints during deletion, and generate Mermaid ER diagram output for visualization.

Changes:

• Added removeTable, removeColumn, and removeForeignKey with defensive referential-integrity checks.
• Added generateMermaid() to emit Mermaid erDiagram output including PK/FK annotations and relationships.
• Added Vitest coverage for removal operations and Mermaid generation; documented the security/learning note in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
packages/web/src/lib/erd.ts	Adds removal APIs with integrity checks and Mermaid diagram generation.
packages/web/src/lib/erd.test.ts	Adds unit tests covering removals and Mermaid output formatting.
.jules/sentinel.md	Records a sentinel entry about referential-integrity validation for ERD deletions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (3)

packages/web/src/lib/erd.ts:96

• removeTable is intended to block deletion when another table references the target, but the current scan also includes the table being removed. This makes it impossible to remove a table that has a self-referential foreign key (e.g., hierarchical tables), even though deleting the table would remove those FKs as well.

    // Cannot remove if referenced by another table
    for (const t of this.tables.values()) {
      for (const fk of t.foreignKeys) {
        if (fk.referenceTable === name) {
          throw new Error(`Cannot remove table '${name}' because it is referenced by '${t.name}'.`)
        }

packages/web/src/lib/erd.ts:164

• generateMermaid currently emits relationships as ${table.name} ||--o{ ${fk.referenceTable}, but generateDDL defines the FK as FOREIGN KEY (...) REFERENCES referenceTable(...) (i.e., the referenceTable is the parent / "one" side). The Mermaid relationship direction is reversed relative to the FK semantics.

    // Add relationships
    for (const table of this.tables.values()) {
      for (const fk of table.foreignKeys) {
        mermaid += `  ${table.name} ||--o{ ${fk.referenceTable} : "${fk.columnName} references ${fk.referenceColumn}"\n`
      }

packages/web/src/lib/erd.test.ts:285

• The Mermaid relationship assertion expects posts ||--o{ users, but the FK semantics in this test are posts.user_id referencing users.id, so the ||--o{ one-to-many direction should be users ||--o{ posts (users has many posts). Update the expected string to match the corrected Mermaid output.

      const mermaid = model.generateMermaid()
      const expected = `erDiagram
  users {
    SERIAL id PK
    VARCHAR(255) name
  }
  posts {
    SERIAL id PK
    INTEGER user_id FK
  }
  posts ||--o{ users : "user_id references id"`
      expect(mermaid).toBe(expected)