Stack Supabase Auth UAT validation account state and closeout for usable sign in - PR_STACK_26166_157-160-supabase-sign-in-uat-ready

Author: ToolboxAid

account/create-account.html

@@ -5,7 +5,7 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>Create Account - GameFoundryStudio</title>
-    <meta name="description" content="Create a GameFoundryStudio account through the configured account provider.">
+    <meta name="description" content="Create a GameFoundryStudio account through the account service.">
     <link rel="icon" href="/favicon.svg">
     <link rel="stylesheet" href="../assets/theme-v2/css/theme.css">
 </head>
@@ -17,7 +17,7 @@
             <div class="container">
                 <div class="kicker">Account</div>
                 <h1>Create Account</h1>
-                <p class="lede">Create an account through the configured account provider.</p>
+                <p class="lede">Create an account through the account service.</p>
             </div>
         </section>
         <section class="section">
@@ -28,7 +28,7 @@ <h1>Create Account</h1>
                             <div class="kicker">Account Access</div>
                             <h2>Create Account</h2>
                         </div>
-                        <p>Account creation is handled by the configured account provider.</p>
+                        <p>Account creation is handled by the account service.</p>
                         <form class="content-stack" data-account-auth-form="create-account">
                             <label for="createAccountEmail">Email</label>
                             <input id="createAccountEmail" name="email" type="email" autocomplete="email" data-account-auth-email>

account/password-reset.html

@@ -5,7 +5,7 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>Password Reset - GameFoundryStudio</title>
-    <meta name="description" content="Request a GameFoundryStudio password reset through the configured account provider.">
+    <meta name="description" content="Request a GameFoundryStudio password reset through the account service.">
     <link rel="icon" href="/favicon.svg">
     <link rel="stylesheet" href="../assets/theme-v2/css/theme.css">
 </head>
@@ -17,7 +17,7 @@
             <div class="container">
                 <div class="kicker">Account</div>
                 <h1>Password Reset</h1>
-                <p class="lede">Request a password reset through the configured account provider.</p>
+                <p class="lede">Request a password reset through the account service.</p>
             </div>
         </section>
         <section class="section">
@@ -28,7 +28,7 @@ <h1>Password Reset</h1>
                             <div class="kicker">Account Access</div>
                             <h2>Password Reset</h2>
                         </div>
-                        <p>Password reset email delivery is handled by the configured account provider.</p>
+                        <p>Password reset email delivery is handled by the account service.</p>
                         <form class="content-stack" data-account-auth-form="password-reset">
                             <label for="passwordResetEmail">Email</label>
                             <input id="passwordResetEmail" name="email" type="email" autocomplete="email" data-account-auth-email>

assets/theme-v2/js/account-auth-actions.js

@@ -4,6 +4,7 @@ const passwordField = document.querySelector("[data-account-auth-password]");
 const statusField = document.querySelector("[data-account-auth-status]");
 const submitButton = document.querySelector("[data-account-auth-submit]");
 const action = form?.getAttribute("data-account-auth-form") || "";
+const ACCOUNT_IDENTITY_SETUP_MESSAGE = "Account identity setup is incomplete. Please contact support.";
 const AUTH_UNAVAILABLE_MESSAGE = "The site is currently unavailable. Please try again later.";
 let authStatus = null;
 
@@ -32,6 +33,9 @@ async function readJson(response, fallbackMessage) {
     payload = null;
   }
   if (!response.ok || payload?.ok === false) {
+    if (payload?.error === ACCOUNT_IDENTITY_SETUP_MESSAGE) {
+      throw new Error(ACCOUNT_IDENTITY_SETUP_MESSAGE);
+    }
     throw new Error(fallbackMessage);
   }
   return payload?.data || {};

assets/theme-v2/js/gamefoundry-partials.js

@@ -527,7 +527,7 @@
             return {
                 role: "user",
                 title: "Sign-in required",
-                message: "Sign in as a local user to open Account pages."
+                message: "Sign in with your account to open Account pages."
             };
         }
         return null;

assets/theme-v2/js/login-session.js

@@ -4,6 +4,7 @@ const identityField = document.querySelector("[data-login-identity]");
 const passwordField = document.querySelector("[data-login-password]");
 const statusField = document.querySelector("[data-login-status]");
 const submitButton = document.querySelector("[data-login-submit]");
+const ACCOUNT_IDENTITY_SETUP_MESSAGE = "Account identity setup is incomplete. Please contact support.";
 const AUTH_UNAVAILABLE_MESSAGE = "The site is currently unavailable. Please try again later.";
 let authStatus = null;
 
@@ -65,6 +66,9 @@ async function readJson(response, fallbackMessage) {
     payload = null;
   }
   if (!response.ok || payload?.ok === false) {
+    if (payload?.error === ACCOUNT_IDENTITY_SETUP_MESSAGE) {
+      throw new Error(ACCOUNT_IDENTITY_SETUP_MESSAGE);
+    }
     throw new Error(fallbackMessage);
   }
   return payload?.data || {};
@@ -79,6 +83,14 @@ async function requestAccountAuth(path, options = {}) {
   return readJson(response, AUTH_UNAVAILABLE_MESSAGE);
 }
 
+async function requestCurrentSession() {
+  const response = await fetch("/api/session/current", {
+    headers: { "accept": "application/json" },
+    method: "GET",
+  });
+  return readJson(response, AUTH_UNAVAILABLE_MESSAGE);
+}
+
 function unavailableMessage(status) {
   return status?.message || AUTH_UNAVAILABLE_MESSAGE;
 }
@@ -95,6 +107,14 @@ async function refreshAccountAuthStatus() {
   }
   try {
     authStatus = await requestAccountAuth("status");
+    if (authStatus.ready) {
+      const session = await requestCurrentSession();
+      if (session?.authenticated) {
+        setFormEnabled(false);
+        setStatus(`Signed in as ${session.displayName || session.label || "Account"}.`);
+        return authStatus;
+      }
+    }
     setFormEnabled(Boolean(authStatus.ready));
     setStatus(authStatus.ready ? "Account service is available." : unavailableMessage(authStatus));
   } catch (error) {

docs_build/dev/reports/PR_26166_157-first-real-sign-in-validation.md

@@ -0,0 +1,103 @@
+# PR_26166_157-first-real-sign-in-validation
+
+## Branch Validation
+
+- Current branch: main
+- Expected branch: main
+- Branch validation: PASS
+
+## Purpose
+
+Validate real Supabase Create Account, Sign In, Session, Role Resolution, Sign Out, and Password Reset flows without adding new infrastructure.
+
+## Requirement Checklist
+
+- PASS - Real Create Account path validated against configured DEV Supabase.
+- PASS - Real Sign In path validated against configured DEV Supabase.
+- PASS - Current Session path validated after sign in.
+- PASS - Role resolution validated; created account resolved with `user`.
+- PASS - Sign Out validated; session returned to unauthenticated.
+- PASS - Password Reset validated with production-safe message.
+- PASS - No new infrastructure was added for this validation PR.
+- PASS - Product data remained Local DB.
+- PASS - No full samples smoke was run.
+
+## Validation Lane Report
+
+- contract: PASS - `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- runtime: PASS - live local API probe against configured DEV Supabase.
+- integration: PASS - `npm run validate:supabase-dev`
+- Playwright: PASS - targeted auth/session Playwright subset.
+- samples: SKIP - explicitly out of scope.
+
+## Changed Files
+
+- Dedicated runtime implementation: none for this validation PR.
+- Stack reports/artifacts: `docs_build/dev/reports/*`
+- Shared stack tests: `tests/playwright/tools/LoginSessionMode.spec.mjs`
+
+## Playwright V8 Coverage
+
+- Artifact: `docs_build/dev/reports/playwright_v8_coverage_report.txt`
+- Status: WARN advisory for files not collected by current Chromium V8 coverage; targeted behavior validation passed.
+
+## Skipped Lanes
+
+- samples: SKIP - explicitly out of scope.
+- full workspace suite: SKIP - targeted auth/session validation was requested for this stack.
+
+## Live DEV Evidence
+
+Sanitized live UAT probe:
+
+```json
+{
+  "authStatus": {
+    "status": 200,
+    "configured": true,
+    "ready": true,
+    "identityTablesReady": true,
+    "productDataProvider": "local-db"
+  },
+  "createAccount": {
+    "status": 200,
+    "identityProvisioned": true,
+    "roleSlugs": ["user"],
+    "userKeyLooksLikeUlid": true
+  },
+  "signIn": {
+    "status": 200,
+    "sessionResolved": true,
+    "roleSlugs": ["user"]
+  },
+  "signedInSession": {
+    "status": 200,
+    "authenticated": true,
+    "roleSlugs": ["user"],
+    "userKeyLooksLikeUlid": true
+  },
+  "signOut": {
+    "status": 200,
+    "authenticated": false
+  },
+  "signedOutSession": {
+    "status": 200,
+    "authenticated": false,
+    "displayName": "Login"
+  },
+  "passwordReset": {
+    "status": 200,
+    "action": "password-reset",
+    "message": "If an account exists for that email, password reset instructions will be sent."
+  }
+}
+```
+
+## Manual Validation Notes
+
+1. Start the local API runtime with Supabase Auth env configured and `GAMEFOUNDRY_DB_PROVIDER=local-db`.
+2. Open `account/create-account.html` and create a new account.
+3. Open `account/sign-in.html`, sign in, and confirm the Account nav shows the signed-in user.
+4. Confirm `/api/session/current` returns authenticated with the `user` role.
+5. Use the Account logout action and confirm the session returns to signed out.
+6. Open `account/password-reset.html` and request a password reset.

docs_build/dev/reports/PR_26166_158-account-flow-error-polish.md

@@ -0,0 +1,60 @@
+# PR_26166_158-account-flow-error-polish
+
+## Branch Validation
+
+- Current branch: main
+- Expected branch: main
+- Branch validation: PASS
+
+## Purpose
+
+Polish user-facing account errors and remove provider/internal wording from active account flows.
+
+## Requirement Checklist
+
+- PASS - Generic unavailable message remains for site/provider failures: `The site is currently unavailable. Please try again later.`
+- PASS - Identity provisioning failures show the actionable support message: `Account identity setup is incomplete. Please contact support.`
+- PASS - Active Create Account and Password Reset copy says `account service`, not provider-specific wording.
+- PASS - No DEV wording appears in active account flow UI.
+- PASS - Browser still calls backend API contracts only.
+- PASS - No secrets, `.env`, password tables, or auth fallback changes were added.
+
+## Implementation Evidence
+
+- `assets/theme-v2/js/account-auth-actions.js` now allows only the safe identity setup support message through failed auth responses; other failed responses remain generic.
+- `assets/theme-v2/js/login-session.js` uses the same safe-message rule for Sign In.
+- `account/create-account.html` and `account/password-reset.html` now use account-service wording.
+- `assets/theme-v2/js/gamefoundry-partials.js` no longer tells users to sign in as a `local user` on protected Account pages.
+
+## Changed Files
+
+- `account/create-account.html`
+- `account/password-reset.html`
+- `assets/theme-v2/js/account-auth-actions.js`
+- `assets/theme-v2/js/login-session.js`
+- `assets/theme-v2/js/gamefoundry-partials.js`
+- `tests/playwright/tools/LoginSessionMode.spec.mjs`
+
+## Validation Lane Report
+
+- static: PASS - changed-file syntax checks passed.
+- Playwright: PASS - targeted browser test confirms identity setup support message renders and provider details are not exposed.
+- samples: SKIP - explicitly out of scope.
+
+## Playwright V8 Coverage
+
+- Artifact: `docs_build/dev/reports/playwright_v8_coverage_report.txt`
+- Status: WARN advisory for some changed JS files not collected by current Chromium V8 coverage; behavior passed through Playwright.
+
+## Skipped Lanes
+
+- samples: SKIP - explicitly out of scope.
+- full workspace suite: SKIP - targeted auth/session validation was requested for this stack.
+
+## Manual Validation Notes
+
+1. Temporarily create an Auth user without a matching app identity row.
+2. Attempt Sign In.
+3. Confirm the page shows `Account identity setup is incomplete. Please contact support.`
+4. Break or omit auth configuration and confirm the page shows the generic unavailable message.
+5. Confirm Create Account and Password Reset pages use account-service language.

docs_build/dev/reports/PR_26166_159-account-session-ui-state.md

@@ -0,0 +1,60 @@
+# PR_26166_159-account-session-ui-state
+
+## Branch Validation
+
+- Current branch: main
+- Expected branch: main
+- Branch validation: PASS
+
+## Purpose
+
+Show signed-in and signed-out account state consistently while preserving guest browsing and guest-save redirects.
+
+## Requirement Checklist
+
+- PASS - Sign In page checks current session through `/api/session/current`.
+- PASS - Signed-in users see `Signed in as <name>.` on the Sign In page.
+- PASS - Signed-in users have the Sign In submit button disabled on the Sign In page.
+- PASS - Header Account nav shows the signed-in display name after successful sign in.
+- PASS - Logout clears the current session and returns Account nav to `Sign In`.
+- PASS - Guest browsing remains allowed.
+- PASS - Guest saving still redirects to `account/sign-in.html`.
+- PASS - No browser-owned provider logic was added.
+
+## Implementation Evidence
+
+- `assets/theme-v2/js/login-session.js` reads current session through the backend session API after account service readiness.
+- `assets/theme-v2/js/gamefoundry-partials.js` retains shared header/account state behavior and updates protected Account copy.
+- Targeted Playwright covers signed-in Sign In page state, logout state, and guest save redirect.
+
+## Changed Files
+
+- `assets/theme-v2/js/login-session.js`
+- `assets/theme-v2/js/gamefoundry-partials.js`
+- `tests/playwright/tools/LoginSessionMode.spec.mjs`
+
+## Validation Lane Report
+
+- static: PASS - changed-file syntax checks passed.
+- Playwright: PASS - targeted auth/session subset passed 5/5.
+- samples: SKIP - explicitly out of scope.
+
+## Playwright V8 Coverage
+
+- Artifact: `docs_build/dev/reports/playwright_v8_coverage_report.txt`
+- Status: WARN advisory for some changed JS files not collected by current Chromium V8 coverage; signed-in/signed-out behavior passed through Playwright.
+
+## Skipped Lanes
+
+- samples: SKIP - explicitly out of scope.
+- full workspace suite: SKIP - targeted auth/session validation was requested for this stack.
+
+## Manual Validation Notes
+
+1. Sign in with a valid account.
+2. Confirm Account nav shows the signed-in display name.
+3. Visit `account/sign-in.html` while signed in.
+4. Confirm status reads `Signed in as <name>.` and Sign In is disabled.
+5. Sign out from the Account menu and confirm protected Account pages block access.
+6. Open a guest-allowed Toolbox page and confirm browsing remains possible.
+7. Trigger a guest save action and confirm it redirects to `account/sign-in.html`.