Skip to content

Commit 91aaf9c

Browse files
ToolboxAidToolboxAid
committed
Enable live Supabase account creation sign in and identity provisioning - PR_26166_156-live-sign-in-and-provisioning
1 parent 3371971 commit 91aaf9c

9 files changed

Lines changed: 888 additions & 365 deletions

‎docs_build/dev/reports/PR_26166_156-live-sign-in-and-provisioning.md‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
# PR_26166_156-live-sign-in-and-provisioning
2+
3+
## Branch Validation
4+
5+
- Current branch: main
6+
- Expected branch: main
7+
- Branch validation: PASS
8+
9+
## Summary
10+
11+
Made Supabase Create Account and Sign In usable end-to-end through backend API contracts.
12+
13+
- Create Account now uses server-owned Supabase Admin Auth user creation, provisions the matching `users` identity record, and assigns the default `user` role through `user_roles`.
14+
- Sign In authenticates with Supabase Auth, resolves the matching app identity rows, and creates the current session state.
15+
- Password Reset remains Supabase Auth provider-backed.
16+
- Missing identity records now fail visibly with: `Account identity setup is incomplete. Please contact support.`
17+
- Product data remains on Local DB with `GAMEFOUNDRY_DB_PROVIDER=local-db`.
18+
19+
## Requirement Checklist
20+
21+
- PASS - Main branch only; execution was on `main`.
22+
- PASS - `docs_build/dev/PROJECT_INSTRUCTIONS.md` was read before implementation.
23+
- PASS - Product data remains Local DB; no product-table migration was added.
24+
- PASS - Backend API contracts remain the browser boundary; browser tests call pages/API, not provider-specific browser logic.
25+
- PASS - Create Account creates a Supabase Auth user through server-side Admin Auth.
26+
- PASS - Create Account provisions the matching `users` record server-side.
27+
- PASS - Create Account assigns the default role through `user_roles`.
28+
- PASS - Sign In authenticates with Supabase Auth.
29+
- PASS - Sign In resolves `users`, `roles`, and `user_roles`.
30+
- PASS - Sign In creates and returns current session state.
31+
- PASS - Password Reset remains Supabase Auth provider-backed.
32+
- PASS - Missing identity records fail visibly and actionably.
33+
- PASS - No password tables were added.
34+
- PASS - No secrets or `.env.local` files were committed.
35+
- PASS - No silent fallback to Local DB auth was added.
36+
37+
## Changed Files
38+
39+
- `src/dev-runtime/auth/provider-contract-stubs.mjs`
40+
- `src/dev-runtime/server/local-api-router.mjs`
41+
- `tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
42+
- `tests/playwright/tools/LoginSessionMode.spec.mjs`
43+
- `docs_build/dev/reports/codex_review.diff`
44+
- `docs_build/dev/reports/codex_changed_files.txt`
45+
- `docs_build/dev/reports/coverage_changed_js_guardrail.txt`
46+
- `docs_build/dev/reports/playwright_v8_coverage_report.txt`
47+
- `docs_build/dev/reports/PR_26166_156-live-sign-in-and-provisioning.md`
48+
49+
## Impacted Lanes
50+
51+
- runtime: auth provider/server API routing.
52+
- integration: Supabase identity table readiness and app session resolution.
53+
- Playwright impacted: Yes.
54+
55+
## Validation Performed
56+
57+
- PASS - `node --check src/dev-runtime/auth/provider-contract-stubs.mjs`
58+
- PASS - `node --check src/dev-runtime/server/local-api-router.mjs`
59+
- PASS - `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
60+
- PASS - `node --check tests/playwright/tools/LoginSessionMode.spec.mjs`
61+
- PASS - `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
62+
- Result: 26 passed, 0 failed.
63+
- PASS - `npm run validate:supabase-dev`
64+
- Overall Result: PASS.
65+
- Users, roles, and user_roles REST/API table checks: PASS.
66+
- Direct DB connection: WARN only, due to `SELF_SIGNED_CERT_IN_CHAIN`; REST/API identity readiness passed.
67+
- PASS - `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses a production-safe account form without public Local DB controls" --reporter=list`
68+
- Result: 1 passed.
69+
- PASS - `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Configured account auth actions use external Auth and resolve the app session" --reporter=list`
70+
- Result: 1 passed.
71+
- PASS - Live DEV API probe for create account, sign in, and session resolution.
72+
- PASS - Live DEV API probe for missing identity failure.
73+
- PASS - Live DEV API probe for password reset.
74+
- PASS - `git diff --check`
75+
76+
## Live DEV Evidence
77+
78+
`npm run validate:supabase-dev`:
79+
80+
```text
81+
PASS - .env.local loaded (6 key(s) loaded)
82+
PASS - URL configured
83+
PASS - Publishable key configured
84+
PASS - Service role key configured
85+
PASS - Database URL configured
86+
PASS - Supabase reachable
87+
PASS - TLS validation
88+
PASS - Auth endpoint reachable
89+
PASS - Service role authentication
90+
WARN - Database connection (SELF_SIGNED_CERT_IN_CHAIN; REST/API identity readiness passed, so direct PostgreSQL TLS failure is advisory for DEV.)
91+
PASS - users table
92+
PASS - roles table
93+
PASS - user_roles table
94+
Overall Result: PASS
95+
```
96+
97+
Create Account and Sign In live probe:
98+
99+
```json
100+
{
101+
"createStatus": 200,
102+
"identityProvisioned": true,
103+
"signInStatus": 200,
104+
"sessionResolved": true,
105+
"currentSession": {
106+
"status": 200,
107+
"authenticated": true,
108+
"roleSlugs": ["user"],
109+
"userKeyLooksLikeUlid": true
110+
}
111+
}
112+
```
113+
114+
Missing identity live probe:
115+
116+
```json
117+
{
118+
"authOnlyCreated": true,
119+
"signInStatus": 503,
120+
"error": "Account identity setup is incomplete. Please contact support.",
121+
"messageIsActionable": true
122+
}
123+
```
124+
125+
Password Reset live probe:
126+
127+
```json
128+
{
129+
"passwordResetStatus": 200,
130+
"action": "password-reset",
131+
"redirectToIncluded": true,
132+
"message": "If an account exists for that email, password reset instructions will be sent."
133+
}
134+
```
135+
136+
## V8 Coverage
137+
138+
- Coverage artifact: `docs_build/dev/reports/playwright_v8_coverage_report.txt`
139+
- Coverage status: WARN advisory for changed Node/server runtime modules because Chromium V8 coverage does not collect those files.
140+
- Browser auth scripts were exercised by the targeted Playwright runs.
141+
142+
## Skipped Lanes
143+
144+
- samples: SKIP - full samples smoke was explicitly out of scope.
145+
- product table migration: SKIP - product data remains Local DB by requirement.
146+
- full workspace suite: SKIP - targeted auth/session validation was the requested lane for this PR.
147+
148+
## Manual Validation Notes
149+
150+
1. Start the dev runtime with Supabase auth environment configured and `GAMEFOUNDRY_DB_PROVIDER=local-db`.
151+
2. Open `account/create-account.html`.
152+
3. Create a new account with an email and password.
153+
4. Open `account/sign-in.html` and sign in with that account.
154+
5. Confirm the session resolves with a `user` role.
155+
6. Open `account/password-reset.html` and request reset instructions.
156+
7. Confirm no browser-visible secrets are shown and failures use production-safe messages.

‎docs_build/dev/reports/codex_changed_files.txt‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,24 @@
11
# git status --short
2-
M package.json
3-
M scripts/validate-supabase-dev.mjs
4-
?? docs_build/database/ddl/account/
5-
?? docs_build/database/seed/account/
6-
?? docs_build/dev/reports/PR_26166_155-supabase-identity-tables-bootstrap.md
2+
M docs_build/dev/reports/codex_changed_files.txt
3+
M docs_build/dev/reports/codex_review.diff
4+
M docs_build/dev/reports/coverage_changed_js_guardrail.txt
5+
M docs_build/dev/reports/playwright_v8_coverage_report.txt
6+
M src/dev-runtime/auth/provider-contract-stubs.mjs
7+
M src/dev-runtime/server/local-api-router.mjs
8+
M tests/dev-runtime/SupabaseProviderContractStub.test.mjs
9+
M tests/playwright/tools/LoginSessionMode.spec.mjs
10+
?? docs_build/dev/reports/PR_26166_156-live-sign-in-and-provisioning.md
711

812
# git ls-files --others --exclude-standard
9-
docs_build/database/ddl/account/supabase-identity-tables.sql
10-
docs_build/database/seed/account/supabase-dev-identity-bootstrap.md
11-
docs_build/dev/reports/PR_26166_155-supabase-identity-tables-bootstrap.md
13+
docs_build/dev/reports/PR_26166_156-live-sign-in-and-provisioning.md
1214

1315
# git diff --stat
14-
package.json | 2 +-
15-
scripts/validate-supabase-dev.mjs | 63 +++++++++++++++++++++++++++++++++------
16-
2 files changed, 55 insertions(+), 10 deletions(-)
16+
docs_build/dev/reports/codex_changed_files.txt | 30 +-
17+
docs_build/dev/reports/codex_review.diff | 882 +++++++++++++--------
18+
.../dev/reports/coverage_changed_js_guardrail.txt | 4 +-
19+
.../dev/reports/playwright_v8_coverage_report.txt | 18 +-
20+
src/dev-runtime/auth/provider-contract-stubs.mjs | 37 +-
21+
src/dev-runtime/server/local-api-router.mjs | 47 +-
22+
.../SupabaseProviderContractStub.test.mjs | 72 +-
23+
tests/playwright/tools/LoginSessionMode.spec.mjs | 7 +-
24+
8 files changed, 732 insertions(+), 365 deletions(-)

0 commit comments

Comments
 (0)