Skip to content

Commit b70b555

Browse files
ToolboxAidToolboxAid
committed
Stack Supabase Auth readiness and live account flows to make sign in usable - PR_STACK_26166_148-152-sign-in-usable-supabase-auth
1 parent 54ec47c commit b70b555

46 files changed

Lines changed: 2292 additions & 817 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎account/sign-in.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ <h1>Sign In</h1>
2929
<h2>Welcome Back</h2>
3030
</div>
3131
<form class="content-stack" data-login-form>
32-
<label for="signInIdentity">Email or username</label>
33-
<input id="signInIdentity" name="identity" type="text" autocomplete="username" data-login-identity>
32+
<label for="signInIdentity">Email</label>
33+
<input id="signInIdentity" name="identity" type="email" autocomplete="email" data-login-identity>
3434
<label for="signInPassword">Password</label>
3535
<input id="signInPassword" name="password" type="password" autocomplete="current-password" data-login-password>
3636
<div class="action-group">

‎assets/theme-v2/js/account-auth-actions.js‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,11 +97,14 @@ form?.addEventListener("submit", (event) => {
9797
if (!endpoint) {
9898
throw new Error("Unknown account action.");
9999
}
100+
const body = {
101+
email: emailField?.value || "",
102+
};
103+
if (passwordField) {
104+
body.password = passwordField.value || "";
105+
}
100106
return requestAccountAuth(endpoint, {
101-
body: {
102-
email: emailField?.value || "",
103-
password: passwordField?.value || "",
104-
},
107+
body,
105108
method: "POST",
106109
});
107110
})

‎assets/theme-v2/js/login-session.js‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ const form = document.querySelector("[data-login-form]");
33
const identityField = document.querySelector("[data-login-identity]");
44
const passwordField = document.querySelector("[data-login-password]");
55
const statusField = document.querySelector("[data-login-status]");
6+
const submitButton = document.querySelector("[data-login-submit]");
67
const AUTH_UNAVAILABLE_MESSAGE = "The site is currently unavailable. Please try again later.";
78
let authStatus = null;
89

@@ -45,6 +46,12 @@ function setStatus(message) {
4546
}
4647
}
4748

49+
function setFormEnabled(enabled) {
50+
if (submitButton) {
51+
submitButton.disabled = !enabled;
52+
}
53+
}
54+
4855
function isStaticOnlyLocalEntrypoint() {
4956
return ["127.0.0.1", "localhost"].includes(window.location.hostname) &&
5057
window.location.port === "5500";
@@ -82,17 +89,20 @@ async function refreshAccountAuthStatus() {
8289
ready: false,
8390
message: AUTH_UNAVAILABLE_MESSAGE,
8491
};
92+
setFormEnabled(false);
8593
setStatus(authStatus.message);
8694
return authStatus;
8795
}
8896
try {
8997
authStatus = await requestAccountAuth("status");
98+
setFormEnabled(Boolean(authStatus.ready));
9099
setStatus(authStatus.ready ? "Account service is available." : unavailableMessage(authStatus));
91100
} catch (error) {
92101
authStatus = {
93102
ready: false,
94103
message: error instanceof Error ? error.message : AUTH_UNAVAILABLE_MESSAGE,
95104
};
105+
setFormEnabled(false);
96106
setStatus(authStatus.message);
97107
}
98108
return authStatus;
@@ -120,10 +130,15 @@ form?.addEventListener("submit", (event) => {
120130
})
121131
.then((result) => {
122132
if (result) {
123-
setStatus(result.message || "Account authentication completed.");
133+
setStatus(result.sessionResolved ? "Signed in." : result.message || "Account authentication completed.");
134+
if (result.sessionResolved) {
135+
window.location.assign(currentReturnTo());
136+
}
124137
}
125138
})
126139
.catch((error) => {
127140
setStatus(error instanceof Error ? error.message : AUTH_UNAVAILABLE_MESSAGE);
128141
});
129142
});
143+
144+
refreshAccountAuthStatus();

‎docs_build/dev/reports/PR_26166_148-supabase-auth-readiness-gate.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# PR_26166_148-supabase-auth-readiness-gate
2+
3+
## Branch Validation
4+
- PASS: current branch `main`.
5+
- Expected branch: `main`.
6+
7+
## Requirement Checklist
8+
- PASS: `/api/auth/status` now proves Supabase Auth selected/configured/ready by checking provider selection, browser-safe config, Local DB product-data provider, and live `/auth/v1/health` connectivity before reporting `ready=true`.
9+
- PASS: Missing or failed Supabase connectivity returns `ready=false`, `status=unavailable`, generic browser message, and operator-safe diagnostics.
10+
- PASS: No product DB migration was added.
11+
- PASS: No secrets or `.env.local` changes were made.
12+
13+
## Validation Lane Report
14+
- PASS: `node --check src/dev-runtime/server/local-api-router.mjs`
15+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
16+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses|Configured account auth actions" --reporter=list`
17+
- PASS: `npm run test:workspace-v2`
18+
19+
## Live/Manual Notes
20+
- Local env probe: `selected=true`, `configured=true`, `localDbProductDataActive=true`, `connectivityStatus=failed`, `ready=false`.
21+
- This is expected readiness-gate behavior when connectivity cannot be proven.
22+
23+
## Playwright V8 Coverage
24+
- See `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
25+
- Coverage WARN: server router JS is Node runtime and not collected by browser V8; browser auth JS is covered.
26+
27+
## Skipped Lanes
28+
- Samples smoke: SKIP. Auth readiness does not touch samples or sample manifests.

‎docs_build/dev/reports/PR_26166_149-sign-in-live-supabase-flow.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# PR_26166_149-sign-in-live-supabase-flow
2+
3+
## Branch Validation
4+
- PASS: current branch `main`.
5+
- Expected branch: `main`.
6+
7+
## Requirement Checklist
8+
- PASS: `/account/sign-in.html` remains Theme V2, external JS only, no inline CSS/JS/events.
9+
- PASS: Sign-in uses backend `/api/auth/sign-in` only.
10+
- PASS: Browser code contains no Supabase provider logic or token handling.
11+
- PASS: Unavailable/failure paths show `The site is currently unavailable. Please try again later.`
12+
- PASS: Successful configured sign-in resolves a backend app session and redirects to the return target.
13+
- PASS: No Local DB auth fallback, password table, secret, or `.env.local` change was added.
14+
15+
## Validation Lane Report
16+
- PASS: `node --check assets/theme-v2/js/login-session.js`
17+
- PASS: `node --check account/sign-in.html` is not applicable; HTML was validated through Playwright page load and structure assertions.
18+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
19+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses|Configured account auth actions" --reporter=list`
20+
- PASS: `npx playwright test tests/playwright/tools/ApiStaticRouteRecovery.spec.mjs --reporter=list`
21+
- PASS: `npx playwright test tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs --reporter=list`
22+
- PASS: `npm run test:workspace-v2`
23+
24+
## Manual Notes
25+
- Sign-in label is now `Email` for Supabase Auth.
26+
- Submit disables when the backend account service is not ready.
27+
- Successful fake Supabase sign-in sanitized tokens and resolved `User 1` through provider-owned identity tables.
28+
29+
## Playwright V8 Coverage
30+
- See `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
31+
32+
## Skipped Lanes
33+
- Full samples smoke: SKIP. Sign-in account flow does not modify sample runtime.

‎docs_build/dev/reports/PR_26166_150-create-account-live-supabase-flow.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# PR_26166_150-create-account-live-supabase-flow
2+
3+
## Branch Validation
4+
- PASS: current branch `main`.
5+
- Expected branch: `main`.
6+
7+
## Requirement Checklist
8+
- PASS: `/account/create-account.html` posts through backend `/api/auth/create-account`.
9+
- PASS: Backend uses the Supabase Auth provider adapter when readiness is proven.
10+
- PASS: No password table or local password storage was added.
11+
- PASS: No Local DB auth fallback was added.
12+
- PASS: Missing readiness/failure path shows the generic production-safe unavailable message.
13+
- PASS: Page remains production-safe Theme V2 with external JavaScript.
14+
15+
## Validation Lane Report
16+
- PASS: `node --check assets/theme-v2/js/account-auth-actions.js`
17+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
18+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses|Configured account auth actions" --reporter=list`
19+
- PASS: `npm run test:workspace-v2`
20+
21+
## Manual Notes
22+
- The create-account action body sends email/password to the backend only.
23+
- Supabase access and refresh tokens are never exposed in API responses or browser code.
24+
25+
## Playwright V8 Coverage
26+
- See `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
27+
28+
## Skipped Lanes
29+
- Full samples smoke: SKIP. Account creation does not touch samples.

‎docs_build/dev/reports/PR_26166_151-password-reset-live-supabase-flow.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# PR_26166_151-password-reset-live-supabase-flow
2+
3+
## Branch Validation
4+
- PASS: current branch `main`.
5+
- Expected branch: `main`.
6+
7+
## Requirement Checklist
8+
- PASS: `/account/password-reset.html` posts through backend `/api/auth/password-reset`.
9+
- PASS: Backend requests password reset through Supabase Auth adapter only when readiness is proven.
10+
- PASS: User-facing success copy is production-safe: `If an account exists for that email, password reset instructions will be sent.`
11+
- PASS: Failure path uses the generic unavailable message.
12+
- PASS: No password table, local password storage, secret, or Local DB auth fallback was added.
13+
14+
## Validation Lane Report
15+
- PASS: `node --check assets/theme-v2/js/account-auth-actions.js`
16+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
17+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses|Configured account auth actions" --reporter=list`
18+
- PASS: `npm run test:workspace-v2`
19+
20+
## Manual Notes
21+
- Password reset submits email only; no blank password field is sent for reset requests.
22+
23+
## Playwright V8 Coverage
24+
- See `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
25+
26+
## Skipped Lanes
27+
- Full samples smoke: SKIP. Password reset does not affect sample runtime.

‎docs_build/dev/reports/PR_26166_152-session-user-role-resolution.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# PR_26166_152-session-user-role-resolution
2+
3+
## Branch Validation
4+
- PASS: current branch `main`.
5+
- Expected branch: `main`.
6+
7+
## Requirement Checklist
8+
- PASS: Signed-in Supabase Auth payload resolves backend session through provider-owned `users`, `roles`, and `user_roles`.
9+
- PASS: `users.key` remains the app ownership reference returned in session data.
10+
- PASS: `GAMEFOUNDRY_DB_PROVIDER=local-db` is preserved for product data.
11+
- PASS: Product tables remain on Local DB; no games/assets/objects/controls/tool metadata migration was added.
12+
- PASS: No browser-generated authoritative keys were added.
13+
- PASS: No secrets or `.env.local` commits were added.
14+
- PASS: Missing user/role paths fail visibly through generic browser-safe action failure and operator-safe backend diagnostics.
15+
16+
## Validation Lane Report
17+
- PASS: `node --check src/dev-runtime/server/local-api-router.mjs`
18+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
19+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses|Configured account auth actions" --reporter=list`
20+
- PASS: `npm run test:workspace-v2`
21+
22+
## Manual Notes
23+
- Fake Supabase sign-in resolves `supabase-user-1` to seeded DEV `User 1`.
24+
- `/api/session/current` returns authenticated `User 1` with role `user` after sign-in.
25+
- Service role values are used only server-side by the provider contract and are not exposed in browser responses.
26+
27+
## Playwright V8 Coverage
28+
- See `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
29+
30+
## Skipped Lanes
31+
- Full samples smoke: SKIP. Session identity resolution does not touch sample manifests or runtime samples.

‎docs_build/dev/reports/codex_changed_files.txt‎

Lines changed: 94 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,94 @@
1-
docs_build/dev/reports/codex_changed_files.txt
2-
docs_build/dev/reports/codex_review.diff
3-
docs_build/dev/reports/coverage_changed_js_guardrail.txt
4-
docs_build/dev/reports/dependency_gating_report.md
5-
docs_build/dev/reports/dependency_hydration_reuse_report.md
6-
docs_build/dev/reports/execution_graph_reuse_report.md
7-
docs_build/dev/reports/failure_fingerprint_report.md
8-
docs_build/dev/reports/filesystem_scan_reduction_report.md
9-
docs_build/dev/reports/incremental_validation_report.md
10-
docs_build/dev/reports/lane_compilation_report.md
11-
docs_build/dev/reports/lane_deduplication_report.md
12-
docs_build/dev/reports/lane_input_validation_report.md
13-
docs_build/dev/reports/lane_runtime_optimization_report.md
14-
docs_build/dev/reports/lane_snapshot_report.md
15-
docs_build/dev/reports/lane_warm_start_report.md
16-
docs_build/dev/reports/monolith_trigger_removal_report.md
17-
docs_build/dev/reports/persistent_lane_manifest_report.md
18-
docs_build/dev/reports/playwright_discovery_ownership_report.md
19-
docs_build/dev/reports/playwright_discovery_scope_report.md
20-
docs_build/dev/reports/playwright_structure_audit.md
21-
docs_build/dev/reports/playwright_v8_coverage_report.txt
22-
docs_build/dev/reports/PR_26166_147-supabase-auth-live-validation.md
23-
docs_build/dev/reports/retry_suppression_report.md
24-
docs_build/dev/reports/slow_path_pruning_report.md
25-
docs_build/dev/reports/static_validation_report.md
26-
docs_build/dev/reports/supabase-auth-live-validation-evidence.json
27-
docs_build/dev/reports/targeted_file_manifest_report.md
28-
docs_build/dev/reports/test_cleanup_performance_report.md
29-
docs_build/dev/reports/test_cleanup_routing_report.md
30-
docs_build/dev/reports/testing_lane_execution_report.md
31-
docs_build/dev/reports/validation_cache_report.md
32-
docs_build/dev/reports/zero_browser_preflight_report.md
1+
# git status --short
2+
M account/sign-in.html
3+
M assets/theme-v2/js/account-auth-actions.js
4+
M assets/theme-v2/js/login-session.js
5+
M docs_build/dev/reports/coverage_changed_js_guardrail.txt
6+
M docs_build/dev/reports/dependency_gating_report.md
7+
M docs_build/dev/reports/dependency_hydration_reuse_report.md
8+
M docs_build/dev/reports/execution_graph_reuse_report.md
9+
M docs_build/dev/reports/failure_fingerprint_report.md
10+
M docs_build/dev/reports/filesystem_scan_reduction_report.md
11+
M docs_build/dev/reports/incremental_validation_report.md
12+
M docs_build/dev/reports/lane_compilation_report.md
13+
M docs_build/dev/reports/lane_deduplication_report.md
14+
M docs_build/dev/reports/lane_input_validation_report.md
15+
M docs_build/dev/reports/lane_manifests/workspace-contract.json
16+
M docs_build/dev/reports/lane_runtime_optimization_report.md
17+
M docs_build/dev/reports/lane_snapshot_report.md
18+
M docs_build/dev/reports/lane_snapshots/workspace-contract.json
19+
M docs_build/dev/reports/lane_warm_start_report.md
20+
M docs_build/dev/reports/lane_warm_starts/workspace-contract.json
21+
M docs_build/dev/reports/monolith_trigger_removal_report.md
22+
M docs_build/dev/reports/persistent_lane_manifest_report.md
23+
M docs_build/dev/reports/playwright_discovery_ownership_report.md
24+
M docs_build/dev/reports/playwright_discovery_scope_report.md
25+
M docs_build/dev/reports/playwright_structure_audit.md
26+
M docs_build/dev/reports/playwright_v8_coverage_report.txt
27+
M docs_build/dev/reports/retry_suppression_report.md
28+
M docs_build/dev/reports/slow_path_pruning_report.md
29+
M docs_build/dev/reports/static_validation_report.md
30+
M docs_build/dev/reports/targeted_file_manifest_report.md
31+
M docs_build/dev/reports/test_cleanup_performance_report.md
32+
M docs_build/dev/reports/test_cleanup_routing_report.md
33+
M docs_build/dev/reports/testing_lane_execution_report.md
34+
M docs_build/dev/reports/validation_cache_report.md
35+
M docs_build/dev/reports/zero_browser_preflight_report.md
36+
M src/dev-runtime/server/local-api-router.mjs
37+
M tests/dev-runtime/SupabaseProviderContractStub.test.mjs
38+
M tests/playwright/tools/ApiStaticRouteRecovery.spec.mjs
39+
M tests/playwright/tools/LoginSessionMode.spec.mjs
40+
M tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs
41+
?? docs_build/dev/reports/PR_26166_148-supabase-auth-readiness-gate.md
42+
?? docs_build/dev/reports/PR_26166_149-sign-in-live-supabase-flow.md
43+
?? docs_build/dev/reports/PR_26166_150-create-account-live-supabase-flow.md
44+
?? docs_build/dev/reports/PR_26166_151-password-reset-live-supabase-flow.md
45+
?? docs_build/dev/reports/PR_26166_152-session-user-role-resolution.md
46+
47+
# git ls-files --others --exclude-standard
48+
docs_build/dev/reports/PR_26166_148-supabase-auth-readiness-gate.md
49+
docs_build/dev/reports/PR_26166_149-sign-in-live-supabase-flow.md
50+
docs_build/dev/reports/PR_26166_150-create-account-live-supabase-flow.md
51+
docs_build/dev/reports/PR_26166_151-password-reset-live-supabase-flow.md
52+
docs_build/dev/reports/PR_26166_152-session-user-role-resolution.md
53+
54+
# git diff --stat
55+
account/sign-in.html | 4 +-
56+
assets/theme-v2/js/account-auth-actions.js | 11 +-
57+
assets/theme-v2/js/login-session.js | 17 +-
58+
.../dev/reports/coverage_changed_js_guardrail.txt | 6 +-
59+
docs_build/dev/reports/dependency_gating_report.md | 2 +-
60+
.../reports/dependency_hydration_reuse_report.md | 4 +-
61+
.../dev/reports/execution_graph_reuse_report.md | 4 +-
62+
.../dev/reports/failure_fingerprint_report.md | 2 +-
63+
.../reports/filesystem_scan_reduction_report.md | 2 +-
64+
.../dev/reports/incremental_validation_report.md | 2 +-
65+
docs_build/dev/reports/lane_compilation_report.md | 2 +-
66+
.../dev/reports/lane_deduplication_report.md | 2 +-
67+
.../dev/reports/lane_input_validation_report.md | 2 +-
68+
.../reports/lane_manifests/workspace-contract.json | 10 +-
69+
.../reports/lane_runtime_optimization_report.md | 2 +-
70+
docs_build/dev/reports/lane_snapshot_report.md | 4 +-
71+
.../reports/lane_snapshots/workspace-contract.json | 22 +-
72+
docs_build/dev/reports/lane_warm_start_report.md | 4 +-
73+
.../lane_warm_starts/workspace-contract.json | 16 +-
74+
.../dev/reports/monolith_trigger_removal_report.md | 2 +-
75+
.../dev/reports/persistent_lane_manifest_report.md | 6 +-
76+
.../playwright_discovery_ownership_report.md | 2 +-
77+
.../reports/playwright_discovery_scope_report.md | 2 +-
78+
.../dev/reports/playwright_structure_audit.md | 2 +-
79+
.../dev/reports/playwright_v8_coverage_report.txt | 48 +++-
80+
docs_build/dev/reports/retry_suppression_report.md | 2 +-
81+
docs_build/dev/reports/slow_path_pruning_report.md | 12 +-
82+
docs_build/dev/reports/static_validation_report.md | 4 +-
83+
.../dev/reports/targeted_file_manifest_report.md | 4 +-
84+
.../dev/reports/test_cleanup_performance_report.md | 14 +-
85+
.../dev/reports/test_cleanup_routing_report.md | 2 +-
86+
.../dev/reports/testing_lane_execution_report.md | 16 +-
87+
docs_build/dev/reports/validation_cache_report.md | 30 +--
88+
.../dev/reports/zero_browser_preflight_report.md | 2 +-
89+
src/dev-runtime/server/local-api-router.mjs | 246 +++++++++++++++------
90+
.../SupabaseProviderContractStub.test.mjs | 92 +++++---
91+
.../tools/ApiStaticRouteRecovery.spec.mjs | 17 +-
92+
tests/playwright/tools/LoginSessionMode.spec.mjs | 99 +++++++--
93+
.../tools/StaticOnlyLoginApiRequired.spec.mjs | 4 +-
94+
39 files changed, 503 insertions(+), 221 deletions(-)

0 commit comments

Comments
 (0)