Bootstrap Supabase identity records and provisioning for usable sign in - PR_26166_153-supabase-identity-bootstrap-and-provisioning

Author: ToolboxAid

docs_build/dev/reports/PR_26166_153-supabase-identity-bootstrap-and-provisioning.md

@@ -0,0 +1,61 @@
+# PR_26166_153-supabase-identity-bootstrap-and-provisioning
+
+## Branch Validation
+- PASS: current branch `main`.
+- Expected branch: `main`.
+
+## Requirement Checklist
+- PASS: `docs_build/dev/PROJECT_INSTRUCTIONS.md` was read before implementation.
+- PASS: `GAMEFOUNDRY_DB_PROVIDER=local-db` is preserved; product data remains Local DB.
+- PASS: Supabase identity table validation was added for `users`, `roles`, and `user_roles`.
+- PASS: `/api/auth/status` now requires Supabase Auth connectivity and identity table reachability before `ready=true`.
+- PASS: Create Account creates the Supabase Auth user through the backend API and provisions matching app identity records server-side.
+- PASS: Provisioning creates/updates `users`, ensures the default `user` role, and inserts `user_roles` with server-generated keys.
+- PASS: Sign In resolves session/user/roles from Supabase identity records.
+- PASS: Password Reset remains Supabase Auth only.
+- PASS: No secrets or `.env.local` files were committed or modified.
+- PASS: Browser pages continue to use backend API contracts only; no browser-owned auth/provider/data logic was added.
+- PASS: No silent fallback was added.
+- FAIL: Real configured Supabase DEV readiness could not be validated as `ready=true` from this machine because the live connectivity check fails before HTTP with `UNABLE_TO_VERIFY_LEAF_SIGNATURE`.
+
+## Validation Lane Report
+- PASS: `node --check src/dev-runtime/server/local-api-router.mjs`
+- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS: `node --check tests/playwright/tools/LoginSessionMode.spec.mjs`
+- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses|Configured account auth actions" --reporter=list`
+- PASS: `npm run test:workspace-v2`
+- FAIL: Real DEV `/api/auth/status` readiness probe with local `.env.local` values present:
+  - `selected=true`
+  - `configured=true`
+  - `localDbProductDataActive=true`
+  - `connectivityStatus=failed`
+  - `identityTablesReady=false`
+  - `ready=false`
+  - operator preflight: `Supabase Auth request failed before an HTTP status was available. (UNABLE_TO_VERIFY_LEAF_SIGNATURE)`
+
+## Playwright Impact
+- Playwright impacted: Yes.
+- Coverage report: `docs_build/dev/reports/playwright_v8_coverage_report.txt`
+- Coverage WARN: Node server runtime JS is not collected by browser V8 coverage; browser account auth JS remains covered by the focused auth Playwright run.
+
+## Manual Validation Notes
+- Fake Supabase provider validation proves:
+  - `/api/auth/status` returns `ready=true` when Auth connectivity and identity tables are reachable.
+  - Create Account provisions one app `users` row, one default `roles` row when needed, and one `user_roles` row.
+  - Sign In resolves a session using the provisioned identity record and role.
+  - Missing identity rows fail with the generic production-safe browser message.
+- Real DEV validation is blocked by local Node TLS trust, not by missing environment values. Required env presence was verified without printing secret values.
+
+## Skipped Lanes
+- Full samples smoke: SKIP. Auth identity bootstrap/provisioning does not touch samples or sample manifests.
+
+## Changed Files
+- `src/dev-runtime/server/local-api-router.mjs`
+- `tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `tests/playwright/tools/LoginSessionMode.spec.mjs`
+- Validation/report artifacts under `docs_build/dev/reports/`
+
+## Review Artifacts
+- `docs_build/dev/reports/codex_review.diff`
+- `docs_build/dev/reports/codex_changed_files.txt`

docs_build/dev/reports/codex_changed_files.txt

@@ -1,9 +1,5 @@
 # git status --short
-M account/sign-in.html
- M assets/theme-v2/js/account-auth-actions.js
- M assets/theme-v2/js/login-session.js
- M docs_build/dev/reports/coverage_changed_js_guardrail.txt
- M docs_build/dev/reports/dependency_gating_report.md
+M docs_build/dev/reports/dependency_gating_report.md
  M docs_build/dev/reports/dependency_hydration_reuse_report.md
  M docs_build/dev/reports/execution_graph_reuse_report.md
  M docs_build/dev/reports/failure_fingerprint_report.md
@@ -23,7 +19,6 @@ M account/sign-in.html
  M docs_build/dev/reports/playwright_discovery_ownership_report.md
  M docs_build/dev/reports/playwright_discovery_scope_report.md
  M docs_build/dev/reports/playwright_structure_audit.md
- M docs_build/dev/reports/playwright_v8_coverage_report.txt
  M docs_build/dev/reports/retry_suppression_report.md
  M docs_build/dev/reports/slow_path_pruning_report.md
  M docs_build/dev/reports/static_validation_report.md
@@ -35,60 +30,43 @@ M account/sign-in.html
  M docs_build/dev/reports/zero_browser_preflight_report.md
  M src/dev-runtime/server/local-api-router.mjs
  M tests/dev-runtime/SupabaseProviderContractStub.test.mjs
- M tests/playwright/tools/ApiStaticRouteRecovery.spec.mjs
  M tests/playwright/tools/LoginSessionMode.spec.mjs
- M tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs
-?? docs_build/dev/reports/PR_26166_148-supabase-auth-readiness-gate.md
-?? docs_build/dev/reports/PR_26166_149-sign-in-live-supabase-flow.md
-?? docs_build/dev/reports/PR_26166_150-create-account-live-supabase-flow.md
-?? docs_build/dev/reports/PR_26166_151-password-reset-live-supabase-flow.md
-?? docs_build/dev/reports/PR_26166_152-session-user-role-resolution.md
+?? docs_build/dev/reports/PR_26166_153-supabase-identity-bootstrap-and-provisioning.md
 
 # git ls-files --others --exclude-standard
-docs_build/dev/reports/PR_26166_148-supabase-auth-readiness-gate.md
-docs_build/dev/reports/PR_26166_149-sign-in-live-supabase-flow.md
-docs_build/dev/reports/PR_26166_150-create-account-live-supabase-flow.md
-docs_build/dev/reports/PR_26166_151-password-reset-live-supabase-flow.md
-docs_build/dev/reports/PR_26166_152-session-user-role-resolution.md
+docs_build/dev/reports/PR_26166_153-supabase-identity-bootstrap-and-provisioning.md
 
 # git diff --stat
-account/sign-in.html                               |   4 +-
- assets/theme-v2/js/account-auth-actions.js         |  11 +-
- assets/theme-v2/js/login-session.js                |  17 +-
- .../dev/reports/coverage_changed_js_guardrail.txt  |   6 +-
- docs_build/dev/reports/dependency_gating_report.md |   2 +-
- .../reports/dependency_hydration_reuse_report.md   |   4 +-
- .../dev/reports/execution_graph_reuse_report.md    |   4 +-
+docs_build/dev/reports/dependency_gating_report.md |   2 +-
+ .../reports/dependency_hydration_reuse_report.md   |  12 +-
+ .../dev/reports/execution_graph_reuse_report.md    |  16 +-
  .../dev/reports/failure_fingerprint_report.md      |   2 +-
  .../reports/filesystem_scan_reduction_report.md    |   2 +-
- .../dev/reports/incremental_validation_report.md   |   2 +-
+ .../dev/reports/incremental_validation_report.md   |  14 +-
  docs_build/dev/reports/lane_compilation_report.md  |   2 +-
  .../dev/reports/lane_deduplication_report.md       |   2 +-
  .../dev/reports/lane_input_validation_report.md    |   2 +-
  .../reports/lane_manifests/workspace-contract.json |  10 +-
- .../reports/lane_runtime_optimization_report.md    |   2 +-
- docs_build/dev/reports/lane_snapshot_report.md     |   4 +-
- .../reports/lane_snapshots/workspace-contract.json |  22 +-
- docs_build/dev/reports/lane_warm_start_report.md   |   4 +-
+ .../reports/lane_runtime_optimization_report.md    |  14 +-
+ docs_build/dev/reports/lane_snapshot_report.md     |  12 +-
+ .../reports/lane_snapshots/workspace-contract.json |  22 +--
+ docs_build/dev/reports/lane_warm_start_report.md   |  12 +-
  .../lane_warm_starts/workspace-contract.json       |  16 +-
  .../dev/reports/monolith_trigger_removal_report.md |   2 +-
- .../dev/reports/persistent_lane_manifest_report.md |   6 +-
+ .../dev/reports/persistent_lane_manifest_report.md |  12 +-
  .../playwright_discovery_ownership_report.md       |   2 +-
  .../reports/playwright_discovery_scope_report.md   |   2 +-
  .../dev/reports/playwright_structure_audit.md      |   2 +-
- .../dev/reports/playwright_v8_coverage_report.txt  |  48 +++-
  docs_build/dev/reports/retry_suppression_report.md |   2 +-
- docs_build/dev/reports/slow_path_pruning_report.md |  12 +-
- docs_build/dev/reports/static_validation_report.md |   4 +-
- .../dev/reports/targeted_file_manifest_report.md   |   4 +-
- .../dev/reports/test_cleanup_performance_report.md |  14 +-
+ docs_build/dev/reports/slow_path_pruning_report.md |  16 +-
+ docs_build/dev/reports/static_validation_report.md |  12 +-
+ .../dev/reports/targeted_file_manifest_report.md   |   8 +-
+ .../dev/reports/test_cleanup_performance_report.md |  22 +--
  .../dev/reports/test_cleanup_routing_report.md     |   2 +-
- .../dev/reports/testing_lane_execution_report.md   |  16 +-
- docs_build/dev/reports/validation_cache_report.md  |  30 +--
- .../dev/reports/zero_browser_preflight_report.md   |   2 +-
- src/dev-runtime/server/local-api-router.mjs        | 246 +++++++++++++++------
- .../SupabaseProviderContractStub.test.mjs          |  92 +++++---
- .../tools/ApiStaticRouteRecovery.spec.mjs          |  17 +-
- tests/playwright/tools/LoginSessionMode.spec.mjs   |  99 +++++++--
- .../tools/StaticOnlyLoginApiRequired.spec.mjs      |   4 +-
- 39 files changed, 503 insertions(+), 221 deletions(-)
+ .../dev/reports/testing_lane_execution_report.md   |  52 +++---
+ docs_build/dev/reports/validation_cache_report.md  |  30 ++--
+ .../dev/reports/zero_browser_preflight_report.md   |  10 +-
+ src/dev-runtime/server/local-api-router.mjs        | 195 ++++++++++++++++++++-
+ .../SupabaseProviderContractStub.test.mjs          | 170 ++++++++++++++++--
+ tests/playwright/tools/LoginSessionMode.spec.mjs   |  40 ++++-
+ 32 files changed, 538 insertions(+), 181 deletions(-)