Execute approved creator platform implementation stack from PLAN_PR source of truth - PR_26169_001-creator-platform-foundation

Author: ToolboxAid

.env.example

@@ -1,4 +1,5 @@
 # Game Foundry Studio local development environment
+# ENVIRONMENT
 
 # Configure the runtime auth and database connections here.
 # Missing connection configuration reports diagnostics instead of falling back.
@@ -40,6 +41,7 @@ GAMEFOUNDRY_DB_BACKUP_DIR=
 # Browser uploads must go through the server API and must not receive these secrets.
 GAMEFOUNDRY_STORAGE_ENDPOINT=
 GAMEFOUNDRY_STORAGE_ACCESS_KEY_ID=
+
 GAMEFOUNDRY_STORAGE_SECRET_ACCESS_KEY=
 GAMEFOUNDRY_STORAGE_BUCKET=
 GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX=

docs_build/dev/codex_commands.md

@@ -1,2 +1,12 @@
-PR_26169_auth-preview-signin-regression
-Fix preview sign-in fallback blocking Supabase authentication.
+PR_26169_002-auth-preview-signin-regression
+
+Summary:
+- Reject malformed selected preview user keys before identity-table lookup.
+- Preserve persisted users/roles/user_roles session resolution for valid preview users.
+- Add targeted contract coverage for malformed keys, logout cleanup, Creator/Admin/Owner role states, missing users, and missing roles.
+
+Validation:
+- node --check src/dev-runtime/server/local-api-router.mjs
+- node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs
+- node --test --test-name-pattern "malformed|Creator Admin and Owner|missing user and missing role" tests/dev-runtime/SupabaseProviderContractStub.test.mjs
+- git diff --check -- src/dev-runtime/server/local-api-router.mjs tests/dev-runtime/SupabaseProviderContractStub.test.mjs docs_build/pr/BUILD_PR_26169_002-auth-preview-signin-regression.md

docs_build/dev/commit_comment.txt

@@ -0,0 +1,63 @@
+# PR_26169_002-auth-preview-signin-regression Report
+
+## Scope
+- PR: `PR_26169_002-auth-preview-signin-regression`
+- Source PLAN: `docs_build/pr/PLAN_PR_26169_002-auth-preview-signin-regression.md`
+- Approved business model dependency: `docs_build/pr/PLAN_PR_26169_001-creator-platform-foundation.md`
+- BUILD doc: `docs_build/pr/BUILD_PR_26169_002-auth-preview-signin-regression.md`
+
+## Branch Validation
+- Current branch: `main`
+- Expected branch: `main`
+- Local branches found: `main`
+- Result: PASS
+
+## Requirement Checklist
+- Read `docs_build/dev/PROJECT_INSTRUCTIONS.md`: PASS
+- Read source PLAN docs before implementation: PASS
+- Create BUILD_PR before implementation: PASS
+- Implement only PR_26169_002 purpose: PASS
+- Preserve public sign-in page and avoid public Local DB controls: PASS
+- Resolve preview users through persisted `users`, `roles`, and `user_roles` records: PASS
+- Keep Creator, Admin, and Owner role states distinguishable/testable: PASS
+- Return actionable diagnostics for malformed selected user keys: PASS
+- Preserve existing missing user and missing role diagnostics: PASS
+- Keep sign-out cleanup scoped to selected session state: PASS
+- Do not add membership, marketplace, AI credit, team, or legal behavior: PASS
+- No Playwright/runtime broad validation: PASS, not required for this API/dev-runtime scoped PR
+
+## Implementation Summary
+- Exported `sessionUserFromIdentityTables` for targeted contract coverage.
+- Trimmed selected preview user keys before persisting session state.
+- Rejected malformed non-empty selected user keys before database lookup, returning an actionable diagnostic instead of a silent Guest fallback or database-read diagnostic.
+- Preserved valid selected-user resolution through persisted identity tables.
+- Added targeted tests for malformed selected keys, logout cleanup after invalid preview state, Creator/Admin/Owner role resolution, missing users, and missing referenced roles.
+
+## Validation
+- `node --check src/dev-runtime/server/local-api-router.mjs`: PASS
+- `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS
+- `node --test --test-name-pattern "malformed|Creator Admin and Owner|missing user and missing role" tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS
+- `git diff --check -- src/dev-runtime/server/local-api-router.mjs tests/dev-runtime/SupabaseProviderContractStub.test.mjs docs_build/pr/BUILD_PR_26169_002-auth-preview-signin-regression.md`: PASS
+  - Note: Git reported Windows line-ending warnings for touched tracked JS files; no whitespace errors were reported.
+
+## Lanes
+- Impacted lane: contract/runtime auth preview session lane under `src/dev-runtime/`.
+- Skipped lanes: Playwright, full runtime server suite, integration, engine, samples.
+- Skip rationale: PR touches server-side dev-runtime auth/session resolution and targeted contract coverage only; no browser UI, engine, sample, or broad product-data behavior was changed.
+- Full suite requirement: Not triggered by this PR scope.
+
+## Acceptance Criteria Evidence
+- Creator preview/session role state: PASS via targeted resolver test.
+- Admin preview/session role state: PASS via targeted resolver test.
+- Owner preview/session role state: PASS via targeted resolver test.
+- Missing selected user diagnostic: PASS via targeted resolver test preserving existing message family.
+- Missing referenced role diagnostic: PASS via targeted resolver test preserving existing message family.
+- Malformed selected user key diagnostic: PASS via route-level test.
+- Sign-out/session clear behavior: PASS via route-level logout assertion after malformed selected state.
+- No business-model data in auth session state: PASS, no pricing/limits/credits/marketplace data added.
+
+## Artifacts
+- Changed files list: `docs_build/dev/reports/codex_changed_files.txt`
+- Review diff: `docs_build/dev/reports/codex_review.diff`
+- ZIP artifact: `tmp/PR_26169_002-auth-preview-signin-regression_delta.zip`
+- ZIP validation: PASS, size > 0, contains repo-relative changed files and reports.

docs_build/dev/reports/PR_26169_002-auth-preview-signin-regression.md

@@ -1,33 +1,8 @@
-# Codex Changed Files
-
-## PR Scope
-- PLAN-only documentation stack for PR_26169 creator platform foundation.
-- No runtime files changed.
-- No Playwright files changed.
-
-## Files
-- docs_build/pr/PLAN_PR_26169_001-creator-platform-foundation.md
-- docs_build/pr/PLAN_PR_26169_002-auth-preview-signin-regression.md
-- docs_build/pr/PLAN_PR_26169_003-beta-invitations-admin.md
-- docs_build/pr/PLAN_PR_26169_004-membership-data-model.md
-- docs_build/pr/PLAN_PR_26169_005-membership-assignment.md
-- docs_build/pr/PLAN_PR_26169_006-memberships-page-v2.md
-- docs_build/pr/PLAN_PR_26169_007-ai-credit-foundation.md
-- docs_build/pr/PLAN_PR_26169_008-ai-credit-display.md
-- docs_build/pr/PLAN_PR_26169_009-marketplace-membership-rules.md
-- docs_build/pr/PLAN_PR_26169_010-marketplace-revenue-model.md
-- docs_build/pr/PLAN_PR_26169_011-marketplace-categories.md
-- docs_build/pr/PLAN_PR_26169_012-teams-foundation.md
-- docs_build/pr/PLAN_PR_26169_013-team-enforcement.md
-- docs_build/pr/PLAN_PR_26169_014-legal-foundation.md
-- docs_build/pr/PLAN_PR_26169_015-terms-of-service.md
-- docs_build/pr/PLAN_PR_26169_016-privacy-cookies-community-copyright-dmca.md
-- docs_build/pr/PLAN_PR_26169_017-owner-memberships.md
-- docs_build/pr/PLAN_PR_26169_018-owner-ai-credits.md
-- docs_build/pr/PLAN_PR_26169_019-admin-health-operations.md
-- docs_build/dev/reports/codex_review.diff
-- docs_build/dev/reports/codex_changed_files.txt
-- docs_build/dev/reports/pr_stack_summary.md
-
-## Artifact
-- tmp/PR_26169_plan_stack_delta.zip
+docs_build/dev/codex_commands.md
+docs_build/dev/commit_comment.txt
+docs_build/dev/reports/PR_26169_002-auth-preview-signin-regression.md
+docs_build/dev/reports/codex_changed_files.txt
+docs_build/dev/reports/codex_review.diff
+docs_build/pr/BUILD_PR_26169_002-auth-preview-signin-regression.md
+src/dev-runtime/server/local-api-router.mjs
+tests/dev-runtime/SupabaseProviderContractStub.test.mjs