Skip to content

Commit 12242b0

Browse files
ToolboxAidToolboxAid
committed
Prepare Supabase DEV provider configuration, Auth stub, and Postgres stub while keeping Local DB active - PR_26164_121-123-supabase-dev-prep
1 parent 5e6092e commit 12242b0

10 files changed

Lines changed: 511 additions & 676 deletions

‎.env.example‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Game Foundry Studio local development environment
2+
3+
# Keep Local DB active by default. Future Supabase provider selectors stay inactive
4+
# until a dedicated adapter PR enables them.
5+
GAMEFOUNDRY_AUTH_PROVIDER=local-db
6+
GAMEFOUNDRY_DB_PROVIDER=local-db
7+
8+
# Future Supabase DEV browser-safe configuration.
9+
# Leave values empty until a reviewed Supabase DEV project exists.
10+
GAMEFOUNDRY_SUPABASE_URL=
11+
GAMEFOUNDRY_SUPABASE_ANON_KEY=
12+
13+
# Future Supabase DEV server-only configuration.
14+
# Do not expose these values to browser JavaScript, HTML, reports, or screenshots.
15+
GAMEFOUNDRY_SUPABASE_SERVICE_ROLE_KEY=
16+
GAMEFOUNDRY_SUPABASE_DATABASE_URL=

‎docs_build/dev/reports/codex_changed_files.txt‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
src/dev-runtime/auth/provider-contract-stubs.mjs
2-
src/dev-runtime/server/local-api-router.mjs
32
tests/dev-runtime/SupabaseProviderContractStub.test.mjs
4-
docs_build/dev/reports/pr120-supabase-provider-contract-stub.md
3+
docs_build/dev/reports/pr123-supabase-dev-postgres-stub.md
54
docs_build/dev/reports/playwright_v8_coverage_report.txt
65
docs_build/dev/reports/coverage_changed_js_guardrail.txt
76
docs_build/dev/reports/codex_changed_files.txt

‎docs_build/dev/reports/codex_review.diff‎

Lines changed: 0 additions & 664 deletions
Large diffs are not rendered by default.

‎docs_build/dev/reports/coverage_changed_js_guardrail.txt‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ Source: Playwright/Chromium built-in V8 coverage from the active Playwright run.
77

88
Changed runtime JS files considered:
99
(0%) src/dev-runtime/auth/provider-contract-stubs.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
10-
(0%) src/dev-runtime/server/local-api-router.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
1110

1211
Guardrail warnings:
1312
(0%) src/dev-runtime/auth/provider-contract-stubs.mjs - WARNING: changed runtime JS file missing from coverage; advisory only
14-
(0%) src/dev-runtime/server/local-api-router.mjs - WARNING: changed runtime JS file missing from coverage; advisory only

‎docs_build/dev/reports/playwright_v8_coverage_report.txt‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ Exercised tool entry points detected:
1818

1919
Changed runtime JS files covered:
2020
(0%) src/dev-runtime/auth/provider-contract-stubs.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
21-
(0%) src/dev-runtime/server/local-api-router.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only
2221

2322
Files with executed line/function counts where available:
2423
(8%) src/engine/api/session-api-client.js - executed lines 68/68; executed functions 1/12
@@ -37,9 +36,7 @@ Files with executed line/function counts where available:
3736

3837
Uncovered or low-coverage changed JS files:
3938
(0%) src/dev-runtime/auth/provider-contract-stubs.mjs - WARNING: uncovered changed runtime JS file; advisory only
40-
(0%) src/dev-runtime/server/local-api-router.mjs - WARNING: uncovered changed runtime JS file; advisory only
4139

4240
Changed JS files considered:
4341
(0%) src/dev-runtime/auth/provider-contract-stubs.mjs - changed JS file not collected as browser runtime coverage
44-
(0%) src/dev-runtime/server/local-api-router.mjs - changed JS file not collected as browser runtime coverage
4542
(0%) tests/dev-runtime/SupabaseProviderContractStub.test.mjs - changed JS file not collected as browser runtime coverage

‎docs_build/dev/reports/pr121-supabase-dev-project-preparation.md‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# PR_26164_121 Supabase DEV Project Preparation
2+
3+
## Branch Validation
4+
5+
- PASS: Current branch is `main`.
6+
- Expected branch: `main`.
7+
- Worktree before changes: clean.
8+
9+
## Scope
10+
11+
- PASS: Started from `docs_build/dev/reports/pr119-supabase-environment-checklist.md`.
12+
- PASS: Started from `docs_build/dev/reports/pr120-supabase-provider-contract-stub.md`.
13+
- PASS: Scoped to Supabase DEV project preparation only.
14+
- PASS: Supabase was not activated.
15+
- PASS: No Supabase connection code was added.
16+
- PASS: No real secrets were added.
17+
- PASS: Passwords are not stored in app tables.
18+
- PASS: Local DB remains active by default.
19+
- PASS: Sign-in behavior is unchanged.
20+
21+
## Environment Config Audit
22+
23+
- PASS: Added `.env.example`.
24+
- PASS: `.env.example` keeps `GAMEFOUNDRY_AUTH_PROVIDER=local-db`.
25+
- PASS: `.env.example` keeps `GAMEFOUNDRY_DB_PROVIDER=local-db`.
26+
- PASS: `.env.example` documents future browser-safe Supabase DEV variables with empty values:
27+
- `GAMEFOUNDRY_SUPABASE_URL`
28+
- `GAMEFOUNDRY_SUPABASE_ANON_KEY`
29+
- PASS: `.env.example` documents future server-only Supabase DEV variables with empty values:
30+
- `GAMEFOUNDRY_SUPABASE_SERVICE_ROLE_KEY`
31+
- `GAMEFOUNDRY_SUPABASE_DATABASE_URL`
32+
- PASS: Provider selection supports `local-db`, `supabase-auth`, and `supabase-postgres`.
33+
- PASS: Missing Supabase config is diagnostic only and does not block Local DB.
34+
35+
## Provider Diagnostics Audit
36+
37+
- PASS: `/api/providers/contract` remains the startup/provider diagnostics endpoint.
38+
- PASS: Endpoint reports active auth provider.
39+
- PASS: Endpoint reports active database provider.
40+
- PASS: Endpoint reports configured providers.
41+
- PASS: Endpoint reports missing future Supabase config warnings.
42+
- PASS: Endpoint reports browser-safe missing variable names for future Supabase Auth.
43+
- PASS: Endpoint does not expose server-only variable names or values.
44+
- PASS: Endpoint reports `secretValuesExposed: false`.
45+
- PASS: Local DB remains active even when future Supabase config is missing.
46+
47+
## Secrets Audit
48+
49+
- PASS: No Supabase dependency was added.
50+
- PASS: No package manifest or lockfile changed.
51+
- PASS: No real Supabase URL was committed.
52+
- PASS: No anon key, service-role key, JWT-like value, or database URL was committed.
53+
- PASS: No password table DDL was added.
54+
- PASS: No password hash, reset secret, or verification secret was added.
55+
- PASS: Test placeholders remain synthetic and are asserted not to appear in browser/API payloads.
56+
57+
## Requirement Checklist
58+
59+
- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution.
60+
- PASS: Verified current branch is `main` before making changes.
61+
- PASS: Started from PR119 and PR120 reports.
62+
- PASS: Scoped this PR to Supabase DEV project preparation only.
63+
- PASS: Did not activate Supabase.
64+
- PASS: Did not connect to Supabase.
65+
- PASS: Did not add real secrets.
66+
- PASS: Did not store passwords in app tables.
67+
- PASS: Kept Local DB active.
68+
- PASS: Added `.env.example` entries for future Supabase DEV configuration.
69+
- PASS: Documented Supabase URL, anon key, service-role key server-only, and provider selection.
70+
- PASS: Updated provider diagnostics so missing Supabase config is visible.
71+
- PASS: Provider selection supports `local-db`, `supabase-auth`, and `supabase-postgres`.
72+
- PASS: Browser/API payloads never receive service-role key values.
73+
- PASS: Startup/provider diagnostics endpoint shows active provider, configured providers, and missing config warnings.
74+
- PASS: Startup/provider diagnostics endpoint does not expose secret values.
75+
- PASS: Current Local DB provider remains active by default.
76+
- PASS: Did not change sign-in behavior.
77+
78+
## Validation
79+
80+
- PASS: `node --check src/dev-runtime/auth/provider-contract-stubs.mjs`
81+
- PASS: `node --check src/dev-runtime/server/local-api-router.mjs`
82+
- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
83+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
84+
- PASS: `npm run dev:local-api` startup validated on `127.0.0.1:5522` with `GAMEFOUNDRY_LOCAL_API_PORT=5522`.
85+
- PASS: Local API provider diagnostics returned active auth/database provider as `local-db`.
86+
- PASS: Local API provider diagnostics returned two missing future Supabase config warnings without breaking Local DB.
87+
- PASS: Local API provider diagnostics returned no secret values and no server-only variable names.
88+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs -g "Sign-in page uses a production-safe account form without public Local DB controls|Protected pages block direct URL access without the required Local session role" --project=playwright`
89+
- PASS: Playwright V8 coverage report produced.
90+
- WARN: Browser V8 coverage reports changed dev-runtime provider files as not collected by browser coverage; these Node-side diagnostics are covered by targeted Node tests.
91+
92+
## Manual Validation Notes
93+
94+
- `git diff --check`: PASS.
95+
- Runtime files changed: PASS, scoped to dev-runtime provider diagnostics.
96+
- Dependencies added: PASS, none.
97+
- Supabase dependency added: PASS, none.
98+
- Secret-pattern scan: PASS, no matches in added diff lines.
99+
- Password tables added: PASS, none.
100+
- Sign-in behavior changed: PASS, no sign-in runtime changes.
101+
- Playwright impacted: Yes, targeted sign-in and DB Viewer route-protection tests passed.
102+
- Samples smoke test: SKIP, no samples changed and PR scope is provider diagnostics/environment preparation.
103+
104+
## Required Outputs
105+
106+
- PASS: `docs_build/dev/reports/pr121-supabase-dev-project-preparation.md`
107+
- PASS: `docs_build/dev/reports/codex_review.diff`
108+
- PASS: `docs_build/dev/reports/codex_changed_files.txt`
109+
- PASS: `tmp/PR_26164_121-supabase-dev-project-preparation_delta.zip`

‎docs_build/dev/reports/pr122-supabase-dev-auth-stub.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# PR_26164_122 Supabase DEV Auth Stub
2+
3+
## Branch Validation
4+
5+
- PASS: Current branch is `main`.
6+
- Expected branch: `main`.
7+
- Started from PR121 outputs.
8+
9+
## Scope
10+
11+
- PASS: Scoped to Supabase Auth adapter stub and sign-in readiness only.
12+
- PASS: Supabase Auth was not activated by default.
13+
- PASS: Local DB does not require a Supabase project.
14+
- PASS: Password tables were not added.
15+
- PASS: Passwords are not stored in app tables.
16+
- PASS: Product data was not moved to Supabase Postgres.
17+
- PASS: Local DB remains active by default.
18+
19+
## Supabase Auth Stub Audit
20+
21+
- PASS: `SupabaseAuthProviderStub` remains behind the provider contract.
22+
- PASS: Future Auth operations exposed:
23+
- `getCurrentUser`
24+
- `signIn`
25+
- `signOut`
26+
- `createAccount`
27+
- `requestPasswordReset`
28+
- `requireRole`
29+
- PASS: Selecting `GAMEFOUNDRY_AUTH_PROVIDER=supabase-auth` without config returns `not-configured`.
30+
- PASS: Selecting `supabase-auth` without config keeps active auth provider as `local-db`.
31+
- PASS: Stub operations throw visible actionable diagnostics if called directly.
32+
- PASS: No Supabase package import exists.
33+
- PASS: No Supabase runtime client is created.
34+
35+
## Sign-In Readiness Audit
36+
37+
- PASS: Current sign-in route remains `account/sign-in.html`.
38+
- PASS: Sign-in page returns HTTP 200 through Local API.
39+
- PASS: Create Account remains production-safe because no insecure local account creation was added.
40+
- PASS: Lost Password remains production-safe because no insecure local password reset was added.
41+
- PASS: No local password behavior was introduced.
42+
- PASS: Supabase auth user id mapping is documented in the provider contract:
43+
- external provider id: `supabase.auth.user.id`
44+
- app identity key: `users.key`
45+
- owner: `server-api`
46+
- PASS: Browser-generated authoritative `users.key` values are not allowed.
47+
- PASS: Service role key values are not exposed to browser/API payloads.
48+
49+
## Secrets Audit
50+
51+
- PASS: No Supabase dependency was added.
52+
- PASS: No package manifest or lockfile changed.
53+
- PASS: No real Supabase URL was committed.
54+
- PASS: No anon key, service-role key, JWT-like value, or database URL was committed.
55+
- PASS: No custom password storage exists in the added PR122 diff.
56+
- PASS: No password hashes, reset secrets, or verification secrets were added.
57+
58+
## Requirement Checklist
59+
60+
- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution.
61+
- PASS: Verified current branch is `main` before making changes.
62+
- PASS: Started from PR121 outputs.
63+
- PASS: Scoped this PR to Supabase Auth adapter stub and sign-in readiness only.
64+
- PASS: Did not activate Supabase Auth by default.
65+
- PASS: Did not require a Supabase project to run Local DB.
66+
- PASS: Did not add password tables.
67+
- PASS: Did not store passwords in app tables.
68+
- PASS: Did not move product data to Supabase Postgres.
69+
- PASS: Kept Local DB active by default.
70+
- PASS: Added Supabase Auth provider adapter stub operations behind the provider contract.
71+
- PASS: Selected Supabase Auth without config fails visibly with actionable diagnostics.
72+
- PASS: Kept Create Account and Lost Password production-safe when Supabase is not configured.
73+
- PASS: Did not implement insecure local password behavior.
74+
- PASS: Did not use browser-generated authoritative `users.key`.
75+
- PASS: Documented Supabase auth user id mapping to `users.key`.
76+
- PASS: Did not expose service role keys to browser code.
77+
78+
## Validation
79+
80+
- PASS: `node --check src/dev-runtime/auth/provider-contract-stubs.mjs`
81+
- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
82+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
83+
- PASS: `npm run dev:local-api` startup validated on `127.0.0.1:5523` with `GAMEFOUNDRY_LOCAL_API_PORT=5523`.
84+
- PASS: Local API selected `supabase-auth` without config and returned a visible `not-configured` diagnostic.
85+
- PASS: Local API active auth/database providers remained `local-db`.
86+
- PASS: Current sign-in route opened with HTTP 200.
87+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs -g "Sign-in page uses a production-safe account form without public Local DB controls|Protected pages block direct URL access without the required Local session role" --project=playwright`
88+
- PASS: Playwright V8 coverage report produced.
89+
- WARN: Browser V8 coverage reports changed dev-runtime provider files as not collected by browser coverage; these Node-side stubs are covered by targeted Node tests.
90+
91+
## Manual Validation Notes
92+
93+
- `git diff --check`: PASS.
94+
- Runtime files changed: PASS, scoped to the dev-runtime Auth provider stub contract.
95+
- Dependencies added: PASS, none.
96+
- Supabase dependency added: PASS, none.
97+
- Secret-pattern scan: PASS, no matches in PR122 added diff lines.
98+
- Custom password storage: PASS, none added.
99+
- Sign-in behavior changed: PASS, current sign-in route still opens and placeholder form behavior remains.
100+
- Playwright impacted: Yes, targeted sign-in and DB Viewer route-protection tests passed.
101+
- Samples smoke test: SKIP, no samples changed and PR scope is Auth provider stubbing.
102+
103+
## Required Outputs
104+
105+
- PASS: `docs_build/dev/reports/pr122-supabase-dev-auth-stub.md`
106+
- PASS: `docs_build/dev/reports/codex_review.diff`
107+
- PASS: `docs_build/dev/reports/codex_changed_files.txt`
108+
- PASS: `tmp/PR_26164_122-supabase-dev-auth-stub_delta.zip`

‎docs_build/dev/reports/pr123-supabase-dev-postgres-stub.md‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
# PR_26164_123 Supabase DEV Postgres Stub
2+
3+
## Branch Validation
4+
5+
- PASS: Current branch is `main`.
6+
- Expected branch: `main`.
7+
- Started from PR121 and PR122 outputs.
8+
9+
## Scope
10+
11+
- PASS: Scoped to Supabase Postgres provider stub only.
12+
- PASS: Supabase Postgres was not activated by default.
13+
- PASS: Active data was not moved to Supabase.
14+
- PASS: No Supabase connection occurs without config.
15+
- PASS: No real secrets were added.
16+
- PASS: Local DB active behavior is unchanged.
17+
18+
## Supabase Postgres Stub Audit
19+
20+
- PASS: `SupabasePostgresProviderStub` remains behind the DB provider contract.
21+
- PASS: Future DB operations exposed:
22+
- `connect`
23+
- `getUsers`
24+
- `getRoles`
25+
- `getUserRoles`
26+
- `runSiteSetup`
27+
- `getDbViewerSnapshot`
28+
- PASS: Operations cover future `users`, `roles`, `user_roles`, Site Setup, and DB Viewer needs.
29+
- PASS: Selecting `GAMEFOUNDRY_DB_PROVIDER=supabase-postgres` without config returns `not-configured`.
30+
- PASS: Selecting `supabase-postgres` without config keeps active database provider as `local-db`.
31+
- PASS: Stub operations throw visible actionable diagnostics if called directly.
32+
- PASS: No Supabase package import exists.
33+
- PASS: No Supabase runtime client is created.
34+
- PASS: No active data migration happens.
35+
36+
## Provider Diagnostics Audit
37+
38+
- PASS: Provider contract preserves `Browser -> API/Service Contract -> Database`.
39+
- PASS: Active auth provider remains `local-db`.
40+
- PASS: Active database provider remains `local-db`.
41+
- PASS: Requested database provider reports `supabase-postgres` when selected.
42+
- PASS: Supabase Postgres status reports `not-configured` when server-only config is missing.
43+
- PASS: Server-only secret names and values are not exposed to browser/API payloads.
44+
- PASS: DB Viewer still loads from Local DB.
45+
- PASS: `dataMigrationActive` is `false`.
46+
47+
## Migration Ownership Notes
48+
49+
- PASS: UAT SQL/setup promotion remains user-controlled.
50+
- PASS: PROD SQL/setup promotion remains user-controlled.
51+
- PASS: Codex may only execute DEV setup/migration after a dedicated Supabase DEV PR.
52+
- PASS: Initial migration target after this PR is documented as:
53+
1. Supabase Auth
54+
2. Supabase `users` / `roles` / `user_roles`
55+
3. Supabase tool/product data groups
56+
57+
## Secrets Audit
58+
59+
- PASS: No Supabase dependency was added.
60+
- PASS: No package manifest or lockfile changed.
61+
- PASS: No real Supabase URL was committed.
62+
- PASS: No anon key, service-role key, JWT-like value, or database URL was committed.
63+
- PASS: No service role key is exposed to browser/API payloads.
64+
- PASS: No active data migration code was added.
65+
66+
## Requirement Checklist
67+
68+
- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution.
69+
- PASS: Verified current branch is `main` before making changes.
70+
- PASS: Started from PR121 and PR122 outputs.
71+
- PASS: Scoped this PR to Supabase Postgres provider stub only.
72+
- PASS: Did not activate Supabase Postgres by default.
73+
- PASS: Did not move active data to Supabase.
74+
- PASS: Did not connect to Supabase without config.
75+
- PASS: Did not add real secrets.
76+
- PASS: Did not change Local DB active behavior.
77+
- PASS: Added Supabase Postgres provider adapter stub behind the DB provider contract.
78+
- PASS: Adapter exposes future DB operations for identity records, Site Setup, and DB Viewer.
79+
- PASS: Selected Supabase Postgres without config fails visibly with actionable diagnostics.
80+
- PASS: Kept Local SQLite provider active by default.
81+
- PASS: Preserved Browser -> API/Service Contract -> Database.
82+
- PASS: Browser/API payloads cannot access service role keys.
83+
- PASS: Documented UAT/PROD SQL promotion remains user-controlled.
84+
- PASS: Documented Codex DEV-only execution boundary.
85+
- PASS: Documented migration target order.
86+
87+
## Validation
88+
89+
- PASS: `node --check src/dev-runtime/auth/provider-contract-stubs.mjs`
90+
- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
91+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
92+
- PASS: `npm run dev:local-api` startup validated on `127.0.0.1:5524` with `GAMEFOUNDRY_LOCAL_API_PORT=5524`.
93+
- PASS: Local API selected `supabase-postgres` without config and returned a visible `not-configured` diagnostic.
94+
- PASS: Local API active auth/database providers remained `local-db`.
95+
- PASS: DB Viewer returned HTTP 200 and rendered Local DB heading.
96+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs -g "Sign-in page uses a production-safe account form without public Local DB controls|Protected pages block direct URL access without the required Local session role" --project=playwright`
97+
- PASS: Playwright V8 coverage report produced.
98+
- WARN: Browser V8 coverage reports changed dev-runtime provider files as not collected by browser coverage; these Node-side stubs are covered by targeted Node tests.
99+
100+
## Manual Validation Notes
101+
102+
- `git diff --check`: PASS.
103+
- Runtime files changed: PASS, scoped to the dev-runtime DB provider stub contract.
104+
- Dependencies added: PASS, none.
105+
- Supabase dependency added: PASS, none.
106+
- Secret-pattern scan: PASS, no matches in PR123 added diff lines.
107+
- Active data migration: PASS, none added.
108+
- DB Viewer active data source: PASS, still Local DB.
109+
- Playwright impacted: Yes, targeted sign-in and DB Viewer route-protection tests passed.
110+
- Samples smoke test: SKIP, no samples changed and PR scope is Postgres provider stubbing.
111+
112+
## Required Outputs
113+
114+
- PASS: `docs_build/dev/reports/pr123-supabase-dev-postgres-stub.md`
115+
- PASS: `docs_build/dev/reports/codex_review.diff`
116+
- PASS: `docs_build/dev/reports/codex_changed_files.txt`
117+
- PASS: `tmp/PR_26164_123-supabase-dev-postgres-stub_delta.zip`

0 commit comments

Comments
 (0)