Fix DEV auth user key authority

Author: ToolboxAid

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md

@@ -0,0 +1,23 @@
+# Branch Validation: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+
+## Status
+
+PASS
+
+## Branch
+
+- Current branch: `PR_26179_OWNER_035-dev-auth-user-key-db-authority`
+- Source branch: `main`
+- Worktree at report time: modified files only for this PR plus generated report artifacts
+
+## Validation Commands
+
+- PASS `node --check src/dev-runtime/server/local-api-router.mjs`
+- PASS `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
+- PASS `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- PASS `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- PASS `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS `git diff --check`
+- PASS `npm run validate:canonical-structure`
+

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md

@@ -0,0 +1,14 @@
+# Manual Validation Notes: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+
+Manual browser validation was not run because this PR changes server-side auth/session resolution and DEV identity sync behavior. The targeted API-level tests cover the affected user-visible outcomes:
+
+- A valid Supabase Auth id linked to `users.authProviderUserId` signs in and returns the database-owned `users.key`.
+- A matching email with stale `users.authProviderUserId` does not sign in and returns the existing Creator-safe identity setup message.
+- The browser response does not expose raw Auth ids or database user keys on the failure path.
+
+Recommended manual follow-up in DEV after merge:
+
+- Run the approved DEV identity sync.
+- Sign in as `qbytes.dq@gmail.com`.
+- Confirm the session resolves to the existing database `users.key` row whose `authProviderUserId` equals the Supabase Auth user id.
+

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md

@@ -0,0 +1,61 @@
+# PR_26179_OWNER_035-dev-auth-user-key-db-authority
+
+## Summary
+
+This PR makes DEV account session resolution treat the database `users` row as authoritative.
+
+Runtime sign-in now resolves a session only when the Supabase Auth user id matches `users.authProviderUserId`. Matching by email alone is no longer accepted for login/session resolution. Email remains valid only for the DEV identity sync step that locates the existing database `users` row before writing the real Supabase Auth id back to `users.authProviderUserId`.
+
+## Diagnostic Findings
+
+### Where `users.key` currently comes from
+
+- DEV seed setup defines static user keys in `src/dev-runtime/seed/seed-db-keys.mjs`.
+- Current database seed DML also contains DEV account rows under `dev/build/database/dml/account.sql`.
+- Before this PR, `src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs` imported those seed keys and used them as the canonical keys during DEV Supabase identity sync.
+- After this PR, DEV sync locates existing `users` rows by email and reads `users.key` from the database row. The sync no longer imports `SEED_DB_KEYS`.
+
+### Where `authProviderUserId` is populated
+
+- Account creation provisioning still writes `authProviderUserId` in `src/dev-runtime/server/local-api-router.mjs` through `provisionSupabaseIdentityForAuthPayload()`.
+- DEV identity sync now reads `auth.users.id` from Supabase Auth, reads `users.key` from the database row found by email, and sends that database-owned key plus the real Auth id through `databaseProvider.initializeIdentity()`.
+
+### Seed constant use
+
+- Seed constants remain valid for DEV seed setup, seed fixtures, and existing test/demo data.
+- They are no longer used by the DEV identity sync helper as the authoritative app user key source.
+- Runtime sign-in/session resolution does not hardcode DavidQ or other user keys. It reads identity tables and resolves `matchingUser.key` after matching Supabase Auth id to `users.authProviderUserId`.
+
+## Exact Fix
+
+- Removed email fallback from Supabase sign-in session resolution.
+- Added a Creator-safe setup failure when Auth succeeds but the matching email row has not been linked to the Auth id.
+- Added a narrow server-side Postgres client injection hook for tests, with default runtime behavior unchanged.
+- Refactored DEV creator identity sync so canonical identity definitions are email-based and database `users.key` is read from existing rows.
+- Changed role assignment and cleanup repair logic to derive canonical user keys from database rows.
+- Added regression tests proving:
+  - Sign-in uses the database-owned `users.key` matched by `authProviderUserId`.
+  - Sign-in does not create a session from matching email when `authProviderUserId` is stale.
+  - DEV sync preserves non-seed database user keys.
+  - DEV sync fails if an expected database `users` row is missing.
+
+## Files Changed
+
+- `src/dev-runtime/server/local-api-router.mjs`
+- `src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
+- `dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+
+## Validation
+
+PASS:
+
+- `node --check src/dev-runtime/server/local-api-router.mjs`
+- `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
+- `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `git diff --check`
+- `npm run validate:canonical-structure`
+

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md

@@ -0,0 +1,18 @@
+# Requirement Checklist: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+
+- PASS Do not use hardcoded user keys as runtime identity source.
+- PASS Use email only to locate the existing DEV `users` row during DEV identity sync.
+- PASS Read `users.key` from the database row during DEV sync.
+- PASS Read `auth.users.id` from Supabase Auth during DEV sync.
+- PASS Write `auth.users.id` into `users.authProviderUserId`.
+- PASS Login/session resolution matches Supabase Auth id to `users.authProviderUserId`.
+- PASS Do not create browser-owned auth.
+- PASS Do not create fake login.
+- PASS Do not add password tables.
+- PASS Do not use `displayName` as an identity key.
+- PASS Do not hardcode DavidQ/user keys in runtime login resolution.
+- PASS Report where `users.key` currently comes from.
+- PASS Report where `authProviderUserId` is populated.
+- PASS Report whether seed constants are setup-only or runtime identity authority.
+- PASS Report exact fix.
+

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md

@@ -0,0 +1,18 @@
+# Validation Lane Report: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+
+## Lane
+
+Targeted auth and DEV identity sync validation.
+
+## Commands
+
+- PASS `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- PASS `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+
+## Coverage
+
+- DEV identity sync reads existing database `users.key` values by email.
+- DEV identity sync writes real Supabase Auth ids to `users.authProviderUserId`.
+- Session resolution accepts only `auth.users.id` matched to `users.authProviderUserId`.
+- Email-only session resolution is rejected with the existing Creator-safe setup message.
+

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md

@@ -0,0 +1,24 @@
+# Validation Report: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+
+## Result
+
+PASS
+
+## Targeted Validation
+
+- `node --check src/dev-runtime/server/local-api-router.mjs`: PASS
+- `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`: PASS
+- `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS
+- `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`: PASS
+- `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`: PASS, 2 tests
+- `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS, 2 tests
+
+## Repository Guardrails
+
+- `git diff --check`: PASS
+- `npm run validate:canonical-structure`: PASS
+
+## Notes
+
+The targeted tests use a server-side Postgres client fixture to exercise the Local API route without opening a real database connection. Default runtime behavior remains unchanged because the injected client defaults to `null`.
+

dev/reports/codex_changed_files.txt

@@ -1,98 +1,26 @@
-# Alfa Objects Stack EOD Changed Files
+# git status --short
+M dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs
+ M dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs
+ M src/dev-runtime/server/local-api-router.mjs
+ M src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs
+?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md
+?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md
+?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md
+?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md
+?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md
+?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md
 
-Base before Objects stack: 13ed907456492612adce750a434b52058301bbf5
-Objects stack merge head: 54b4c4a894e8e6ddf75d8dabdda0cc0f87f92a51
-Current branch during report: main
-main...origin/main during report: 0	0
+# git ls-files --others --exclude-standard
+dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md
+dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md
+dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md
+dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md
+dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md
+dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md
 
-# Merged PRs
-- PR_26179_ALFA_011-objects-manager-mvp: a2da07a84adea589a22b05ed8985bdcf7d5806db Merge PR_26179_ALFA_011 Objects Manager MVP
-- PR_26179_ALFA_012-objects-properties-mvp: 76ef2bcfff8a8fb0a3949901dc32a090593a4480 Merge PR_26179_ALFA_012 Object Properties MVP
-- PR_26179_ALFA_013-objects-asset-links: 22464cc322f6d8c2721124dd1ca30d13f0adc8cf Merge PR_26179_ALFA_013 Objects Asset Links
-- PR_26179_ALFA_014-objects-journey-readiness: 54b4c4a894e8e6ddf75d8dabdda0cc0f87f92a51 Merge PR_26179_ALFA_014 Objects Journey Readiness
-
-# git status --short before report refresh
-M dev/reports/codex_review.diff
-
-# git diff --name-status 13ed907456492612adce750a434b52058301bbf5..54b4c4a894e8e6ddf75d8dabdda0cc0f87f92a51
-M	assets/toolbox/game-journey/js/index.js
-M	assets/toolbox/objects/js/index.js
-A	dev/reports/PR_26179_ALFA_011-objects-manager-mvp_branch-validation.md
-A	dev/reports/PR_26179_ALFA_011-objects-manager-mvp_manual-validation-notes.md
-A	dev/reports/PR_26179_ALFA_011-objects-manager-mvp_report.md
-A	dev/reports/PR_26179_ALFA_011-objects-manager-mvp_requirement-checklist.md
-A	dev/reports/PR_26179_ALFA_011-objects-manager-mvp_validation-lane.md
-A	dev/reports/PR_26179_ALFA_011-objects-manager-mvp_validation-report.md
-A	dev/reports/PR_26179_ALFA_012-objects-properties-mvp_branch_validation.md
-A	dev/reports/PR_26179_ALFA_012-objects-properties-mvp_manual_validation_notes.md
-A	dev/reports/PR_26179_ALFA_012-objects-properties-mvp_report.md
-A	dev/reports/PR_26179_ALFA_012-objects-properties-mvp_requirement_checklist.md
-A	dev/reports/PR_26179_ALFA_012-objects-properties-mvp_validation_lane.md
-A	dev/reports/PR_26179_ALFA_012-objects-properties-mvp_validation_report.md
-A	dev/reports/PR_26179_ALFA_013-objects-asset-links_branch_validation.md
-A	dev/reports/PR_26179_ALFA_013-objects-asset-links_manual_validation_notes.md
-A	dev/reports/PR_26179_ALFA_013-objects-asset-links_report.md
-A	dev/reports/PR_26179_ALFA_013-objects-asset-links_requirement_checklist.md
-A	dev/reports/PR_26179_ALFA_013-objects-asset-links_validation_lane.md
-A	dev/reports/PR_26179_ALFA_013-objects-asset-links_validation_report.md
-A	dev/reports/PR_26179_ALFA_014-objects-journey-readiness_branch_validation.md
-A	dev/reports/PR_26179_ALFA_014-objects-journey-readiness_eod_report.md
-A	dev/reports/PR_26179_ALFA_014-objects-journey-readiness_manual_validation_notes.md
-A	dev/reports/PR_26179_ALFA_014-objects-journey-readiness_report.md
-A	dev/reports/PR_26179_ALFA_014-objects-journey-readiness_requirement_checklist.md
-A	dev/reports/PR_26179_ALFA_014-objects-journey-readiness_validation_lane.md
-A	dev/reports/PR_26179_ALFA_014-objects-journey-readiness_validation_report.md
-A	dev/reports/PR_26179_ALFA_objects-stack_product-owner-review-notes.md
-M	dev/reports/codex_changed_files.txt
-M	dev/reports/codex_review.diff
-M	dev/reports/coverage_changed_js_guardrail.txt
-M	dev/reports/playwright_v8_coverage_report.txt
-A	dev/tests/dev-runtime/ObjectsApiService.test.mjs
-M	dev/tests/playwright/tools/GameJourneyTool.spec.mjs
-M	dev/tests/playwright/tools/ObjectsTool.spec.mjs
-M	src/dev-runtime/server/local-api-router.mjs
-M	src/dev-runtime/toolbox-api/alfa-tool-services.mjs
-M	toolbox/game-journey/index.html
-M	toolbox/objects/index.html
-
-# git diff --stat 13ed907456492612adce750a434b52058301bbf5..54b4c4a894e8e6ddf75d8dabdda0cc0f87f92a51
-assets/toolbox/game-journey/js/index.js            | 285 +++++-
- assets/toolbox/objects/js/index.js                 | 598 ++++++++++++-
- ...FA_011-objects-manager-mvp_branch-validation.md |  10 +
- ...-objects-manager-mvp_manual-validation-notes.md |  19 +
- ...PR_26179_ALFA_011-objects-manager-mvp_report.md |  39 +
- ...11-objects-manager-mvp_requirement-checklist.md |  16 +
- ...ALFA_011-objects-manager-mvp_validation-lane.md |  17 +
- ...FA_011-objects-manager-mvp_validation-report.md |  19 +
- ...012-objects-properties-mvp_branch_validation.md |  26 +
- ...jects-properties-mvp_manual_validation_notes.md |  22 +
- ...26179_ALFA_012-objects-properties-mvp_report.md |  40 +
- ...objects-properties-mvp_requirement_checklist.md |  23 +
- ...A_012-objects-properties-mvp_validation_lane.md |  23 +
- ...012-objects-properties-mvp_validation_report.md |  18 +
- ...FA_013-objects-asset-links_branch_validation.md |  27 +
- ...-objects-asset-links_manual_validation_notes.md |  24 +
- ...PR_26179_ALFA_013-objects-asset-links_report.md |  41 +
- ...13-objects-asset-links_requirement_checklist.md |  15 +
- ...ALFA_013-objects-asset-links_validation_lane.md |  23 +
- ...FA_013-objects-asset-links_validation_report.md |  16 +
- ...-objects-journey-readiness_branch_validation.md |  24 +
- ...LFA_014-objects-journey-readiness_eod_report.md |  27 +
- ...ts-journey-readiness_manual_validation_notes.md |  14 +
- ...79_ALFA_014-objects-journey-readiness_report.md |  34 +
- ...ects-journey-readiness_requirement_checklist.md |  17 +
- ...14-objects-journey-readiness_validation_lane.md |  20 +
- ...-objects-journey-readiness_validation_report.md |  19 +
- ...LFA_objects-stack_product-owner-review-notes.md |  87 ++
- dev/reports/codex_changed_files.txt                |  55 +-
- dev/reports/codex_review.diff                      | 988 ++++++++++++++++++++-
- dev/reports/coverage_changed_js_guardrail.txt      |   4 +-
- dev/reports/playwright_v8_coverage_report.txt      |  31 +-
- dev/tests/dev-runtime/ObjectsApiService.test.mjs   | 224 +++++
- .../playwright/tools/GameJourneyTool.spec.mjs      |  94 ++
- dev/tests/playwright/tools/ObjectsTool.spec.mjs    | 211 ++++-
- src/dev-runtime/server/local-api-router.mjs        |  14 +-
- src/dev-runtime/toolbox-api/alfa-tool-services.mjs | 417 +++++++++
- toolbox/game-journey/index.html                    |  21 +
- toolbox/objects/index.html                         |  53 ++
- 39 files changed, 3601 insertions(+), 54 deletions(-)
+# git diff --stat
+.../SupabaseDevCreatorIdentitySeedSync.test.mjs    | 188 ++++++++++++++-------
+ .../SupabaseProviderContractStub.test.mjs          | 138 ++++++++++++++-
+ src/dev-runtime/server/local-api-router.mjs        |  24 ++-
+ .../supabase-dev-creator-identity-seed-sync.mjs    | 155 +++++++++++------
+ 4 files changed, 391 insertions(+), 114 deletions(-)