Package PR035 DEV auth user key authority

Author: ToolboxAid

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md

@@ -1,34 +1,10 @@
-# Branch Validation: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+# PR_26179_OWNER_035-dev-auth-user-key-db-authority Branch Validation
 
-## Status
-
-PASS
-
-## Branch
+Status: PASS
 
 - Current branch: `PR_26179_OWNER_035-dev-auth-user-key-db-authority`
-- Source branch: `main`
-- Worktree at report time: modified files only for this PR plus generated report artifacts
-
-## Validation Commands
-
-- PASS `node --check src/dev-runtime/server/local-api-router.mjs`
-- PASS `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
-- PASS `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
-- PASS `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
-- PASS `node --check src/dev-runtime/toolbox-api/alfa-tool-services.mjs`
-- PASS `node --check dev/scripts/sync-supabase-dev-creator-identities.mjs`
-- PASS `node --check dev/tests/dev-runtime/TagsApiService.test.mjs`
-- PASS `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
-- PASS `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
-- PASS `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`
-- PASS `git diff --check`
-- PASS `npm run validate:canonical-structure`
-
-## DEV Identity Verification
-
-- PASS `qbytes.dq@gmail.com` exists in Supabase Auth.
-- PASS `qbytes.dq@gmail.com` exists in product `users`.
-- PASS `users.authProviderUserId` matches Supabase Auth id.
-- PASS DEV identity sync ran with password updates disabled.
-- PASS `/api/auth/sign-in` resolves qbytes to the database `users.key`.
+- Base branch: `main`
+- Rebased onto latest synchronized main: PASS
+- Worktree clean before validation: PASS
+- Main excludes the fix until PR merge: PASS
+- Branch ready to push/open PR: PASS

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md

@@ -1,16 +1,17 @@
-# Manual Validation Notes: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+# PR_26179_OWNER_035-dev-auth-user-key-db-authority Manual Validation Notes
 
-Manual browser validation was not run because this PR changes server-side auth/session resolution and DEV identity sync behavior. The targeted API-level tests and live API sign-in smoke cover the affected user-visible outcomes:
+Status: READY FOR OWNER VALIDATION
 
-- A valid Supabase Auth id linked to `users.authProviderUserId` signs in and returns the database-owned `users.key`.
-- A matching email with stale `users.authProviderUserId` does not sign in and returns the existing Creator-safe identity setup message.
-- The browser response does not expose raw Auth ids or database user keys on the failure path.
+Manual checks after merge:
 
-Live DEV notes:
+1. Run the approved DEV identity sync against DEV.
+2. Confirm `qbytes.dq@gmail.com` exists in Supabase Auth.
+3. Confirm `qbytes.dq@gmail.com` exists in the product `users` table.
+4. Confirm product `users.authProviderUserId` equals Supabase Auth `auth.users.id`.
+5. Sign in as `qbytes.dq@gmail.com` without changing password.
+6. Confirm the resolved session uses the database `users.key`.
 
-- Initial audit found Supabase Auth present but product `users` missing for `qbytes.dq@gmail.com`.
-- The missing database row was caused by a toolbox helper upserting seed users over the reserved account keys.
-- The helper was fixed so toolbox seeding no longer upserts `users`.
-- The approved DEV account DML restored the missing rows.
-- DEV identity sync ran with password updates disabled.
-- Final `/api/auth/sign-in` smoke for `qbytes.dq@gmail.com` passed and resolved to the database `users.key`.
+Packaging note:
+
+- Read-only pre-package verification found the Auth user present but the product users row missing on the current DEV target.
+- The mutating DEV identity sync was intentionally not run during this package/push step.

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md

@@ -1,30 +1,36 @@
-# PR_26179_OWNER_035-dev-auth-user-key-db-authority
+# PR_26179_OWNER_035-dev-auth-user-key-db-authority
 
 ## Summary
 
 This PR makes DEV account session resolution treat the database `users` row as authoritative.
 
-Runtime sign-in now resolves a session only when the Supabase Auth user id matches `users.authProviderUserId`. Matching by email alone is no longer accepted for login/session resolution. Email remains valid only for the DEV identity sync step that locates the existing database `users` row before writing the real Supabase Auth id back to `users.authProviderUserId`.
+Runtime sign-in now resolves a session only when the Supabase Auth user id matches `users.authProviderUserId`. Matching by email alone is not accepted for login/session resolution. Email remains valid only for the approved DEV identity sync step that locates the existing database `users` row before writing the real Supabase Auth id back to `users.authProviderUserId`.
+
+## Branch Status
+
+- Source branch: `PR_26179_OWNER_035-dev-auth-user-key-db-authority`
+- Base branch: `main`
+- Rebased onto main HEAD: `13cbe98955c1bcc014bff07480b7d3399386e72f`
+- Main still excludes this fix until PR merge: yes
 
 ## Diagnostic Findings
 
-### Where `users.key` currently comes from
+### Where `users.key` comes from
 
-- DEV seed setup defines static user keys in `src/dev-runtime/seed/seed-db-keys.mjs`.
-- Current database seed DML also contains DEV account rows under `dev/build/database/dml/account.sql`.
-- Before this PR, `src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs` imported those seed keys and used them as the canonical keys during DEV Supabase identity sync.
-- After this PR, DEV sync locates existing `users` rows by email and reads `users.key` from the database row. The sync no longer imports `SEED_DB_KEYS`.
+- DEV seed setup still defines static fixture keys in `src/dev-runtime/seed/seed-db-keys.mjs` for seed/bootstrap data.
+- Before this PR, DEV Supabase identity sync used those seed constants as the authoritative app user keys.
+- After this PR, DEV sync locates existing database `users` rows by email and reads `users.key` from the database row. Missing or duplicate database rows are explicit setup errors.
 
 ### Where `authProviderUserId` is populated
 
-- Account creation provisioning still writes `authProviderUserId` in `src/dev-runtime/server/local-api-router.mjs` through `provisionSupabaseIdentityForAuthPayload()`.
-- DEV identity sync now reads `auth.users.id` from Supabase Auth, reads `users.key` from the database row found by email, and sends that database-owned key plus the real Auth id through `databaseProvider.initializeIdentity()`.
+- Account provisioning continues to write `authProviderUserId` in `src/dev-runtime/server/local-api-router.mjs` through the API/server path.
+- DEV identity sync reads Supabase Auth `auth.users.id`, reads the existing product `users.key` from the database row found by email, then writes the real Auth id to `users.authProviderUserId`.
 
-### Seed constant use
+### Runtime resolution
 
-- Seed constants remain valid for DEV seed setup, seed fixtures, and existing test/demo data.
-- They are no longer used by the DEV identity sync helper as the authoritative app user key source.
-- Runtime sign-in/session resolution does not hardcode DavidQ or other user keys. It reads identity tables and resolves `matchingUser.key` after matching Supabase Auth id to `users.authProviderUserId`.
+- Supabase sign-in/session resolution now requires an active product `users` row whose `authProviderUserId` equals the Supabase Auth user id.
+- If Auth succeeds but the product row is not linked, the API returns a controlled setup message directing the operator to run the approved DEV identity sync.
+- Runtime login no longer hardcodes DavidQ/user keys and no longer uses display name as an identity key.
 
 ## Exact Fix
 
@@ -33,61 +39,43 @@ Runtime sign-in now resolves a session only when the Supabase Auth user id match
 - Added a narrow server-side Postgres client injection hook for tests, with default runtime behavior unchanged.
 - Refactored DEV creator identity sync so canonical identity definitions are email-based and database `users.key` is read from existing rows.
 - Changed role assignment and cleanup repair logic to derive canonical user keys from database rows.
-- Removed the Alfa toolbox tag/design/configuration helper behavior that upserted seed `users` rows over the static DEV account keys.
-- Changed the DEV identity sync default so existing Supabase Auth users are updated without sending a password. Password updates now require an explicit `--update-passwords` flag.
-- Added regression tests proving:
-  - Sign-in uses the database-owned `users.key` matched by `authProviderUserId`.
-  - Sign-in does not create a session from matching email when `authProviderUserId` is stale.
-  - DEV sync preserves non-seed database user keys.
-  - DEV sync fails if an expected database `users` row is missing.
-  - Tags API seeding does not upsert rows into `users`.
-  - Existing Auth user sync does not send a password by default.
-
-## DEV Database Verification
-
-Performed against the current `.env` DEV database target.
+- Removed the Alfa toolbox tag/design/configuration helper behavior that upserted seed `users` rows over DEV account keys.
+- Changed the DEV identity sync default so existing Supabase Auth users are updated without sending a password. Password updates now require explicit `--update-passwords`.
+- Added regression tests for auth id matching, stale authProviderUserId handling, existing database key preservation, missing database rows, Tags API seeding not modifying `users`, and password-safe sync defaults.
 
-Initial audit:
+## Current DEV Data Note
 
-- `qbytes.dq@gmail.com` existed in Supabase Auth.
-- `qbytes.dq@gmail.com` was missing from the product `users` table.
-- The reserved static DEV account keys for User 1 and DavidQ had been overwritten by seed `Creator` / `Forge Bot` rows.
+Read-only verification before packaging found:
 
-Repair and sync:
+- `qbytes.dq@gmail.com` exists in Supabase Auth.
+- `qbytes.dq@gmail.com` is currently missing from the product `users` table.
+- Therefore `users.authProviderUserId` is not synced for that account yet.
 
-- Re-applied the approved DEV account DML to restore the missing database identity rows.
-- Ran the DEV identity sync with `updatePasswords: false`.
-- qbytes sync action: `updated`.
-- qbytes password update: `false`.
-
-Final audit:
-
-- Supabase Auth match count: `1`.
-- Product `users` match count: `1`.
-- `users.authProviderUserId` equals Supabase Auth `auth.users.id`: PASS.
-- Sign-in smoke through `/api/auth/sign-in`: PASS.
-- Session resolved to the database `users.key`: PASS.
+The mutating DEV identity sync was not run during this package/push step. Next action after this PR is merged: run the approved DEV identity sync against the current DEV database, then re-test sign-in.
 
 ## Files Changed
 
-- `src/dev-runtime/server/local-api-router.mjs`
-- `src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
-- `dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
-- `dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- `src/dev-runtime/server/local-api-router.mjs` - updated
+- `src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs` - updated
+- `src/dev-runtime/toolbox-api/alfa-tool-services.mjs` - updated
+- `dev/scripts/sync-supabase-dev-creator-identities.mjs` - updated
+- `dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs` - updated
+- `dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs` - updated
+- `dev/tests/dev-runtime/TagsApiService.test.mjs` - updated
 
 ## Validation
 
 PASS:
 
+- `git diff --check`
+- `npm run validate:canonical-structure`
 - `node --check src/dev-runtime/server/local-api-router.mjs`
 - `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
-- `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
-- `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
 - `node --check src/dev-runtime/toolbox-api/alfa-tool-services.mjs`
 - `node --check dev/scripts/sync-supabase-dev-creator-identities.mjs`
+- `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
 - `node --check dev/tests/dev-runtime/TagsApiService.test.mjs`
 - `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
 - `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
 - `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`
-- `git diff --check`
-- `npm run validate:canonical-structure`

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md

@@ -1,25 +1,15 @@
-# Requirement Checklist: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+# PR_26179_OWNER_035-dev-auth-user-key-db-authority Requirement Checklist
 
-- PASS Do not use hardcoded user keys as runtime identity source.
-- PASS Use email only to locate the existing DEV `users` row during DEV identity sync.
-- PASS Read `users.key` from the database row during DEV sync.
-- PASS Read `auth.users.id` from Supabase Auth during DEV sync.
-- PASS Write `auth.users.id` into `users.authProviderUserId`.
-- PASS Login/session resolution matches Supabase Auth id to `users.authProviderUserId`.
-- PASS Do not create browser-owned auth.
-- PASS Do not create fake login.
-- PASS Do not add password tables.
-- PASS Do not use `displayName` as an identity key.
-- PASS Do not hardcode DavidQ/user keys in runtime login resolution.
-- PASS Verify qbytes exists in Supabase Auth.
-- PASS Verify qbytes exists in the product `users` table.
-- PASS Verify `users.authProviderUserId` equals Supabase Auth id.
-- PASS If the database row/link is stale, run DEV identity sync.
-- PASS Do not change password during existing Auth user sync.
-- PASS Do not recreate qbytes Auth user because it already exists.
-- PASS Do not use email fallback for session resolution.
-- PASS Re-test sign-in after sync.
-- PASS Report where `users.key` currently comes from.
-- PASS Report where `authProviderUserId` is populated.
-- PASS Report whether seed constants are setup-only or runtime identity authority.
-- PASS Report exact fix.
+Status: PASS
+
+- Database `users` row is authoritative for `users.key`: PASS
+- Runtime sign-in does not use hardcoded DavidQ/user keys: PASS
+- Runtime sign-in does not use display name as identity key: PASS
+- Supabase Auth id must match `users.authProviderUserId`: PASS
+- Email is used only by DEV identity sync to locate existing DB rows: PASS
+- DEV identity sync reads DB-owned `users.key`: PASS
+- DEV identity sync writes Auth id to `users.authProviderUserId`: PASS
+- Toolbox seed helper no longer upserts seed rows into `users`: PASS
+- Existing Auth user password is not changed by default sync: PASS
+- Required reports under `dev/reports/`: PASS
+- Repo-structured ZIP under `dev/workspace/zips/`: PASS

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md

@@ -1,21 +1,17 @@
-# Validation Lane Report: PR_26179_OWNER_035-dev-auth-user-key-db-authority
+# PR_26179_OWNER_035-dev-auth-user-key-db-authority Validation Lane Report
 
-## Lane
+Status: PASS
 
-Targeted auth and DEV identity sync validation.
+Lane: Owner auth identity authority and DEV sync guardrails.
 
-## Commands
+Coverage:
 
-- PASS `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
-- PASS `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
-- PASS `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`
-- PASS live DEV identity audit and sign-in smoke for `qbytes.dq@gmail.com`
+- Supabase session resolution requires `users.authProviderUserId` to match Auth id.
+- Stale `authProviderUserId` does not create a session by email fallback.
+- DEV identity sync requires existing product users rows and preserves DB-owned keys.
+- Tags API service seeding does not write seed user rows into `users`.
+- Canonical repository structure remains valid.
 
-## Coverage
+Not run:
 
-- DEV identity sync reads existing database `users.key` values by email.
-- DEV identity sync writes real Supabase Auth ids to `users.authProviderUserId`.
-- Existing Auth user sync does not update passwords by default.
-- Session resolution accepts only `auth.users.id` matched to `users.authProviderUserId`.
-- Email-only session resolution is rejected with the existing Creator-safe setup message.
-- Tags API setup no longer writes seed rows to the account `users` table.
+- Full workspace smoke. Not required for this package/push step; targeted auth and Tags guardrail validation passed.

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md

@@ -1,36 +1,18 @@
-# Validation Report: PR_26179_OWNER_035-dev-auth-user-key-db-authority
-
-## Result
-
-PASS
-
-## Targeted Validation
-
-- `node --check src/dev-runtime/server/local-api-router.mjs`: PASS
-- `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`: PASS
-- `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS
-- `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`: PASS
-- `node --check src/dev-runtime/toolbox-api/alfa-tool-services.mjs`: PASS
-- `node --check dev/scripts/sync-supabase-dev-creator-identities.mjs`: PASS
-- `node --check dev/tests/dev-runtime/TagsApiService.test.mjs`: PASS
-- `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`: PASS, 2 tests
-- `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS, 2 tests
-- `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`: PASS, 3 tests
-
-## Live DEV Validation
-
-- PASS Initial audit detected Supabase Auth user for `qbytes.dq@gmail.com`.
-- PASS Initial audit detected missing/stale product `users` row and halted sign-in retest.
-- PASS Approved DEV account DML restored the missing identity rows.
-- PASS DEV identity sync completed with `updatePasswords: false`.
-- PASS Final audit verified `users.authProviderUserId` equals Supabase Auth id.
-- PASS `/api/auth/sign-in` returned HTTP 200 and resolved the session to the database `users.key`.
-
-## Repository Guardrails
-
-- `git diff --check`: PASS
-- `npm run validate:canonical-structure`: PASS
-
-## Notes
-
-The targeted tests use a server-side Postgres client fixture to exercise the Local API route without opening a real database connection. Default runtime behavior remains unchanged because the injected client defaults to `null`.
+# PR_26179_OWNER_035-dev-auth-user-key-db-authority Validation Report
+
+Status: PASS
+
+Validated commands:
+
+- `git diff --check` - PASS
+- `npm run validate:canonical-structure` - PASS
+- `node --check src/dev-runtime/server/local-api-router.mjs` - PASS
+- `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs` - PASS
+- `node --check src/dev-runtime/toolbox-api/alfa-tool-services.mjs` - PASS
+- `node --check dev/scripts/sync-supabase-dev-creator-identities.mjs` - PASS
+- `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs` - PASS
+- `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs` - PASS
+- `node --check dev/tests/dev-runtime/TagsApiService.test.mjs` - PASS
+- `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs` - PASS, 2 tests
+- `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs` - PASS, 2 tests
+- `node --test dev/tests/dev-runtime/TagsApiService.test.mjs` - PASS, 3 tests