Route auth status through backend contract with production-safe unavailable messaging - PR_26166_142-auth-status-backend-contract

Author: ToolboxAid

account/create-account.html

@@ -5,7 +5,7 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>Create Account - GameFoundryStudio</title>
-    <meta name="description" content="Create a GameFoundryStudio account through configured DEV Supabase Auth.">
+    <meta name="description" content="Create a GameFoundryStudio account through the configured account provider.">
     <link rel="icon" href="/favicon.svg">
     <link rel="stylesheet" href="../assets/theme-v2/css/theme.css">
 </head>
@@ -17,7 +17,7 @@
             <div class="container">
                 <div class="kicker">Account</div>
                 <h1>Create Account</h1>
-                <p class="lede">Create an account through external DEV Supabase Auth when it is configured.</p>
+                <p class="lede">Create an account through the configured account provider.</p>
             </div>
         </section>
         <section class="section">
@@ -28,14 +28,14 @@ <h1>Create Account</h1>
                             <div class="kicker">Account Access</div>
                             <h2>Create Account</h2>
                         </div>
-                        <p>Account creation is handled by external Supabase Auth when the DEV provider is configured.</p>
+                        <p>Account creation is handled by the configured account provider.</p>
                         <form class="content-stack" data-account-auth-form="create-account">
                             <label for="createAccountEmail">Email</label>
                             <input id="createAccountEmail" name="email" type="email" autocomplete="email" data-account-auth-email>
                             <label for="createAccountPassword">Password</label>
                             <input id="createAccountPassword" name="password" type="password" autocomplete="new-password" data-account-auth-password>
                             <button class="btn primary" type="submit" data-account-auth-submit>Create Account</button>
-                            <div class="status" role="status" data-account-auth-status>Checking DEV Supabase Auth configuration.</div>
+                            <div class="status" role="status" data-account-auth-status>Checking account availability.</div>
                         </form>
                         <div class="action-group">
                             <a class="btn btn--compact" href="sign-in.html">Back to Sign In</a>

account/password-reset.html

@@ -5,7 +5,7 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>Password Reset - GameFoundryStudio</title>
-    <meta name="description" content="Request a GameFoundryStudio password reset through configured DEV Supabase Auth.">
+    <meta name="description" content="Request a GameFoundryStudio password reset through the configured account provider.">
     <link rel="icon" href="/favicon.svg">
     <link rel="stylesheet" href="../assets/theme-v2/css/theme.css">
 </head>
@@ -17,7 +17,7 @@
             <div class="container">
                 <div class="kicker">Account</div>
                 <h1>Password Reset</h1>
-                <p class="lede">Request a password reset through external DEV Supabase Auth when it is configured.</p>
+                <p class="lede">Request a password reset through the configured account provider.</p>
             </div>
         </section>
         <section class="section">
@@ -28,12 +28,12 @@ <h1>Password Reset</h1>
                             <div class="kicker">Account Access</div>
                             <h2>Password Reset</h2>
                         </div>
-                        <p>Password reset email delivery is handled by external Supabase Auth when the DEV provider is configured.</p>
+                        <p>Password reset email delivery is handled by the configured account provider.</p>
                         <form class="content-stack" data-account-auth-form="password-reset">
                             <label for="passwordResetEmail">Email</label>
                             <input id="passwordResetEmail" name="email" type="email" autocomplete="email" data-account-auth-email>
                             <button class="btn primary" type="submit" data-account-auth-submit>Request Password Reset</button>
-                            <div class="status" role="status" data-account-auth-status>Checking DEV Supabase Auth configuration.</div>
+                            <div class="status" role="status" data-account-auth-status>Checking account availability.</div>
                         </form>
                         <div class="action-group">
                             <a class="btn btn--compact" href="sign-in.html">Back to Sign In</a>

account/sign-in.html

@@ -38,7 +38,7 @@ <h2>Welcome Back</h2>
                                 <a class="btn" href="create-account.html" data-login-create-account>Create Account</a>
                                 <a class="btn btn--compact" href="password-reset.html" data-login-lost-password>Password Reset</a>
                             </div>
-                            <div class="status" role="status" data-login-status>Checking DEV Supabase Auth configuration.</div>
+                            <div class="status" role="status" data-login-status>Checking account availability.</div>
                         </form>
                         <div class="action-group">
                             <a class="btn btn--compact" href="toolbox/index.html" data-login-continue>Continue Browsing</a>

assets/theme-v2/js/account-auth-actions.js

@@ -4,7 +4,8 @@ const passwordField = document.querySelector("[data-account-auth-password]");
 const statusField = document.querySelector("[data-account-auth-status]");
 const submitButton = document.querySelector("[data-account-auth-submit]");
 const action = form?.getAttribute("data-account-auth-form") || "";
-let supabaseStatus = null;
+const AUTH_UNAVAILABLE_MESSAGE = "The site is currently unavailable. Please try again later.";
+let authStatus = null;
 
 function setStatus(message) {
   if (statusField) {
@@ -31,47 +32,47 @@ async function readJson(response, fallbackMessage) {
     payload = null;
   }
   if (!response.ok || payload?.ok === false) {
-    throw new Error(payload?.error || fallbackMessage);
+    throw new Error(fallbackMessage);
   }
   return payload?.data || {};
 }
 
-async function requestSupabaseAuth(path, options = {}) {
-  const response = await fetch(`/api/auth/dev/supabase/${path}`, {
+async function requestAccountAuth(path, options = {}) {
+  const response = await fetch(`/api/auth/${path}`, {
     body: options.body ? JSON.stringify(options.body) : undefined,
     headers: options.body ? { "content-type": "application/json" } : undefined,
     method: options.method || "GET",
   });
-  return readJson(response, "DEV Supabase Auth API is unavailable. Start the API-backed local server.");
+  return readJson(response, AUTH_UNAVAILABLE_MESSAGE);
 }
 
 function unavailableMessage(status) {
-  return status?.message || "DEV Supabase Auth is unavailable. Configure GAMEFOUNDRY_SUPABASE_URL and GAMEFOUNDRY_SUPABASE_ANON_KEY on the local server.";
+  return status?.message || AUTH_UNAVAILABLE_MESSAGE;
 }
 
-async function refreshSupabaseStatus() {
+async function refreshAccountAuthStatus() {
   if (isStaticOnlyLocalEntrypoint()) {
-    supabaseStatus = {
+    authStatus = {
       ready: false,
-      message: "Start the DEV API server to use Supabase Auth. Guest browsing remains available.",
+      message: AUTH_UNAVAILABLE_MESSAGE,
     };
     setFormEnabled(false);
-    setStatus(supabaseStatus.message);
-    return supabaseStatus;
+    setStatus(authStatus.message);
+    return authStatus;
   }
   try {
-    supabaseStatus = await requestSupabaseAuth("status");
-    setFormEnabled(Boolean(supabaseStatus.ready));
-    setStatus(supabaseStatus.ready ? "DEV Supabase Auth is ready." : unavailableMessage(supabaseStatus));
+    authStatus = await requestAccountAuth("status");
+    setFormEnabled(Boolean(authStatus.ready));
+    setStatus(authStatus.ready ? "Account service is available." : unavailableMessage(authStatus));
   } catch (error) {
-    supabaseStatus = {
+    authStatus = {
       ready: false,
-      message: error instanceof Error ? error.message : String(error || "DEV Supabase Auth status failed."),
+      message: error instanceof Error ? error.message : AUTH_UNAVAILABLE_MESSAGE,
     };
     setFormEnabled(false);
-    setStatus(supabaseStatus.message);
+    setStatus(authStatus.message);
   }
-  return supabaseStatus;
+  return authStatus;
 }
 
 function actionEndpoint() {
@@ -86,7 +87,7 @@ function actionEndpoint() {
 
 form?.addEventListener("submit", (event) => {
   event.preventDefault();
-  Promise.resolve(supabaseStatus || refreshSupabaseStatus())
+  Promise.resolve(authStatus || refreshAccountAuthStatus())
     .then((status) => {
       if (!status?.ready) {
         setStatus(unavailableMessage(status));
@@ -96,7 +97,7 @@ form?.addEventListener("submit", (event) => {
       if (!endpoint) {
         throw new Error("Unknown account action.");
       }
-      return requestSupabaseAuth(endpoint, {
+      return requestAccountAuth(endpoint, {
         body: {
           email: emailField?.value || "",
           password: passwordField?.value || "",
@@ -106,12 +107,12 @@ form?.addEventListener("submit", (event) => {
     })
     .then((result) => {
       if (result) {
-        setStatus(result.message || "Supabase Auth action completed.");
+        setStatus(result.message || "Account action completed.");
       }
     })
     .catch((error) => {
-      setStatus(error instanceof Error ? error.message : String(error || "Supabase Auth action failed."));
+      setStatus(error instanceof Error ? error.message : AUTH_UNAVAILABLE_MESSAGE);
     });
 });
 
-refreshSupabaseStatus();
+refreshAccountAuthStatus();

assets/theme-v2/js/login-session.js

@@ -3,7 +3,8 @@ const form = document.querySelector("[data-login-form]");
 const identityField = document.querySelector("[data-login-identity]");
 const passwordField = document.querySelector("[data-login-password]");
 const statusField = document.querySelector("[data-login-status]");
-let supabaseStatus = null;
+const AUTH_UNAVAILABLE_MESSAGE = "The site is currently unavailable. Please try again later.";
+let authStatus = null;
 
 function rootPrefix() {
   const rootSegments = new Set([
@@ -57,44 +58,44 @@ async function readJson(response, fallbackMessage) {
     payload = null;
   }
   if (!response.ok || payload?.ok === false) {
-    throw new Error(payload?.error || fallbackMessage);
+    throw new Error(fallbackMessage);
   }
   return payload?.data || {};
 }
 
-async function requestSupabaseAuth(path, options = {}) {
-  const response = await fetch(`/api/auth/dev/supabase/${path}`, {
+async function requestAccountAuth(path, options = {}) {
+  const response = await fetch(`/api/auth/${path}`, {
     body: options.body ? JSON.stringify(options.body) : undefined,
     headers: options.body ? { "content-type": "application/json" } : undefined,
     method: options.method || "GET",
   });
-  return readJson(response, "DEV Supabase Auth API is unavailable. Start the API-backed local server.");
+  return readJson(response, AUTH_UNAVAILABLE_MESSAGE);
 }
 
 function unavailableMessage(status) {
-  return status?.message || "DEV Supabase Auth is unavailable. Configure GAMEFOUNDRY_SUPABASE_URL and GAMEFOUNDRY_SUPABASE_ANON_KEY on the local server.";
+  return status?.message || AUTH_UNAVAILABLE_MESSAGE;
 }
 
-async function refreshSupabaseStatus() {
+async function refreshAccountAuthStatus() {
   if (isStaticOnlyLocalEntrypoint()) {
-    supabaseStatus = {
+    authStatus = {
       ready: false,
-      message: "Start the DEV API server to use Supabase Auth. Guest browsing remains available.",
+      message: AUTH_UNAVAILABLE_MESSAGE,
     };
-    setStatus(supabaseStatus.message);
-    return supabaseStatus;
+    setStatus(authStatus.message);
+    return authStatus;
   }
   try {
-    supabaseStatus = await requestSupabaseAuth("status");
-    setStatus(supabaseStatus.ready ? "DEV Supabase Auth is ready for sign-in." : unavailableMessage(supabaseStatus));
+    authStatus = await requestAccountAuth("status");
+    setStatus(authStatus.ready ? "Account service is available." : unavailableMessage(authStatus));
   } catch (error) {
-    supabaseStatus = {
+    authStatus = {
       ready: false,
-      message: error instanceof Error ? error.message : String(error || "DEV Supabase Auth status failed."),
+      message: error instanceof Error ? error.message : AUTH_UNAVAILABLE_MESSAGE,
     };
-    setStatus(supabaseStatus.message);
+    setStatus(authStatus.message);
   }
-  return supabaseStatus;
+  return authStatus;
 }
 
 if (continueLink) {
@@ -103,13 +104,13 @@ if (continueLink) {
 
 form?.addEventListener("submit", (event) => {
   event.preventDefault();
-  Promise.resolve(refreshSupabaseStatus())
+  Promise.resolve(refreshAccountAuthStatus())
     .then((status) => {
       if (!status?.ready) {
         setStatus(unavailableMessage(status));
         return null;
       }
-      return requestSupabaseAuth("sign-in", {
+      return requestAccountAuth("sign-in", {
         body: {
           identity: identityField?.value || "",
           password: passwordField?.value || "",
@@ -119,10 +120,10 @@ form?.addEventListener("submit", (event) => {
     })
     .then((result) => {
       if (result) {
-        setStatus(result.message || "Supabase Auth sign-in completed.");
+        setStatus(result.message || "Account authentication completed.");
       }
     })
     .catch((error) => {
-      setStatus(error instanceof Error ? error.message : String(error || "Supabase Auth sign-in failed."));
+      setStatus(error instanceof Error ? error.message : AUTH_UNAVAILABLE_MESSAGE);
     });
 });

docs_build/dev/reports/PR_26166_142-auth-status-backend-contract.md

@@ -0,0 +1,104 @@
+# PR_26166_142-auth-status-backend-contract
+
+## Branch Validation
+
+- Current branch: `main`
+- Expected branch: `main`
+- Result: PASS
+
+## Summary
+
+Fixed the auth status/check flow so Sign In, Create Account, and Password Reset use the shared backend contract:
+
+- `GET /api/auth/status`
+- `POST /api/auth/sign-in`
+- `POST /api/auth/create-account`
+- `POST /api/auth/password-reset`
+
+The browser no longer calls environment-specific auth routes. The Local API router decides the configured auth adapter and returns production-safe availability text to the UI when auth is missing or unavailable.
+
+Delta ZIP: `tmp/PR_26166_142-auth-status-backend-contract_delta.zip`
+
+## Requirement Checklist
+
+| Requirement | Result | Evidence |
+| --- | --- | --- |
+| Use `main` only | PASS | `git branch --show-current` returned `main`. |
+| Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` | PASS | Read before edits. |
+| Browser pages must not call environment-specific/missing API routes | PASS | `assets/theme-v2/js/login-session.js` and `assets/theme-v2/js/account-auth-actions.js` call `/api/auth/...`. |
+| Password Reset/Create Account must not show `Unknown API route` | PASS | Both pages now use `/api/auth/status`; Playwright validates the generic unavailable state. |
+| All environments call the same backend API contract | PASS | Browser calls only `/api/auth/status`, `/api/auth/sign-in`, `/api/auth/create-account`, `/api/auth/password-reset`. |
+| Backend/API decides auth/db adapter | PASS | `src/dev-runtime/server/local-api-router.mjs` resolves provider status in `authStatus()` and action adapters in `authAdapterForAction()`. |
+| Add/correct backend route handling for auth status/config availability | PASS | Added generic `/api/auth/*` route handling. |
+| Missing/unreachable backend shows production-safe message | PASS | UI and backend use `The site is currently unavailable. Please try again later.` |
+| Remove user-facing DEV wording | PASS | Account pages/auth scripts no longer contain user-facing DEV/Supabase/env wording. |
+| Do not activate product-table migration | PASS | No product-table migration changes. |
+| Do not add secrets or `.env` files | PASS | No secrets or `.env` files changed. |
+| No silent fallback | PASS | Missing/unavailable auth reports unavailable; no fallback auth path is triggered. |
+| No browser-owned auth/product data | PASS | Browser invokes backend API only; no browser-owned auth/product persistence added. |
+
+## Search Evidence
+
+- `rg -n "/api/auth/dev/supabase" account assets/theme-v2/js src/dev-runtime/server` returned no active page/script/server matches.
+- `rg -n "DEV|Supabase|GAMEFOUNDRY_|Unknown API route" account assets/theme-v2/js/login-session.js assets/theme-v2/js/account-auth-actions.js` returned no auth UI/script matches; the only output was unrelated `DEVICE_POLL_INTERVAL_MS` in `account/user-controls-page.js`.
+- `rg -n "authStatus\\(|authSignIn\\(|authCreateAccount\\(|authPasswordReset\\(" src/dev-runtime/server/local-api-router.mjs` shows generic backend auth handlers.
+- The generic `Unknown API route` server fallback remains for unrelated unknown API paths, but Create Account and Password Reset no longer call missing routes.
+
+## Changed Files
+
+- `account/sign-in.html`
+- `account/create-account.html`
+- `account/password-reset.html`
+- `assets/theme-v2/js/login-session.js`
+- `assets/theme-v2/js/account-auth-actions.js`
+- `src/dev-runtime/server/local-api-router.mjs`
+- `tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `tests/playwright/tools/LoginSessionMode.spec.mjs`
+- `tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs`
+- `tests/playwright/tools/ApiStaticRouteRecovery.spec.mjs`
+- `docs_build/dev/reports/playwright_v8_coverage_report.txt`
+- `docs_build/dev/reports/coverage_changed_js_guardrail.txt`
+- Workspace validation reports refreshed by `npm run test:workspace-v2`.
+
+## Impacted Lanes
+
+- runtime: auth/session browser and Local API route behavior.
+- integration: Sign In, Create Account, Password Reset unavailable/configured states.
+- contract: Supabase provider adapter contract stub route checks.
+
+## Skipped Lanes
+
+- samples: SKIP. The PR only changes account auth status/API contract wiring and does not touch samples or sample runtime behavior.
+- full samples smoke: SKIP per request.
+
+## Validation Performed
+
+- PASS: `node --check assets/theme-v2/js/login-session.js`
+- PASS: `node --check assets/theme-v2/js/account-auth-actions.js`
+- PASS: `node --check src/dev-runtime/server/local-api-router.mjs`
+- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs tests/playwright/tools/ApiStaticRouteRecovery.spec.mjs`
+- PASS: `npm run test:workspace-v2`
+- PASS: final targeted Playwright rerun for focused V8 coverage.
+- PASS: `git diff --check` with line-ending warnings only.
+
+## Playwright Result
+
+- PASS: 13 targeted auth/session Playwright tests passed.
+- PASS: `npm run test:workspace-v2` passed 5 workspace-contract tests.
+
+## V8 Coverage
+
+- PASS/WARN: `docs_build/dev/reports/playwright_v8_coverage_report.txt` generated.
+- `assets/theme-v2/js/account-auth-actions.js`: 92% advisory coverage.
+- `assets/theme-v2/js/login-session.js`: 93% advisory coverage.
+- `src/dev-runtime/server/local-api-router.mjs`: WARN because browser V8 does not collect server-side Node modules; covered by Node contract test and Playwright route checks.
+
+## Manual Validation Notes
+
+1. Open `account/sign-in.html`.
+2. With auth unavailable, click `Sign In`; status should show `The site is currently unavailable. Please try again later.`
+3. Open `account/create-account.html`; status should resolve through `/api/auth/status` and must not show `Unknown API route`.
+4. Open `account/password-reset.html`; status should resolve through `/api/auth/status` and must not show `Unknown API route`.
+5. With Supabase auth env configured, Sign In/Create Account/Password Reset use the external auth adapter while product data remains Local DB.