Continue server API migration and add Local Mem Local DB login modes - PR_26158_023-server-api-migration-pass-3-login-environments

Author: ToolboxAid

admin/db-viewer.html

@@ -5,8 +5,8 @@
     <meta charset="utf-8">
     <base href="/">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Mock DB - GameFoundryStudio</title>
-    <meta name="description" content="Admin-only read-only mock DB viewer for GameFoundryStudio project data diagnostics.">
+    <title>Local Mem DB - GameFoundryStudio</title>
+    <meta name="description" content="Admin-only read-only Local Mem DB viewer for GameFoundryStudio project data diagnostics.">
     <link rel="icon" href="/favicon.svg">
     <link rel="stylesheet" href="assets/theme-v2/css/theme.css">
 </head>
@@ -16,25 +16,25 @@
     <main data-admin-only="true">
         <section class="page-title">
             <div class="container">
-                <div class="kicker">Admin Only / Mock DB</div>
-                <h1>Mock DB</h1>
-                <p class="lede">Read-only mock DB dump for project tables, relationships, and data diagnostics.</p>
+                <div class="kicker">Admin Only / Local Mem DB</div>
+                <h1>Local Mem DB</h1>
+                <p class="lede">Read-only Local Mem DB dump for project tables, relationships, and data diagnostics.</p>
             </div>
         </section>
         <section class="section">
             <div class="container container--tool-wide">
                 <div class="tool-workspace tool-workspace--wide">
                     <aside class="tool-column tool-group-build">
                         <div class="tool-column-header">
-                            <h2>Mock DB</h2>
+                            <h2>Local Mem DB</h2>
                         </div>
                         <div class="accordion-stack">
                             <details class="vertical-accordion" open>
                                 <summary>Scope</summary>
                                 <div class="accordion-body content-stack">
-                                    <p>Current tool mock DB records are displayed as a read-only human-readable dump.</p>
+                                    <p>Current tool Local Mem DB records are displayed as a read-only human-readable dump.</p>
                                     <p>Use the diagnostics panel to confirm table attribution, relationships, and table bleed checks.</p>
-                                    <button class="btn btn--compact" type="button" data-admin-db-clear>Clear Mock DB</button>
+                                    <button class="btn btn--compact" type="button" data-admin-db-clear>Clear Local Mem DB</button>
                                 </div>
                             </details>
                         </div>
@@ -43,13 +43,13 @@ <h2>Mock DB</h2>
                     <section class="tool-center-panel content-stack" aria-labelledby="admin-db-viewer-title" data-admin-db-viewer>
                         <div class="content-cluster">
                             <div>
-                                <div class="kicker">Mock DB</div>
-                                <h2 id="admin-db-viewer-title">Mock DB</h2>
+                                <div class="kicker">Local Mem DB</div>
+                                <h2 id="admin-db-viewer-title">Local Mem DB</h2>
                             </div>
-                            <span class="status" role="status" data-admin-db-status>Loading mock DB records.</span>
+                            <span class="status" role="status" data-admin-db-status>Loading Local Mem DB records.</span>
                         </div>
-                        <div class="action-group" role="group" aria-label="Mock DB table filters" data-admin-db-filters></div>
-                        <section class="content-stack" aria-label="Mock DB tables" data-admin-db-tables></section>
+                        <div class="action-group" role="group" aria-label="Local Mem DB table filters" data-admin-db-filters></div>
+                        <section class="content-stack" aria-label="Local Mem DB tables" data-admin-db-tables></section>
                     </section>
                     <aside class="tool-column tool-group-build">
                         <div class="tool-column-header">

admin/db-viewer.js

@@ -13,7 +13,7 @@ function localModeSelected() {
     request.setRequestHeader("Accept", "application/json");
     request.send(null);
     const payload = request.responseText ? JSON.parse(request.responseText) : null;
-    return request.status >= 200 && request.status < 300 && payload?.data?.mode === "local";
+    return request.status >= 200 && request.status < 300 && payload?.data?.mode === "local-mem";
   } catch {
     return false;
   }
@@ -31,17 +31,17 @@ async function loadLocalDbViewer() {
     return;
   }
   if (!devRuntimeAllowed()) {
-    showGatewayStatus("Mock DB is available only in the local dev runtime.");
+    showGatewayStatus("Local Mem DB is available only in the local dev runtime.");
     return;
   }
   if (!localModeSelected()) {
-    showGatewayStatus("Mock DB is available only in Local mode.");
+    showGatewayStatus("Local Mem DB is available only in Local Mem mode until Local DB adapter is configured.");
     return;
   }
   const module = await import("../src/engine/api/mock-db-viewer-ui.js");
   module.startMockDbViewer(document);
 }
 
 loadLocalDbViewer().catch((error) => {
-  console.error("Unable to load Local Mock DB viewer.", error);
+  console.error("Unable to load Local Mem DB viewer.", error);
 });

admin/tools-progress.js

@@ -112,7 +112,7 @@ function renderToolsProgress() {
     row.append(cell);
     progressBody.append(row);
     if (progressSummary) {
-      progressSummary.textContent = "Tool registry API unavailable. Start the Local/DEV server API and refresh.";
+      progressSummary.textContent = "Tool registry API unavailable. Start the local server API and refresh.";
     }
     return;
   }

assets/theme-v2/js/gamefoundry-partials.js

@@ -163,13 +163,13 @@
                 authenticated: Boolean(session.authenticated),
                 diagnostic: session.diagnostic || "",
                 displayName: session.authenticated ? session.displayName || session.label || "Account" : "Login",
-                mode: session.mode || "local",
+                mode: session.mode || "local-mem",
                 roleSlugs: Array.isArray(session.roleSlugs) ? session.roleSlugs : []
             };
         } catch (error) {
             return {
                 authenticated: false,
-                diagnostic: "Server session API is unavailable. Start the Local/DEV server API before using protected pages.",
+                diagnostic: "Server session API is unavailable. Start the local server API before using protected pages.",
                 displayName: "Login",
                 mode: "missing-api",
                 roleSlugs: []

assets/theme-v2/js/login-session.js

@@ -57,10 +57,10 @@ function renderUserButtons(mode) {
   }
 
   userControls.replaceChildren();
-  if (mode.id === "dev") {
+  if (mode.usersEnabled === false) {
     userControls.hidden = true;
     if (userStatus) {
-      userStatus.textContent = "DEV mode uses read-only/demo JSON access. No users are selectable.";
+      userStatus.textContent = mode.diagnostic || "No local users are selectable for this environment.";
     }
     return;
   }
@@ -103,7 +103,7 @@ function renderError(error) {
     modeTitle.textContent = "Session API unavailable";
   }
   if (modeDescription) {
-    modeDescription.textContent = "Start the Local/DEV server API to select a session.";
+    modeDescription.textContent = "Start the local server API to select a session.";
   }
   if (modeStatus) {
     modeStatus.textContent = `Login/session diagnostic: ${message}`;
@@ -130,7 +130,16 @@ function render() {
       modeDescription.textContent = mode.description;
     }
     if (modeStatus) {
-      modeStatus.textContent = `${mode.label} mode selected.`;
+      const environment = session.environment || mode.environment || mode.label;
+      const persistence = session.persistence || mode.persistence || "";
+      const statusParts = [`Environment: ${environment}`];
+      if (persistence) {
+        statusParts.push(`Persistence: ${persistence}`);
+      }
+      if (session.diagnostic || mode.diagnostic) {
+        statusParts.push(`Diagnostic: ${session.diagnostic || mode.diagnostic}`);
+      }
+      modeStatus.textContent = statusParts.join(". ") + ".";
     }
     renderUserButtons(mode);
     updateContinueLink();
@@ -142,7 +151,7 @@ function render() {
 modeButtons.forEach((button) => {
   button.addEventListener("click", () => {
     try {
-      setSessionMode(button.dataset.loginMode || "local");
+      setSessionMode(button.dataset.loginMode || "local-mem");
       dispatchModeChanged();
       render();
     } catch (error) {
@@ -157,7 +166,7 @@ userControls?.addEventListener("click", (event) => {
     return;
   }
   try {
-    setSessionMode("local");
+    setSessionMode("local-mem");
     setSessionUser(button.dataset.loginUser || "");
     dispatchSessionChanged();
     render();

assets/theme-v2/js/tool-display-mode.js

@@ -148,7 +148,7 @@
             const diagnostic = document.createElement("p");
             diagnostic.className = "status";
             diagnostic.setAttribute("role", "status");
-            diagnostic.textContent = "Tool navigation could not load from the server API. Start the Local/DEV server API and refresh.";
+            diagnostic.textContent = "Tool navigation could not load from the server API. Start the local server API and refresh.";
             body.appendChild(diagnostic);
         }
     }

docs_build/dev/admin-notes/index.txt

@@ -1,8 +1,8 @@
 
-[ ] http://127.0.0.1:5500/admin/db-viewer.html
-
-[ ] Tiles
--
+[ ] move 
+src\assets\fonts\0xProtoNerdFont\ to assets\theme-v2\fonts\
+src\assets\fonts\vector_battle\ to assets\theme-v2\fonts\
+delete src\assets\
 
 [ ] Project Life Cycle
 
@@ -19,7 +19,7 @@
 - left to right easiest to hardest
 - build off of, type, enemy, heros, levels, etc.
 
-[x] Admin notes
+[.] Admin notes
 - reads txt file (this one) and displays
 - if a note has [subnote] it should be a link on the page and display [subnote].txt
 - example [other] should display other.txt, 
@@ -35,3 +35,24 @@
 - each section will have a start end time
 - The test/debug page will be the location for test, 
 - only on when run from test
+
+[ ] Before UAT, add a milestone:
+
+Security Gate 1
+
+Requirements:
+
+Server-side session
+Server-side auth
+Server-side role checks
+Server-side ownership checks
+API layer between UI and DB
+No direct browser DB writes
+
+Scoring it today 2026-06-06:
+Data Model      8/10
+Role Model      8/10
+UI Protection   7/10
+Real Security   1/10
+
+because true security doesn't exist until the server validates every request.

docs_build/dev/reports/browser_mock_remaining_audit.md

@@ -1,38 +1,38 @@
-# PR_26158_022 Browser Mock Remaining Audit
+# PR_26158_024 Browser Mock Remaining Audit
 
-## Audit Scope
+## Scope
 
-Active browser/tool files changed or adjacent to PR_26158_020/021:
+Focused audit for browser-visible files and adjacent server/API cleanup touched in PR_26158_024:
 
+- `admin/db-viewer.html`
 - `admin/db-viewer.js`
-- `assets/theme-v2/js/login-session.js`
-- `assets/theme-v2/js/tool-display-mode.js`
-- `admin/tools-progress.js`
-- `toolbox/tools-page-accordions.js`
-- `toolbox/project-journey/project-journey.js`
-- toolbox API clients under `toolbox/*/*-api-client.js`
-- engine API clients under `src/engine/api/`
+- `src/engine/api/mock-db-api-client.js`
+- `src/engine/api/mock-db-viewer-ui.js`
+- `src/dev-runtime/server/mock-api-router.mjs`
+- `src/dev-runtime/persistence/mock-db-store.js`
+- `tests/playwright/tools/AdminDbViewer.spec.mjs`
+- `tests/playwright/tools/LoginSessionMode.spec.mjs`
 
-## Findings
+## Static Import Boundary
 
 | Check | Status | Evidence |
 | --- | --- | --- |
-| Active browser files import `src/dev-runtime` directly. | PASS | Focused `rg` found no active browser entry imports after migration. |
-| Active browser files import mock repositories directly. | PASS | Remaining `*-mock-repository.js` imports are repository/server-dev implementation files only. |
-| Active browser files import `mock-db-store` or dev persistence. | PASS | `src/engine/persistence/mock-db-store.js` was removed; browser files use API clients. |
-| Active browser files import static Toolbox registry records directly. | PASS | Toolbox page, Project Journey, Admin Tools Progress, and Tool Display Mode now use `toolbox/tool-registry-api-client.js`. |
-| Active browser files keep page-local mock DB snapshots or fake records. | PASS | Palette invalid/empty source modes are server-owned; DB Viewer reads `/api/mock-db/snapshot`. |
-| Active browser files use `localStorage`/`sessionStorage` for mock DB/session fallback. | PASS | Migrated files use session/Mock DB API clients; permitted Workspace/sessionStorage contracts in unrelated shared runtime files were not modified. |
+| Browser files import `src/dev-runtime` directly. | PASS | `rg -n '^import .*src/dev-runtime|import\\(.*src/dev-runtime' assets admin toolbox src -g '*.js' -g '!src/dev-runtime/**' ...` returned no matches. |
+| Browser files import static `toolRegistry.js` directly. | PASS | `rg -n '^import .*toolRegistry\\.js|import\\(.*toolRegistry\\.js' ...` returned no matches. |
+| Browser files import mock repositories directly. | PASS | Refined `rg` excluding repository implementation files returned no matches. |
 
-## Remaining Matches And Classification
+## Local Mode Cleanup
 
-`rg` still finds mock/dev strings in these categories:
-
-- `src/dev-runtime/server/mock-api-router.mjs`: PASS, server/dev runtime API owner.
-- `toolbox/*/*-mock-repository.js`, `toolbox/colors/palette-workspace-repository.js`, `toolbox/colors/palette-source-mock-db.js`: PASS, server/dev-only repository/data source modules imported by the dev server router.
-- `src/shared/toolbox/*` imports of `toolbox/toolRegistry.js`: AUDIT NOTE, product registry/shared shell metadata outside the active browser files changed by this migration pass. The adjacent active consumers were migrated to the server-backed registry endpoint.
+| Check | Status | Evidence |
+| --- | --- | --- |
+| Local login shows only Local Mem and Local DB. | PASS | Login Playwright lane asserts exact labels. |
+| DEV/UAT/Prod are not local login buttons. | PASS | Login Playwright lane asserts no DEV, UAT, or Prod buttons. |
+| Server rejects legacy `modeId: "local"`. | PASS | API contract probe returned 500 with `Unknown local login environment: local`. |
+| Local DB does not fall back to Local Mem. | PASS | API contract probe verified Local DB snapshot fails with `Local DB adapter not configured`. |
+| DB Viewer user-facing wording says Local Mem DB. | PASS | Admin DB Viewer Playwright asserts Local Mem DB headings, status text, clear/seed controls, and dialogs. |
 
-## Command Evidence
+## Remaining Internal Matches
 
-- `rg -n "dev-runtime|toolRegistry\\.js|mock-db-store|mock-repository|palette-workspace-repository|palette-source-mock-db|localStorage|sessionStorage" admin assets/theme-v2/js toolbox src/engine/api -g "*.js" -g "*.mjs" --glob "!archive/**" --glob "!**/start_of_day/**" --glob "!node_modules/**" --glob "!tmp/**"`
-- Remaining results were only server/dev repository implementation modules.
+- `toolbox/*/*-mock-repository.js` and `toolbox/colors/palette-workspace-repository.js` remain server/data-source implementation modules, not active browser entry imports.
+- `/api/mock-db/*` route names and `mock-db-*` module filenames remain stable internal API contracts.
+- Internal exception text `Invalid mock DB audit user key` remains in non-user-facing audit validation.