Skip to content

Commit 5d94d2e

Browse files
ToolboxAidToolboxAid
committed
Add standalone Supabase DEV connectivity validation script and TLS diagnostics - PR_26166_154-supabase-dev-tls-identity-readiness
1 parent 0da72a3 commit 5d94d2e

5 files changed

Lines changed: 1425 additions & 1561 deletions

File tree

‎docs_build/dev/reports/PR_26166_154-supabase-dev-tls-identity-readiness.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# PR_26166_154-supabase-dev-tls-identity-readiness
2+
3+
## Branch Validation
4+
- PASS: Current branch is `main`.
5+
- Expected branch: `main`.
6+
7+
## Requirement Checklist
8+
- PASS: `docs_build/dev/PROJECT_INSTRUCTIONS.md` was read before implementation.
9+
- PASS: Created standalone Supabase DEV validation script at `scripts/validate-supabase-dev.mjs`.
10+
- PASS: Added `npm run validate:supabase-dev`.
11+
- PASS: Script loads `.env.local` without printing secret values.
12+
- PASS: Script checks required variables:
13+
- `GAMEFOUNDRY_SUPABASE_URL`
14+
- `GAMEFOUNDRY_SUPABASE_ANON_KEY`
15+
- `GAMEFOUNDRY_SUPABASE_SERVICE_ROLE_KEY`
16+
- `GAMEFOUNDRY_SUPABASE_DATABASE_URL`
17+
- PASS: Script masks configured values using first 6 and last 4 characters only.
18+
- PASS: Script checks Supabase URL reachability.
19+
- PASS: Script checks Supabase Auth endpoint reachability.
20+
- PASS: Script checks service role authentication through Supabase Auth admin API.
21+
- PASS: Script checks TLS certificate validation without disabling TLS verification.
22+
- PASS: Script checks the database URL through a TLS PostgreSQL connection handshake.
23+
- PASS: Script checks `users`, `roles`, and `user_roles` table existence through server-side service role REST access.
24+
- PASS: Script outputs clear `PASS`/`FAIL` diagnostics and `Overall Result`.
25+
- PASS: No `NODE_TLS_REJECT_UNAUTHORIZED=0` usage was added.
26+
- PASS: No `rejectUnauthorized: false` usage was added.
27+
- PASS: No secrets or `.env.local` files were committed or modified.
28+
29+
## Validation Lane Report
30+
- Impacted lane: targeted operator auth/provider validation tooling.
31+
- Playwright impacted: No. This PR adds standalone validation tooling and an npm script only.
32+
- Samples validation: SKIP. No sample files, sample manifests, or sample runtime behavior changed.
33+
34+
## Validation Performed
35+
- PASS: `node --check scripts/validate-supabase-dev.mjs`
36+
- PASS: `node -e "JSON.parse(require('fs').readFileSync('package.json','utf8')); console.log('package.json OK')"`
37+
- PASS: TLS bypass guard search found no matches for `NODE_TLS_REJECT_UNAUTHORIZED`, `rejectUnauthorized: false`, or `strictSSL=false`.
38+
- PASS: `git diff --check`
39+
- FAIL: `npm run validate:supabase-dev` completed with expected diagnostic failure because this machine does not trust the current Supabase TLS certificate chain.
40+
41+
## validate:supabase-dev Output
42+
43+
```text
44+
> html-javascript-gaming@1.0.0 validate:supabase-dev
45+
> node ./scripts/validate-supabase-dev.mjs
46+
47+
PASS - .env.local loaded (6 key(s) loaded)
48+
PASS - URL configured (GAMEFOUNDRY_SUPABASE_URL=https:.../v1/)
49+
PASS - Publishable key configured (GAMEFOUNDRY_SUPABASE_ANON_KEY=sb_pub...V2Zj)
50+
PASS - Service role key configured (GAMEFOUNDRY_SUPABASE_SERVICE_ROLE_KEY=sb_sec...KRU6)
51+
PASS - Database URL configured (GAMEFOUNDRY_SUPABASE_DATABASE_URL=postgr...gres)
52+
FAIL - Supabase reachable (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
53+
FAIL - TLS validation (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
54+
FAIL - Auth endpoint reachable (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
55+
FAIL - Service role authentication (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
56+
FAIL - Database connection (SELF_SIGNED_CERT_IN_CHAIN)
57+
FAIL - users table (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
58+
FAIL - roles table (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
59+
FAIL - user_roles table (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
60+
61+
Overall Result: FAIL
62+
Failed checks: Supabase reachable, TLS validation, Auth endpoint reachable, Service role authentication, Database connection, users table, roles table, user_roles table
63+
```
64+
65+
## Manual Validation Notes
66+
- `.env.local` was detected and loaded by the script.
67+
- Required Supabase values were present and masked in output.
68+
- The validator did not print raw secrets.
69+
- TLS verification remains enabled for HTTPS and PostgreSQL checks.
70+
- Current failure is environment trust related:
71+
- HTTPS/Supabase REST/Auth: `UNABLE_TO_VERIFY_LEAF_SIGNATURE`
72+
- PostgreSQL TLS: `SELF_SIGNED_CERT_IN_CHAIN`
73+
- The script correctly refuses to treat these connections as valid rather than disabling TLS or falling back.
74+
75+
## Changed Files
76+
- `package.json`
77+
- `scripts/validate-supabase-dev.mjs`
78+
- `docs_build/dev/reports/PR_26166_154-supabase-dev-tls-identity-readiness.md`
79+
80+
## Review Artifacts
81+
- `docs_build/dev/reports/codex_review.diff`
82+
- `docs_build/dev/reports/codex_changed_files.txt`

‎docs_build/dev/reports/codex_changed_files.txt‎

Lines changed: 7 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,72 +1,12 @@
11
# git status --short
2-
M docs_build/dev/reports/dependency_gating_report.md
3-
M docs_build/dev/reports/dependency_hydration_reuse_report.md
4-
M docs_build/dev/reports/execution_graph_reuse_report.md
5-
M docs_build/dev/reports/failure_fingerprint_report.md
6-
M docs_build/dev/reports/filesystem_scan_reduction_report.md
7-
M docs_build/dev/reports/incremental_validation_report.md
8-
M docs_build/dev/reports/lane_compilation_report.md
9-
M docs_build/dev/reports/lane_deduplication_report.md
10-
M docs_build/dev/reports/lane_input_validation_report.md
11-
M docs_build/dev/reports/lane_manifests/workspace-contract.json
12-
M docs_build/dev/reports/lane_runtime_optimization_report.md
13-
M docs_build/dev/reports/lane_snapshot_report.md
14-
M docs_build/dev/reports/lane_snapshots/workspace-contract.json
15-
M docs_build/dev/reports/lane_warm_start_report.md
16-
M docs_build/dev/reports/lane_warm_starts/workspace-contract.json
17-
M docs_build/dev/reports/monolith_trigger_removal_report.md
18-
M docs_build/dev/reports/persistent_lane_manifest_report.md
19-
M docs_build/dev/reports/playwright_discovery_ownership_report.md
20-
M docs_build/dev/reports/playwright_discovery_scope_report.md
21-
M docs_build/dev/reports/playwright_structure_audit.md
22-
M docs_build/dev/reports/retry_suppression_report.md
23-
M docs_build/dev/reports/slow_path_pruning_report.md
24-
M docs_build/dev/reports/static_validation_report.md
25-
M docs_build/dev/reports/targeted_file_manifest_report.md
26-
M docs_build/dev/reports/test_cleanup_performance_report.md
27-
M docs_build/dev/reports/test_cleanup_routing_report.md
28-
M docs_build/dev/reports/testing_lane_execution_report.md
29-
M docs_build/dev/reports/validation_cache_report.md
30-
M docs_build/dev/reports/zero_browser_preflight_report.md
31-
M src/dev-runtime/server/local-api-router.mjs
32-
M tests/dev-runtime/SupabaseProviderContractStub.test.mjs
33-
M tests/playwright/tools/LoginSessionMode.spec.mjs
34-
?? docs_build/dev/reports/PR_26166_153-supabase-identity-bootstrap-and-provisioning.md
2+
M package.json
3+
?? docs_build/dev/reports/PR_26166_154-supabase-dev-tls-identity-readiness.md
4+
?? scripts/validate-supabase-dev.mjs
355

366
# git ls-files --others --exclude-standard
37-
docs_build/dev/reports/PR_26166_153-supabase-identity-bootstrap-and-provisioning.md
7+
docs_build/dev/reports/PR_26166_154-supabase-dev-tls-identity-readiness.md
8+
scripts/validate-supabase-dev.mjs
389

3910
# git diff --stat
40-
docs_build/dev/reports/dependency_gating_report.md | 2 +-
41-
.../reports/dependency_hydration_reuse_report.md | 12 +-
42-
.../dev/reports/execution_graph_reuse_report.md | 16 +-
43-
.../dev/reports/failure_fingerprint_report.md | 2 +-
44-
.../reports/filesystem_scan_reduction_report.md | 2 +-
45-
.../dev/reports/incremental_validation_report.md | 14 +-
46-
docs_build/dev/reports/lane_compilation_report.md | 2 +-
47-
.../dev/reports/lane_deduplication_report.md | 2 +-
48-
.../dev/reports/lane_input_validation_report.md | 2 +-
49-
.../reports/lane_manifests/workspace-contract.json | 10 +-
50-
.../reports/lane_runtime_optimization_report.md | 14 +-
51-
docs_build/dev/reports/lane_snapshot_report.md | 12 +-
52-
.../reports/lane_snapshots/workspace-contract.json | 22 +--
53-
docs_build/dev/reports/lane_warm_start_report.md | 12 +-
54-
.../lane_warm_starts/workspace-contract.json | 16 +-
55-
.../dev/reports/monolith_trigger_removal_report.md | 2 +-
56-
.../dev/reports/persistent_lane_manifest_report.md | 12 +-
57-
.../playwright_discovery_ownership_report.md | 2 +-
58-
.../reports/playwright_discovery_scope_report.md | 2 +-
59-
.../dev/reports/playwright_structure_audit.md | 2 +-
60-
docs_build/dev/reports/retry_suppression_report.md | 2 +-
61-
docs_build/dev/reports/slow_path_pruning_report.md | 16 +-
62-
docs_build/dev/reports/static_validation_report.md | 12 +-
63-
.../dev/reports/targeted_file_manifest_report.md | 8 +-
64-
.../dev/reports/test_cleanup_performance_report.md | 22 +--
65-
.../dev/reports/test_cleanup_routing_report.md | 2 +-
66-
.../dev/reports/testing_lane_execution_report.md | 52 +++---
67-
docs_build/dev/reports/validation_cache_report.md | 30 ++--
68-
.../dev/reports/zero_browser_preflight_report.md | 10 +-
69-
src/dev-runtime/server/local-api-router.mjs | 195 ++++++++++++++++++++-
70-
.../SupabaseProviderContractStub.test.mjs | 170 ++++++++++++++++--
71-
tests/playwright/tools/LoginSessionMode.spec.mjs | 40 ++++-
72-
32 files changed, 538 insertions(+), 181 deletions(-)
11+
package.json | 1 +
12+
1 file changed, 1 insertion(+)

0 commit comments

Comments
 (0)