Fix DB auth foundation seed ownership, grouped DDL DML artifacts, guest seed data, reseed routing, and DB Viewer ordering - PR_26164_101-db-auth-foundation-fixes

Author: ToolboxAid

account/sign-in.html

@@ -26,21 +26,6 @@ <h1>Sign In</h1>
                     <aside class="side-menu" aria-label="Session mode">
                         <button class="btn btn--compact" type="button" data-login-mode="local-db">Local DB</button>
                         <p class="status" role="status" data-login-mode-disabled-message hidden>Use the API-backed local server for sign-in. Run npm run dev:local-api and open http://127.0.0.1:5501/account/sign-in.html. Local DB is disabled until the local API server is running.</p>
-                        <hr>
-                        <section class="content-stack" aria-labelledby="login-reseed-title">
-                            <div>
-                                <div class="kicker">Database</div>
-                                <h2 id="login-reseed-title">Reseed</h2>
-                            </div>
-                            <p><strong>Active DB mode:</strong> <span data-login-reseed-active-mode>Checking...</span></p>
-                            <p><strong>Reseed target:</strong> <span data-login-reseed-target>Checking...</span></p>
-                            <div class="action-group" role="group" aria-label="Reseed active DB">
-                                <button class="btn btn--compact" type="button" data-login-reseed-start>Reseed Active DB</button>
-                                <button class="btn btn--compact" type="button" data-login-reseed-confirm hidden>Confirm Reseed</button>
-                                <button class="btn btn--compact" type="button" data-login-reseed-cancel hidden>Cancel</button>
-                            </div>
-                            <p class="status" role="status" data-login-reseed-status>Checking...</p>
-                        </section>
                     </aside>
                     <div class="card">
                         <div class="card-body content-stack">

admin/db-viewer.html

@@ -34,6 +34,8 @@ <h2 data-admin-db-mode-title>Local DB</h2>
                                 <div class="accordion-body content-stack">
                                     <p data-admin-db-scope-description>Current tool Local DB records are displayed as a read-only human-readable dump.</p>
                                     <p>Use the diagnostics panel to confirm table attribution, relationships, and table bleed checks.</p>
+                                    <button class="btn btn--compact" type="button" data-admin-setup-reseed>Reseed Local DB</button>
+                                    <p class="status" role="status" data-admin-setup-status>SKIP: No setup action has been run.</p>
                                 </div>
                             </details>
                         </div>
@@ -76,6 +78,7 @@ <h2>DB Inspector</h2>
     <div data-partial="footer"></div>
     <script src="assets/theme-v2/js/gamefoundry-partials.js" defer></script>
     <script src="assets/theme-v2/js/tool-display-mode.js" defer></script>
+    <script type="module" src="assets/theme-v2/js/admin-setup-actions.js"></script>
     <script type="module" src="admin/db-viewer.js"></script>
 </body>
 

admin/site-setup.html

@@ -18,7 +18,7 @@
             <div class="container">
                 <div class="kicker">Admin Wireframe</div>
                 <h1>Site Setup</h1>
-                <p class="lede">Reserve the future setup owner for controlled platform bootstrap actions without executing setup work.</p>
+                <p class="lede">Admin-owned setup actions for controlled Local DB bootstrap and review.</p>
             </div>
         </section>
         <section class="section">
@@ -41,11 +41,12 @@ <h2>Admin</h2>
                                 </nav>
                             </details>
                             <details class="vertical-accordion" open>
-                                <summary>Setup Preview</summary>
+                                <summary>Setup Actions</summary>
                                 <div class="accordion-body content-stack">
                                     <label>Setup Area <select disabled><option>Default roles</option><option>First admin</option><option>Tool metadata bootstrap</option><option>Starter platform settings</option><option>Ticket categories</option></select></label>
                                     <label>Review Mode <select disabled><option>Foundation only</option><option>Local DB dry run</option><option>Admin approval</option></select></label>
-                                    <button class="btn btn--compact" type="button" disabled>Preview Setup Action</button>
+                                    <button class="btn btn--compact" type="button" data-admin-setup-reseed>Reseed Local DB</button>
+                                    <p class="status" role="status" data-admin-setup-status>SKIP: No setup action has been run.</p>
                                 </div>
                             </details>
                         </div>
@@ -56,7 +57,7 @@ <h2>Admin</h2>
                             <div class="kicker">Setup Ownership</div>
                             <h2 id="admin-site-setup-title">Controlled Setup Foundation</h2>
                         </div>
-                        <p>This foundation page identifies where future setup and seed actions belong. Runtime setup actions are not executable in this PR.</p>
+                        <p>This page owns controlled Local DB setup entry points. Reseed actions call admin-gated server APIs and report visible PASS/FAIL/WARN/SKIP status.</p>
                         <div class="table-wrapper">
                             <table class="data-table" aria-label="Site setup ownership foundation">
                                 <caption>Future Site Setup Ownership</caption>
@@ -86,14 +87,14 @@ <h2>Inspector</h2>
                             <details class="vertical-accordion" open>
                                 <summary>Status</summary>
                                 <div class="accordion-body content-stack">
-                                    <p class="status" role="status">Wireframe only. Site setup actions are not read, written, or executed.</p>
+                                    <p class="status" role="status" data-admin-setup-status>SKIP: No setup action has been run.</p>
                                 </div>
                             </details>
                             <details class="vertical-accordion" open>
                                 <summary>DDL/DML Review</summary>
                                 <div class="accordion-body content-stack">
                                     <p>DDL remains under docs_build/database/ddl/.</p>
-                                    <p>Temporary DEV setup review DML remains under docs_build/database/dml/ until this page owns executable setup behavior in a later PR.</p>
+                                    <p>Temporary DEV setup review DML is grouped under docs_build/database/dml/. Local DB reseed runs through the server API.</p>
                                 </div>
                             </details>
                         </div>
@@ -105,6 +106,7 @@ <h2>Inspector</h2>
     <div data-partial="footer"></div>
     <script src="assets/theme-v2/js/gamefoundry-partials.js" defer></script>
     <script src="assets/theme-v2/js/tool-display-mode.js" defer></script>
+    <script type="module" src="assets/theme-v2/js/admin-setup-actions.js"></script>
 </body>
 
 </html>

assets/theme-v2/js/admin-setup-actions.js

@@ -0,0 +1,43 @@
+import { reseedAdminSetup } from "../../../src/engine/api/admin-setup-api-client.js";
+
+const reseedButtons = Array.from(document.querySelectorAll("[data-admin-setup-reseed]"));
+const statusFields = Array.from(document.querySelectorAll("[data-admin-setup-status]"));
+
+function setStatus(message, status = "PASS") {
+  const text = `${status}: ${message}`;
+  statusFields.forEach((field) => {
+    field.textContent = text;
+  });
+}
+
+function setBusy(isBusy) {
+  reseedButtons.forEach((button) => {
+    button.disabled = isBusy;
+    if (isBusy) {
+      button.setAttribute("aria-disabled", "true");
+    } else {
+      button.removeAttribute("aria-disabled");
+    }
+  });
+}
+
+function runReseed() {
+  setBusy(true);
+  setStatus("Running Local DB reseed through Admin setup.", "WARN");
+  try {
+    const result = reseedAdminSetup();
+    setStatus(result.message || "Local DB reseed completed through Admin setup.", result.status || "PASS");
+    window.dispatchEvent(new CustomEvent("gamefoundry:mock-db-changed", {
+      detail: result.snapshot || null,
+    }));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error || "Admin setup reseed failed.");
+    setStatus(message, "FAIL");
+  } finally {
+    setBusy(false);
+  }
+}
+
+reseedButtons.forEach((button) => {
+  button.addEventListener("click", runReseed);
+});

assets/theme-v2/js/login-session.js

@@ -5,7 +5,6 @@ import {
   signIn,
   setSessionMode,
 } from "../../../src/engine/api/session-api-client.js";
-import { seedMockDb } from "../../../src/engine/api/mock-db-api-client.js";
 
 const modeButtons = Array.from(document.querySelectorAll("[data-login-mode]"));
 const modeTitle = document.querySelector("[data-login-mode-title]");
@@ -15,21 +14,11 @@ const modeDisabledMessage = document.querySelector("[data-login-mode-disabled-me
 const userControls = document.querySelector("[data-login-user-controls]");
 const userStatus = document.querySelector("[data-login-user-status]");
 const continueLink = document.querySelector("[data-login-continue]");
-const reseedFields = {
-  activeMode: document.querySelector("[data-login-reseed-active-mode]"),
-  cancelButton: document.querySelector("[data-login-reseed-cancel]"),
-  confirmButton: document.querySelector("[data-login-reseed-confirm]"),
-  startButton: document.querySelector("[data-login-reseed-start]"),
-  status: document.querySelector("[data-login-reseed-status]"),
-  target: document.querySelector("[data-login-reseed-target]"),
-};
 const localApiStartCommand = "npm run dev:local-api";
 const localApiLoginUrl = "http://127.0.0.1:5501/account/sign-in.html";
 const expectedSessionEndpoint = "/api/session/current";
 const apiBackedLoginDiagnostic = `Use the API-backed local server for sign-in. Run ${localApiStartCommand} and open ${localApiLoginUrl}.`;
 const staticModeDisabledMessage = `Use the API-backed local server for sign-in. Run ${localApiStartCommand} and open ${localApiLoginUrl}. Local DB is disabled until the local API server is running.`;
-let reseedConfirmationPending = false;
-let reseedStatusMessage = "";
 const localStatusFields = {
   api: document.querySelector("[data-login-status-api]"),
   apiUrl: document.querySelector("[data-login-status-api-url]"),
@@ -92,55 +81,6 @@ function updateLocalDevelopmentStatus({ apiAvailability, disabledReason, serverM
   }
 }
 
-function setReseedButtonState(button, disabled) {
-  if (!button) {
-    return;
-  }
-  button.disabled = disabled;
-  if (disabled) {
-    button.setAttribute("aria-disabled", "true");
-  } else {
-    button.removeAttribute("aria-disabled");
-  }
-}
-
-function reseedModeLabel(mode) {
-  return mode?.label || mode?.environment || mode?.id || "selected DB mode";
-}
-
-function updateReseedControls({ apiAvailable, mode, statusMessage }) {
-  const modeLabel = apiAvailable ? reseedModeLabel(mode) : "Unavailable";
-  const message = statusMessage || (apiAvailable
-    ? `Ready to reseed ${modeLabel}.`
-    : "Reseed unavailable until the Local API is available.");
-  if (reseedFields.activeMode) {
-    reseedFields.activeMode.textContent = modeLabel;
-  }
-  if (reseedFields.target) {
-    reseedFields.target.textContent = modeLabel;
-  }
-  if (reseedFields.status) {
-    reseedFields.status.textContent = message;
-  }
-  setReseedButtonState(reseedFields.startButton, !apiAvailable || reseedConfirmationPending);
-  setReseedButtonState(reseedFields.confirmButton, !apiAvailable || !reseedConfirmationPending);
-  setReseedButtonState(reseedFields.cancelButton, !apiAvailable || !reseedConfirmationPending);
-  if (reseedFields.confirmButton) {
-    reseedFields.confirmButton.hidden = !apiAvailable || !reseedConfirmationPending;
-  }
-  if (reseedFields.cancelButton) {
-    reseedFields.cancelButton.hidden = !apiAvailable || !reseedConfirmationPending;
-  }
-}
-
-function currentModeForReseed() {
-  const session = getCurrentUser();
-  return getSessionModes().find((item) => item.id === session.mode) || {
-    id: session.mode,
-    label: session.environment || session.mode,
-  };
-}
-
 function dispatchSessionChanged() {
   window.dispatchEvent(new CustomEvent("gamefoundry:mock-db-session-user-changed", {
     detail: getCurrentUser(),
@@ -220,8 +160,6 @@ function renderError(error) {
   const disabledReason = message === apiBackedLoginDiagnostic
     ? staticModeDisabledMessage
     : `Local DB is disabled because ${message}`;
-  reseedConfirmationPending = false;
-  reseedStatusMessage = "Reseed unavailable until the Local API is available.";
   modeButtons.forEach((button) => {
     button.disabled = true;
     button.setAttribute("aria-disabled", "true");
@@ -252,11 +190,6 @@ function renderError(error) {
     disabledReason,
     serverMode,
   });
-  updateReseedControls({
-    apiAvailable: false,
-    mode: null,
-    statusMessage: reseedStatusMessage,
-  });
   updateContinueLink();
 }
 
@@ -296,11 +229,6 @@ function render() {
       disabledReason: "Local DB is enabled because the Local API is available.",
       serverMode: `API-backed local server (${mode.label || session.mode})`,
     });
-    updateReseedControls({
-      apiAvailable: true,
-      mode,
-      statusMessage: reseedStatusMessage,
-    });
     if (modeDisabledMessage) {
       modeDisabledMessage.hidden = true;
       modeDisabledMessage.textContent = "";
@@ -320,8 +248,6 @@ modeButtons.forEach((button) => {
       return;
     }
     try {
-      reseedConfirmationPending = false;
-      reseedStatusMessage = "";
       setSessionMode(modeId);
       dispatchModeChanged();
       render();
@@ -345,51 +271,4 @@ userControls?.addEventListener("click", (event) => {
   }
 });
 
-reseedFields.startButton?.addEventListener("click", () => {
-  try {
-    const mode = currentModeForReseed();
-    const modeLabel = reseedModeLabel(mode);
-    reseedConfirmationPending = true;
-    reseedStatusMessage = `Confirm reseed for ${modeLabel}.`;
-    render();
-  } catch (error) {
-    reseedConfirmationPending = false;
-    reseedStatusMessage = `Reseed unavailable: ${errorMessage(error)}`;
-    renderError(error);
-  }
-});
-
-reseedFields.cancelButton?.addEventListener("click", () => {
-  try {
-    const modeLabel = reseedModeLabel(currentModeForReseed());
-    reseedConfirmationPending = false;
-    reseedStatusMessage = `Reseed canceled for ${modeLabel}.`;
-    render();
-  } catch (error) {
-    reseedConfirmationPending = false;
-    reseedStatusMessage = `Reseed canceled. ${errorMessage(error)}`;
-    renderError(error);
-  }
-});
-
-reseedFields.confirmButton?.addEventListener("click", () => {
-  try {
-    const modeLabel = reseedModeLabel(currentModeForReseed());
-    seedMockDb();
-    reseedConfirmationPending = false;
-    reseedStatusMessage = `Reseed complete for ${modeLabel}.`;
-    dispatchModeChanged();
-    render();
-  } catch (error) {
-    const message = errorMessage(error);
-    let modeLabel = "selected DB mode";
-    try {
-      modeLabel = reseedModeLabel(currentModeForReseed());
-    } catch {}
-    reseedConfirmationPending = false;
-    reseedStatusMessage = `Reseed failed for ${modeLabel}: ${message}`;
-    render();
-  }
-});
-
 render();

docs_build/database/README.md

@@ -1,19 +1,22 @@
 # Database Artifact Ownership
 
-Database schema and setup review artifacts are owned outside runtime source.
+Database schema, DML review, and seed artifacts are grouped under `docs_build/database/`.
 
 ## Ownership
 
 - DEV database DDL belongs in `docs_build/database/ddl/`.
 - DEV setup or DML review artifacts belong in `docs_build/database/dml/`.
-- DDL must not be placed under `src/` or `docs/`.
-- DML files in this folder are temporary setup/review artifacts unless promoted by a future Admin Site Setup workflow.
+- Seed artifacts belong in `docs_build/database/seed/`.
+- Guest seed artifacts belong in `docs_build/database/seed/guest/` and are read-only.
+- DDL/DML/seed artifacts must not be placed under `src/` or `docs/`.
 - Identity records use `key` as the primary identifier. Shared audit ownership uses `createdBy` and `updatedBy` references to `users.key`.
 
-## Execution Boundary
+## Grouping
+
+Each product area/tool owns one grouped file in `ddl/`, `dml/`, and `seed/`. Account tables stay in `account.sql` / `account.json`; tool metadata, planning, and votes remain separate grouped files.
 
-Codex may execute DEV database setup only.
+## Execution Boundary
 
-UAT and production SQL execution is user-controlled. Codex may prepare review artifacts, but it must not execute UAT or production SQL.
+Runtime DEV setup and reseed actions must call server-side APIs. Browser pages must not directly seed authoritative DB records or generate authoritative DB keys.
 
-Long-term seed behavior belongs in Admin -> Site Setup, not permanent seed SQL. Temporary DML files may document review setup data while the Admin Site Setup workflow is planned.
+Codex may execute DEV database setup only. UAT and production SQL execution is user-controlled. Codex may prepare review artifacts, but it must not execute UAT or production SQL.

…database/ddl/dev-app-identity-schema.sql docs_build/database/ddl/account.sqldocs_build/database/ddl/dev-app-identity-schema.sql renamed to docs_build/database/ddl/account.sql docs_build/database/ddl/dev-app-identity-schema.sql renamed to docs_build/database/ddl/account.sql

@@ -1,7 +1,8 @@
 -- Game Foundry Studio DEV database DDL
--- Ownership: docs_build/database/ddl/
+-- Group: Account
+-- Ownership: docs_build/database/ddl/account.sql
 -- Target DEV database: gamefoundry_dev
--- Scope: app identity tables only. No custom password tables are defined here.
+-- Scope: account identity tables only. No custom password tables are defined here.
 -- Identity ownership follows the project key-based governance model.
 
 CREATE TABLE IF NOT EXISTS users (

docs_build/database/ddl/admin.sql

@@ -0,0 +1,9 @@
+-- Game Foundry Studio DEV database DDL
+-- Group: Admin
+-- Ownership: docs_build/database/ddl/admin.sql
+-- Runtime Local DB schemas for these tables are currently owned by src/dev-runtime/persistence/mock-db-store.js.
+-- This grouped file documents the product/tool ownership boundary until an executable migration PR promotes the table DDL.
+-- Owned tables: none active
+-- Note: Admin Site Setup owns explicit server-side setup/reseed entry points. No persistent admin table exists in this PR.
+
+-- Server/API layer owns authoritative key generation for records in this group.

docs_build/database/ddl/asset.sql

@@ -0,0 +1,8 @@
+-- Game Foundry Studio DEV database DDL
+-- Group: Asset
+-- Ownership: docs_build/database/ddl/asset.sql
+-- Runtime Local DB schemas for these tables are currently owned by src/dev-runtime/persistence/mock-db-store.js.
+-- This grouped file documents the product/tool ownership boundary until an executable migration PR promotes the table DDL.
+-- Owned tables: asset_role_definitions, asset_library_items, asset_storage_objects, asset_import_events, asset_validation_items
+
+-- Server/API layer owns authoritative key generation for records in this group.

docs_build/database/ddl/controls.sql

@@ -0,0 +1,8 @@
+-- Game Foundry Studio DEV database DDL
+-- Group: Controls
+-- Ownership: docs_build/database/ddl/controls.sql
+-- Runtime Local DB schemas for these tables are currently owned by src/dev-runtime/persistence/mock-db-store.js.
+-- This grouped file documents the product/tool ownership boundary until an executable migration PR promotes the table DDL.
+-- Owned tables: game_input_mappings, player_controller_profiles, player_input_device_selections, input_custom_action_records
+
+-- Server/API layer owns authoritative key generation for records in this group.