Remove static API fallbacks and require explicit local API diagnostics - PR_26158_032-remove-static-api-fallbacks

Author: ToolboxAid

assets/theme-v2/js/gamefoundry-partials.js

@@ -110,7 +110,6 @@
 
     const currentScript = document.currentScript || document.querySelector("script[src*='gamefoundry-partials.js']");
     const assetRoot = currentScript ? new URL("../", currentScript.src) : null;
-    const staticApiDiagnosticKey = "GameFoundryStaticApiUnavailableDiagnostic";
 
     function assetUrl(path) {
         if (!assetRoot) return rootPrefix() + path;
@@ -143,14 +142,6 @@
         return "Local server API route unavailable for " + method + " " + url + " (" + status + "). Start the API-backed local server route instead of a static-only server.";
     }
 
-    function cachedStaticApiDiagnostic() {
-        return String(window[staticApiDiagnosticKey] || "");
-    }
-
-    function cacheStaticApiDiagnostic(message) {
-        window[staticApiDiagnosticKey] = message;
-    }
-
     function missingSessionApiLoginState(diagnostic) {
         return {
             authenticated: false,
@@ -172,10 +163,6 @@
     }
 
     function localDevLoginState() {
-        const cachedDiagnostic = cachedStaticApiDiagnostic();
-        if (cachedDiagnostic) {
-            return missingSessionApiLoginState(cachedDiagnostic);
-        }
         try {
             const request = new XMLHttpRequest();
             request.open("GET", "/api/session/current", false);
@@ -184,9 +171,7 @@
             const payload = request.responseText ? JSON.parse(request.responseText) : null;
             if (request.status < 200 || request.status >= 300 || payload?.ok === false) {
                 if (request.status === 404 || request.status === 405) {
-                    const diagnostic = localRouteUnavailableDiagnostic("GET", "/api/session/current", request.status);
-                    cacheStaticApiDiagnostic(diagnostic);
-                    throw new Error(diagnostic);
+                    throw new Error(localRouteUnavailableDiagnostic("GET", "/api/session/current", request.status));
                 }
                 throw new Error(payload?.error || "Session API did not return a valid current session.");
             }
@@ -332,11 +317,10 @@
         const pagePath = currentPagePath() || "index.html";
         const requirement = protectedPageRequirement(pagePath);
         if (!requirement) {
-            const diagnostic = cachedStaticApiDiagnostic();
             window.GameFoundrySessionGuard = {
                 blocked: false,
-                diagnostic,
-                mode: diagnostic ? "missing-api" : "",
+                diagnostic: "",
+                mode: "",
                 pagePath,
                 requirement: ""
             };

assets/theme-v2/js/login-session.js

@@ -13,27 +13,6 @@ const modeStatus = document.querySelector("[data-login-mode-status]");
 const userControls = document.querySelector("[data-login-user-controls]");
 const userStatus = document.querySelector("[data-login-user-status]");
 const continueLink = document.querySelector("[data-login-continue]");
-const staticModeDetails = {
-  "local-mem": {
-    description: "Uses MockDbAdapter backed by in-memory lists when the API-backed local server is running.",
-    diagnostic: "Static-only server detected. Local Mem selection remains available, but local users and persistence require the API-backed local server.",
-    environment: "Local Mem",
-    id: "local-mem",
-    label: "Local Mem",
-    persistence: "Memory",
-  },
-  "local-db": {
-    description: "Uses LocalDbAdapter backed by server SQLite storage.",
-    diagnostic: "Static-only server detected. Local DB requires the API-backed local server; start the local server API to use SQLite-backed Local DB.",
-    environment: "Local DB",
-    id: "local-db",
-    label: "Local DB",
-    persistence: "Local DB",
-  },
-};
-let staticApiUnavailable = false;
-let staticModeId = "local-mem";
-let staticApiDiagnostic = "";
 
 function currentReturnTo() {
   const params = new URLSearchParams(window.location.search);
@@ -116,55 +95,22 @@ function errorMessage(error) {
   return error instanceof Error ? error.message : String(error || "Session API unavailable.");
 }
 
-function isStaticApiUnavailable(message) {
-  return message.includes("Local server API route unavailable") ||
-    message.includes("/api/session") && message.includes("(404)");
-}
-
-function renderStaticApiUnavailable(modeId, error) {
-  const mode = staticModeDetails[modeId] || staticModeDetails["local-mem"];
-  staticApiUnavailable = true;
-  staticModeId = mode.id;
-  staticApiDiagnostic = errorMessage(error);
-  renderModeButtons(mode);
-  if (userControls) {
-    userControls.replaceChildren();
-    userControls.hidden = true;
-  }
-  if (modeTitle) {
-    modeTitle.textContent = mode.label;
-  }
-  if (modeDescription) {
-    modeDescription.textContent = mode.description;
-  }
-  if (modeStatus) {
-    modeStatus.textContent = `Environment: ${mode.environment}. Persistence: ${mode.persistence}. Diagnostic: ${mode.diagnostic} ${staticApiDiagnostic}`;
-  }
-  if (userStatus) {
-    userStatus.textContent = "No local users are available because the API-backed local server is unavailable.";
-  }
-  updateContinueLink();
-}
-
 function renderError(error) {
   const message = errorMessage(error);
-  if (isStaticApiUnavailable(message)) {
-    renderStaticApiUnavailable(staticModeId, error);
-    return;
-  }
   modeButtons.forEach((button) => {
-    button.disabled = false;
-    button.removeAttribute("aria-disabled");
+    button.disabled = true;
+    button.setAttribute("aria-disabled", "true");
+    setSelectedButton(button, false);
   });
   if (userControls) {
     userControls.replaceChildren();
     userControls.hidden = true;
   }
   if (modeTitle) {
-    modeTitle.textContent = "Session API unavailable";
+    modeTitle.textContent = "Session API required";
   }
   if (modeDescription) {
-    modeDescription.textContent = "Start the local server API to select a session.";
+    modeDescription.textContent = "Start the API-backed local server to choose Local Mem or Local DB.";
   }
   if (modeStatus) {
     modeStatus.textContent = `Login/session diagnostic: ${message}`;
@@ -178,7 +124,6 @@ function renderError(error) {
 function render() {
   try {
     const session = getSessionCurrent();
-    staticApiUnavailable = false;
     const mode = getSessionModes().find((item) => item.id === session.mode) || {
       description: "",
       id: session.mode,
@@ -213,16 +158,11 @@ function render() {
 modeButtons.forEach((button) => {
   button.addEventListener("click", () => {
     const modeId = button.dataset.loginMode || "local-mem";
-    if (staticApiUnavailable) {
-      renderStaticApiUnavailable(modeId, staticApiDiagnostic);
-      return;
-    }
     try {
       setSessionMode(modeId);
       dispatchModeChanged();
       render();
     } catch (error) {
-      staticModeId = modeId;
       renderError(error);
     }
   });

docs_build/dev/reports/coverage_changed_js_guardrail.txt

@@ -6,7 +6,7 @@ Missing changed runtime JS files are WARN, not FAIL.
 Source: Playwright/Chromium built-in V8 coverage from the active Playwright run.
 
 Changed runtime JS files considered:
-(55%) src/engine/api/server-api-client.js - executed lines 186/186; executed functions 12/22
+(53%) src/engine/api/server-api-client.js - executed lines 159/159; executed functions 10/19
 
 Guardrail warnings:
 (100%) none - no changed runtime JS coverage warnings

docs_build/dev/reports/playwright_v8_coverage_report.txt

@@ -14,30 +14,29 @@ Note: coverage entries are aggregated across every page/tool where coverageRepor
 Exercised tool entry points detected:
 (61%) Toolbox Index - exercised 3 runtime JS files
 (0%) Tool Template V2 - not exercised by this Playwright run
-(77%) Theme V2 Shared JS - exercised 3 runtime JS files
+(80%) Theme V2 Shared JS - exercised 3 runtime JS files
 
 Changed runtime JS files covered:
-(55%) src/engine/api/server-api-client.js - executed lines 186/186; executed functions 12/22
+(53%) src/engine/api/server-api-client.js - executed lines 159/159; executed functions 10/19
 
 Files with executed line/function counts where available:
-(55%) src/engine/api/server-api-client.js - executed lines 186/186; executed functions 12/22
+(53%) src/engine/api/server-api-client.js - executed lines 159/159; executed functions 10/19
 (55%) toolbox/project-journey/project-journey.js - executed lines 1003/1003; executed functions 54/99
 (60%) src/engine/api/mock-db-api-client.js - executed lines 19/19; executed functions 3/5
 (64%) assets/theme-v2/js/tool-display-mode.js - executed lines 201/201; executed functions 9/14
 (67%) admin/db-viewer.js - executed lines 53/53; executed functions 4/6
-(79%) assets/theme-v2/js/login-session.js - executed lines 227/227; executed functions 15/19
-(80%) assets/theme-v2/js/gamefoundry-partials.js - executed lines 448/448; executed functions 33/41
 (81%) toolbox/tool-registry-api-client.js - executed lines 148/148; executed functions 22/27
+(82%) assets/theme-v2/js/gamefoundry-partials.js - executed lines 434/434; executed functions 32/39
 (85%) src/engine/api/mock-db-viewer-ui.js - executed lines 510/510; executed functions 82/96
+(88%) assets/theme-v2/js/login-session.js - executed lines 169/169; executed functions 15/17
 (88%) src/engine/api/session-api-client.js - executed lines 34/34; executed functions 7/8
 (100%) toolbox/project-journey/project-journey-api-client.js - executed lines 12/12; executed functions 2/2
 
 Uncovered or low-coverage changed JS files:
 (100%) none - no low-coverage changed runtime JS files
 
 Changed JS files considered:
-(0%) tests/helpers/browserExtensionNoise.mjs - changed JS file not collected as browser runtime coverage
-(0%) tests/playwright/tools/StaticOnlyLoginFallback.spec.mjs - changed JS file not collected as browser runtime coverage
-(55%) src/engine/api/server-api-client.js - changed JS file with browser V8 coverage
-(79%) assets/theme-v2/js/login-session.js - changed JS file with browser V8 coverage
-(80%) assets/theme-v2/js/gamefoundry-partials.js - changed JS file with browser V8 coverage
+(0%) tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs - changed JS file not collected as browser runtime coverage
+(53%) src/engine/api/server-api-client.js - changed JS file with browser V8 coverage
+(82%) assets/theme-v2/js/gamefoundry-partials.js - changed JS file with browser V8 coverage
+(88%) assets/theme-v2/js/login-session.js - changed JS file with browser V8 coverage

docs_build/dev/reports/remove-static-api-fallbacks-report.md

@@ -0,0 +1,71 @@
+# PR_26158_032 Remove Static API Fallbacks Report
+
+## Executive Summary
+
+Removed the PR_030/PR_031 static-only login fallback. A missing `/api/session/current` now leaves login/session mode unavailable with a visible API-required diagnostic instead of presenting Local Mem or Local DB as usable choices.
+
+API-backed Local Mem and SQLite-backed Local DB behavior remains intact behind the server API boundary.
+
+## Implementation
+
+| Area | Change | Evidence |
+| --- | --- | --- |
+| Login session UI | Removed static fallback mode data/state and now disables Local Mem/Local DB controls when session API reads fail. | `assets/theme-v2/js/login-session.js` |
+| Header/session partials | Removed the shared static diagnostic cache from PR_031; missing session API failures are not cached as success-like browser state. | `assets/theme-v2/js/gamefoundry-partials.js` |
+| Server API client | Removed static API diagnostic cache and duplicate-suppression behavior; missing API requests throw visible diagnostics through the normal client path. | `src/engine/api/server-api-client.js` |
+| Static-only Playwright | Replaced the fallback test with an API-required test that verifies disabled mode controls and actionable diagnostics. | `tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs` |
+
+## Requirement Checklist
+
+| Requirement | Evidence | Status |
+| --- | --- | --- |
+| Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` first. | Read before implementation. | PASS |
+| Remove static-only login fallback behavior added in PR_030/PR_031. | Removed `staticModeDetails`, `staticApiUnavailable`, `renderStaticApiUnavailable`, `GameFoundryStaticApiUnavailableDiagnostic`, and related cache logic. | PASS |
+| Local Mem and Local DB require the correct local API server path when login/session state depends on `/api/session/current`. | Static-only test verifies both buttons are disabled when `/api/session/current` is unavailable. | PASS |
+| If `/api/session/current` is unavailable, show a visible actionable API-required diagnostic. | Static-only test verifies `Session API required` and the route-unavailable diagnostic text. | PASS |
+| Do not pretend login/session mode is usable. | Static-only test verifies Local Mem and Local DB are disabled and not selected. | PASS |
+| Keep errors visible; do not suppress or cache missing API failures as success-like state. | Removed browser static API cache and diagnostic dedupe path from `gamefoundry-partials.js` and `server-api-client.js`. | PASS |
+| Preserve SQLite-backed Local DB behind API boundary. | `LoginSessionMode.spec.mjs` passed 5/5, including Local DB mode. | PASS |
+| Preserve real API-backed Local Mem/Local DB behavior when API server is running. | `LoginSessionMode.spec.mjs` passed 5/5. | PASS |
+| Prove `ShowOneChild.js` / `ActionableCoachmark` is external if still not repo-owned; do not add shims. | `Get-ChildItem -Path . -Recurse -Filter ShowOneChild.js -File` returned no files; scoped active HTML/JS `rg` found only test guard references. No shim added. | PASS |
+| Do not add UAT/Prod behavior. | No UAT/Prod login choices or adapter behavior changed; existing LoginSessionMode assertions still pass. | PASS |
+| Do not modify `start_of_day` folders. | `git status --short` shows no `start_of_day` changes. | PASS |
+| Run changed-file syntax checks. | `node --check` passed for changed JS/spec files. | PASS |
+| Run LoginSessionMode Playwright with API server running. | `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs` passed 5/5. | PASS |
+| Add/run static-only login test proving API-required diagnostic appears and login modes do not silently work. | `npx playwright test tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs` passed 1/1. | PASS |
+| Run ToolboxRoutePages Playwright. | `npx playwright test tests/playwright/tools/ToolboxRoutePages.spec.mjs` passed 1/1. | PASS |
+| Do not run full samples smoke unless directly impacted. | Full samples smoke skipped; samples and sample loader/framework were not touched. | PASS |
+
+## ShowOneChild / ActionableCoachmark Evidence
+
+| Check | Evidence | Result |
+| --- | --- | --- |
+| Repo-owned file search | `Get-ChildItem -Path . -Recurse -Filter ShowOneChild.js -File` returned no files. | PASS |
+| Active HTML/JS reference search | Scoped active HTML/JS `rg` found `tests/helpers/browserExtensionNoise.mjs`, `tests/playwright/tools/ApiStaticRouteRecovery.spec.mjs`, and `tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs` only. | PASS |
+| Shim check | No `ActionableCoachmark` global or shim was added. | PASS |
+
+## Validation Commands
+
+| Command | Result |
+| --- | --- |
+| `node --check assets/theme-v2/js/login-session.js` | PASS |
+| `node --check assets/theme-v2/js/gamefoundry-partials.js` | PASS |
+| `node --check src/engine/api/server-api-client.js` | PASS |
+| `node --check tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs` | PASS |
+| `npx playwright test tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs` | PASS, 1/1 |
+| `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs` | PASS, 5/5 |
+| `npx playwright test tests/playwright/tools/ToolboxRoutePages.spec.mjs` | PASS, 1/1 |
+| `git diff --check` | PASS, with Git line-ending warning only |
+
+## Skipped Lanes
+
+| Lane | Decision | Reason |
+| --- | --- | --- |
+| AdminDbViewer Playwright | SKIP | DB Viewer routes and rendering were not changed. |
+| Full samples smoke | SKIP | No sample files, sample loader, or shared sample framework changed. |
+| Full Playwright suite | SKIP | Requested targeted lanes cover the changed login/session and toolbox-route surfaces. |
+
+## Notes
+
+- Playwright emitted Node SQLite experimental warnings from the existing Local DB path. They are not introduced by this PR and did not fail validation.
+- Historical reports for PR_030/PR_031 still document the older fallback behavior; PR_032 supersedes that behavior in active runtime and test coverage.