|
| 1 | +# PR_26166_145-supabase-users-roles-cutover |
| 2 | + |
| 3 | +## Branch Validation |
| 4 | +- PASS: current branch `main`. |
| 5 | +- Expected branch: `main`. |
| 6 | + |
| 7 | +## Requirement Checklist |
| 8 | +- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before changes. |
| 9 | +- PASS: Browser continues to use backend API routes only; no browser Supabase/local-db switching was added. |
| 10 | +- PASS: Identity ownership is explicit in the provider contract for `users`, `roles`, and `user_roles` through `identityOwnership`. |
| 11 | +- PASS: Supabase Auth selected path reads identity rows server-side while `GAMEFOUNDRY_DB_PROVIDER=local-db` keeps product data on Local DB. |
| 12 | +- PASS: No games/assets/objects/controls/palettes/tags/workspace/tool metadata/product tables were migrated. |
| 13 | +- PASS: DEV static ULID exception remains documented for User 1, User 2, User 3, and DavidQ admin only. |
| 14 | +- PASS: Ownership fields are declared for identity records: `key`, `createdAt`, `updatedAt`, `createdBy`, `updatedBy`. |
| 15 | +- PASS: `users.key` remains the authoritative ownership reference. |
| 16 | +- PASS: No browser-generated authoritative keys were added. |
| 17 | +- PASS: No password tables or local password storage were added. |
| 18 | +- PASS: No secrets or `.env` files were added. |
| 19 | +- PASS: No silent fallback was added; selected providers are authoritative and missing identity/role rows fail visibly. |
| 20 | + |
| 21 | +## Implementation Summary |
| 22 | +- `src/dev-runtime/auth/provider-contract-stubs.mjs`: added `identityOwnership` contract fields describing auth-owned identity tables, owner provider, reader provider, product DB provider, ownership fields, static DEV user exception, and no browser-owned keys. |
| 23 | +- `src/dev-runtime/server/local-api-router.mjs`: added provider-aware async session helpers for Supabase Auth selected with Local DB product data; session routes now resolve identity through server-side Supabase identity table reads. |
| 24 | +- `tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: added coverage for identity ownership contract, Supabase selected identity lookup, role lookup, user_roles lookup, missing-user diagnostics, and missing-role diagnostics. |
| 25 | + |
| 26 | +## Validation Lane Report |
| 27 | +- PASS: changed-file syntax checks: |
| 28 | + - `node --check src/dev-runtime/auth/provider-contract-stubs.mjs` |
| 29 | + - `node --check src/dev-runtime/server/local-api-router.mjs` |
| 30 | + - `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs` |
| 31 | +- PASS: targeted auth identity validation: |
| 32 | + - `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs` |
| 33 | + - Result: 21 passed. |
| 34 | +- PASS: Supabase selected path with Local DB product data: |
| 35 | + - Test env used `GAMEFOUNDRY_AUTH_PROVIDER=supabase-auth` and `GAMEFOUNDRY_DB_PROVIDER=local-db` against a fake Supabase service. |
| 36 | + - Validated `users`, `roles`, and `user_roles` REST reads through server-side provider contract. |
| 37 | +- PASS: missing-user visible failure: |
| 38 | + - `POST /api/session/user` with a missing user key returns an unauthenticated session with actionable diagnostic. |
| 39 | +- PASS: missing-role visible failure: |
| 40 | + - `POST /api/session/user` with `user_roles.roleKey` pointing to a missing role returns an unauthenticated session with actionable diagnostic. |
| 41 | +- PASS: workspace-v2 validation: |
| 42 | + - `npm run test:workspace-v2` |
| 43 | + - Result: 5 Playwright tests passed. |
| 44 | +- PASS: diff guardrail: |
| 45 | + - `git diff --check` |
| 46 | + - Result: no whitespace errors; line-ending warnings only. |
| 47 | + |
| 48 | +## Playwright / V8 Coverage |
| 49 | +- Playwright impacted: Yes. |
| 50 | +- PASS: `npm run test:workspace-v2` passed. |
| 51 | +- PASS: `docs_build/dev/reports/playwright_v8_coverage_report.txt` generated for changed runtime JavaScript files using targeted Node V8 coverage from auth identity tests. |
| 52 | + |
| 53 | +## Impacted Lanes |
| 54 | +- Auth/session provider contract lane. |
| 55 | +- Local API session route lane. |
| 56 | +- Workspace-v2 Playwright validation lane because runtime auth/session behavior changed. |
| 57 | + |
| 58 | +## Skipped Lanes |
| 59 | +- Samples smoke: SKIP. This PR changes auth/session provider contracts only and does not alter sample runtime behavior. |
| 60 | +- Full product DB migration validation: SKIP. Requirement explicitly keeps non-auth product data on Local DB and forbids product table migration. |
| 61 | + |
| 62 | +## Manual Validation Notes |
| 63 | +- Start dev server with `GAMEFOUNDRY_AUTH_PROVIDER=supabase-auth` and `GAMEFOUNDRY_DB_PROVIDER=local-db`. |
| 64 | +- Ensure Supabase URL, anon key, and service-role key are present in local environment only. |
| 65 | +- Call `/api/providers/contract` and verify `identityOwnership.ownerProviderId=supabase-auth`, `readerProviderId=supabase-postgres`, and `productDatabaseProviderId=local-db`. |
| 66 | +- Call `/api/session/users` and verify identity users resolve through server API. |
| 67 | +- Call `/api/session/user` with a valid seeded DEV user key and verify role slugs resolve from `user_roles` and `roles`. |
| 68 | +- Call `/api/local-db/snapshot` and verify product tables remain Local DB-backed. |
| 69 | + |
| 70 | +## Changed Files |
| 71 | +See `docs_build/dev/reports/codex_changed_files.txt` for the generated changed-file list. |
0 commit comments