Verify DEV auth identity link

Author: ToolboxAid

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md

@@ -16,8 +16,19 @@ PASS
 - PASS `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
 - PASS `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
 - PASS `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- PASS `node --check src/dev-runtime/toolbox-api/alfa-tool-services.mjs`
+- PASS `node --check dev/scripts/sync-supabase-dev-creator-identities.mjs`
+- PASS `node --check dev/tests/dev-runtime/TagsApiService.test.mjs`
 - PASS `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
 - PASS `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`
 - PASS `git diff --check`
 - PASS `npm run validate:canonical-structure`
 
+## DEV Identity Verification
+
+- PASS `qbytes.dq@gmail.com` exists in Supabase Auth.
+- PASS `qbytes.dq@gmail.com` exists in product `users`.
+- PASS `users.authProviderUserId` matches Supabase Auth id.
+- PASS DEV identity sync ran with password updates disabled.
+- PASS `/api/auth/sign-in` resolves qbytes to the database `users.key`.

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md

@@ -1,14 +1,16 @@
 # Manual Validation Notes: PR_26179_OWNER_035-dev-auth-user-key-db-authority
 
-Manual browser validation was not run because this PR changes server-side auth/session resolution and DEV identity sync behavior. The targeted API-level tests cover the affected user-visible outcomes:
+Manual browser validation was not run because this PR changes server-side auth/session resolution and DEV identity sync behavior. The targeted API-level tests and live API sign-in smoke cover the affected user-visible outcomes:
 
 - A valid Supabase Auth id linked to `users.authProviderUserId` signs in and returns the database-owned `users.key`.
 - A matching email with stale `users.authProviderUserId` does not sign in and returns the existing Creator-safe identity setup message.
 - The browser response does not expose raw Auth ids or database user keys on the failure path.
 
-Recommended manual follow-up in DEV after merge:
-
-- Run the approved DEV identity sync.
-- Sign in as `qbytes.dq@gmail.com`.
-- Confirm the session resolves to the existing database `users.key` row whose `authProviderUserId` equals the Supabase Auth user id.
+Live DEV notes:
 
+- Initial audit found Supabase Auth present but product `users` missing for `qbytes.dq@gmail.com`.
+- The missing database row was caused by a toolbox helper upserting seed users over the reserved account keys.
+- The helper was fixed so toolbox seeding no longer upserts `users`.
+- The approved DEV account DML restored the missing rows.
+- DEV identity sync ran with password updates disabled.
+- Final `/api/auth/sign-in` smoke for `qbytes.dq@gmail.com` passed and resolved to the database `users.key`.

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md

@@ -33,11 +33,40 @@ Runtime sign-in now resolves a session only when the Supabase Auth user id match
 - Added a narrow server-side Postgres client injection hook for tests, with default runtime behavior unchanged.
 - Refactored DEV creator identity sync so canonical identity definitions are email-based and database `users.key` is read from existing rows.
 - Changed role assignment and cleanup repair logic to derive canonical user keys from database rows.
+- Removed the Alfa toolbox tag/design/configuration helper behavior that upserted seed `users` rows over the static DEV account keys.
+- Changed the DEV identity sync default so existing Supabase Auth users are updated without sending a password. Password updates now require an explicit `--update-passwords` flag.
 - Added regression tests proving:
   - Sign-in uses the database-owned `users.key` matched by `authProviderUserId`.
   - Sign-in does not create a session from matching email when `authProviderUserId` is stale.
   - DEV sync preserves non-seed database user keys.
   - DEV sync fails if an expected database `users` row is missing.
+  - Tags API seeding does not upsert rows into `users`.
+  - Existing Auth user sync does not send a password by default.
+
+## DEV Database Verification
+
+Performed against the current `.env` DEV database target.
+
+Initial audit:
+
+- `qbytes.dq@gmail.com` existed in Supabase Auth.
+- `qbytes.dq@gmail.com` was missing from the product `users` table.
+- The reserved static DEV account keys for User 1 and DavidQ had been overwritten by seed `Creator` / `Forge Bot` rows.
+
+Repair and sync:
+
+- Re-applied the approved DEV account DML to restore the missing database identity rows.
+- Ran the DEV identity sync with `updatePasswords: false`.
+- qbytes sync action: `updated`.
+- qbytes password update: `false`.
+
+Final audit:
+
+- Supabase Auth match count: `1`.
+- Product `users` match count: `1`.
+- `users.authProviderUserId` equals Supabase Auth `auth.users.id`: PASS.
+- Sign-in smoke through `/api/auth/sign-in`: PASS.
+- Session resolved to the database `users.key`: PASS.
 
 ## Files Changed
 
@@ -54,8 +83,11 @@ PASS:
 - `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`
 - `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
 - `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
+- `node --check src/dev-runtime/toolbox-api/alfa-tool-services.mjs`
+- `node --check dev/scripts/sync-supabase-dev-creator-identities.mjs`
+- `node --check dev/tests/dev-runtime/TagsApiService.test.mjs`
 - `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
 - `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`
 - `git diff --check`
 - `npm run validate:canonical-structure`
-

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md

@@ -11,8 +11,15 @@
 - PASS Do not add password tables.
 - PASS Do not use `displayName` as an identity key.
 - PASS Do not hardcode DavidQ/user keys in runtime login resolution.
+- PASS Verify qbytes exists in Supabase Auth.
+- PASS Verify qbytes exists in the product `users` table.
+- PASS Verify `users.authProviderUserId` equals Supabase Auth id.
+- PASS If the database row/link is stale, run DEV identity sync.
+- PASS Do not change password during existing Auth user sync.
+- PASS Do not recreate qbytes Auth user because it already exists.
+- PASS Do not use email fallback for session resolution.
+- PASS Re-test sign-in after sync.
 - PASS Report where `users.key` currently comes from.
 - PASS Report where `authProviderUserId` is populated.
 - PASS Report whether seed constants are setup-only or runtime identity authority.
 - PASS Report exact fix.
-

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md

@@ -8,11 +8,14 @@ Targeted auth and DEV identity sync validation.
 
 - PASS `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`
 - PASS `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`
+- PASS live DEV identity audit and sign-in smoke for `qbytes.dq@gmail.com`
 
 ## Coverage
 
 - DEV identity sync reads existing database `users.key` values by email.
 - DEV identity sync writes real Supabase Auth ids to `users.authProviderUserId`.
+- Existing Auth user sync does not update passwords by default.
 - Session resolution accepts only `auth.users.id` matched to `users.authProviderUserId`.
 - Email-only session resolution is rejected with the existing Creator-safe setup message.
-
+- Tags API setup no longer writes seed rows to the account `users` table.

dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md

@@ -10,8 +10,21 @@ PASS
 - `node --check src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs`: PASS
 - `node --check dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS
 - `node --check dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`: PASS
+- `node --check src/dev-runtime/toolbox-api/alfa-tool-services.mjs`: PASS
+- `node --check dev/scripts/sync-supabase-dev-creator-identities.mjs`: PASS
+- `node --check dev/tests/dev-runtime/TagsApiService.test.mjs`: PASS
 - `node --test dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`: PASS, 2 tests
 - `node --test --test-name-pattern "Supabase sign-in resolves|Supabase sign-in does not" dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: PASS, 2 tests
+- `node --test dev/tests/dev-runtime/TagsApiService.test.mjs`: PASS, 3 tests
+
+## Live DEV Validation
+
+- PASS Initial audit detected Supabase Auth user for `qbytes.dq@gmail.com`.
+- PASS Initial audit detected missing/stale product `users` row and halted sign-in retest.
+- PASS Approved DEV account DML restored the missing identity rows.
+- PASS DEV identity sync completed with `updatePasswords: false`.
+- PASS Final audit verified `users.authProviderUserId` equals Supabase Auth id.
+- PASS `/api/auth/sign-in` returned HTTP 200 and resolved the session to the database `users.key`.
 
 ## Repository Guardrails
 
@@ -21,4 +34,3 @@ PASS
 ## Notes
 
 The targeted tests use a server-side Postgres client fixture to exercise the Local API route without opening a real database connection. Default runtime behavior remains unchanged because the injected client defaults to `null`.
-

dev/reports/codex_changed_files.txt

@@ -1,26 +1,52 @@
 # git status --short
-M dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs
- M dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs
- M src/dev-runtime/server/local-api-router.mjs
+M dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md
+ M dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md
+ M dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md
+ M dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md
+ M dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md
+ M dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md
+ M dev/reports/codex_changed_files.txt
+ M dev/reports/codex_review.diff
+ M dev/scripts/sync-supabase-dev-creator-identities.mjs
+ M dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs
+ M dev/tests/dev-runtime/TagsApiService.test.mjs
  M src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs
-?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md
-?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md
-?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md
-?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md
-?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md
-?? dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md
+ M src/dev-runtime/toolbox-api/alfa-tool-services.mjs
+
+# git diff --name-status main
+A	dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md
+A	dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md
+A	dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md
+A	dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md
+A	dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md
+A	dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md
+M	dev/reports/codex_changed_files.txt
+M	dev/reports/codex_review.diff
+M	dev/scripts/sync-supabase-dev-creator-identities.mjs
+M	dev/tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs
+M	dev/tests/dev-runtime/SupabaseProviderContractStub.test.mjs
+M	dev/tests/dev-runtime/TagsApiService.test.mjs
+M	src/dev-runtime/server/local-api-router.mjs
+M	src/dev-runtime/testing/supabase-dev-creator-identity-seed-sync.mjs
+M	src/dev-runtime/toolbox-api/alfa-tool-services.mjs
 
 # git ls-files --others --exclude-standard
-dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_branch_validation.md
-dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_manual_validation_notes.md
-dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_report.md
-dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_requirement_checklist.md
-dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_lane_report.md
-dev/reports/PR_26179_OWNER_035-dev-auth-user-key-db-authority_validation_report.md
+(no output)
 
-# git diff --stat
-.../SupabaseDevCreatorIdentitySeedSync.test.mjs    | 188 ++++++++++++++-------
- .../SupabaseProviderContractStub.test.mjs          | 138 ++++++++++++++-
- src/dev-runtime/server/local-api-router.mjs        |  24 ++-
- .../supabase-dev-creator-identity-seed-sync.mjs    | 155 +++++++++++------
- 4 files changed, 391 insertions(+), 114 deletions(-)
+# git diff --stat main
+...auth-user-key-db-authority_branch_validation.md |  34 ++
+ ...ser-key-db-authority_manual_validation_notes.md |  16 +
+ ...ER_035-dev-auth-user-key-db-authority_report.md |  93 +++++
+ ...-user-key-db-authority_requirement_checklist.md |  25 ++
+ ...user-key-db-authority_validation_lane_report.md |  21 +
+ ...auth-user-key-db-authority_validation_report.md |  36 ++
+ dev/reports/codex_changed_files.txt                |  33 +-
+ dev/reports/codex_review.diff                      | 448 ++++++++++++++++-----
+ .../sync-supabase-dev-creator-identities.mjs       |   5 +-
+ .../SupabaseDevCreatorIdentitySeedSync.test.mjs    | 192 ++++++---
+ .../SupabaseProviderContractStub.test.mjs          | 138 ++++++-
+ dev/tests/dev-runtime/TagsApiService.test.mjs      |   1 +
+ src/dev-runtime/server/local-api-router.mjs        |  24 +-
+ .../supabase-dev-creator-identity-seed-sync.mjs    | 167 +++++---
+ src/dev-runtime/toolbox-api/alfa-tool-services.mjs |  31 --
+ 15 files changed, 996 insertions(+), 268 deletions(-)