|
| 1 | +# PR_26166_146-supabase-auth-default-provider |
| 2 | + |
| 3 | +## Branch Validation |
| 4 | +- PASS: current branch `main`. |
| 5 | +- Expected branch: `main`. |
| 6 | + |
| 7 | +## Requirement Checklist |
| 8 | +- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before changes. |
| 9 | +- PASS: Default auth provider selection changed from `local-db` to `supabase-auth` in the provider contract. |
| 10 | +- PASS: `GAMEFOUNDRY_DB_PROVIDER` remains `local-db` by default. |
| 11 | +- PASS: Product data remains on Local DB; no product table migration was added. |
| 12 | +- PASS: `users`, `roles`, and `user_roles` remain provider-owned through the identity ownership contract from PR145. |
| 13 | +- PASS: Browser pages continue using backend API contracts only; no browser-side provider branching was added. |
| 14 | +- PASS: Sign In, Create Account, and Password Reset route through Supabase Auth by default when config exists. |
| 15 | +- PASS: Missing Supabase configuration fails visibly with the production-safe unavailable message and no local-db auth fallback. |
| 16 | +- PASS: Guest browsing remains enabled; unauthenticated sessions still return guest state. |
| 17 | +- PASS: Guest save redirects were not changed. |
| 18 | +- PASS: No password tables or local password storage were added. |
| 19 | +- PASS: No secrets were committed. |
| 20 | +- PASS: No user `.env.local` files were modified. |
| 21 | + |
| 22 | +## Implementation Summary |
| 23 | +- `.env.example`: documents `GAMEFOUNDRY_AUTH_PROVIDER=supabase-auth` with `GAMEFOUNDRY_DB_PROVIDER=local-db`; Supabase values remain blank. |
| 24 | +- `src/dev-runtime/auth/provider-contract-stubs.mjs`: adds explicit default provider constants and changes the auth default to `supabase-auth`; keeps database default as `local-db`; marks the Supabase Auth adapter active-by-default while still config-gated. |
| 25 | +- `tests/dev-runtime/SupabaseProviderContractStub.test.mjs`: adds default startup, missing-config, and configured default Sign In/Create Account/Password Reset coverage. |
| 26 | +- `tests/playwright/tools/RootToolsFutureState.spec.mjs`: explicitly selects Local DB auth for the legacy toolbox workspace-contract test file so its local-admin session setup remains deterministic under the new global auth default. |
| 27 | + |
| 28 | +## Validation Lane Report |
| 29 | +- PASS: changed-file syntax/static checks: |
| 30 | + - `node --check src/dev-runtime/auth/provider-contract-stubs.mjs` |
| 31 | + - `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs` |
| 32 | + - `node --check tests/playwright/tools/RootToolsFutureState.spec.mjs` |
| 33 | +- PASS: targeted auth/provider validation: |
| 34 | + - `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs` |
| 35 | + - Result: 23 passed. |
| 36 | +- PASS: default startup selects Supabase Auth: |
| 37 | + - Test validates no `GAMEFOUNDRY_AUTH_PROVIDER` selects `supabase-auth` and no `GAMEFOUNDRY_DB_PROVIDER` selects `local-db`. |
| 38 | +- PASS: configured path: |
| 39 | + - Test validates default Sign In/Create Account/Password Reset calls route to the fake external Supabase Auth service when browser-safe config is present. |
| 40 | +- PASS: missing-config path: |
| 41 | + - Test validates default startup with no Supabase config returns visible unavailable state and rejects sign-in with no local-db fallback. |
| 42 | +- PASS: Playwright impacted lane: |
| 43 | + - `npm run test:workspace-v2` |
| 44 | + - Result: 5 passed. |
| 45 | + - Note: first run exposed a legacy workspace-contract local-auth assumption; the test file now explicitly selects Local DB auth for that non-auth lane and final rerun passed. |
| 46 | +- PASS: V8 coverage: |
| 47 | + - `docs_build/dev/reports/playwright_v8_coverage_report.txt` |
| 48 | + - Covers changed runtime JS: `src/dev-runtime/auth/provider-contract-stubs.mjs`. |
| 49 | +- PASS: diff guardrail: |
| 50 | + - `git diff --check` |
| 51 | + - Result: no whitespace errors; line-ending warnings only. |
| 52 | + |
| 53 | +## Impacted Lanes |
| 54 | +- Auth/provider contract lane. |
| 55 | +- Auth action routing lane. |
| 56 | +- Workspace-contract Playwright lane because the default auth provider changed. |
| 57 | + |
| 58 | +## Skipped Lanes |
| 59 | +- Full samples smoke: SKIP. This PR changes auth provider defaults and auth/session validation only; no sample runtime behavior changed. |
| 60 | +- Product DB migration: SKIP. Requirement explicitly keeps product data on Local DB and does not migrate product tables. |
| 61 | + |
| 62 | +## Manual Validation Notes |
| 63 | +- Start the Local API without `GAMEFOUNDRY_AUTH_PROVIDER`; call `/api/auth/status` and verify `authProviderId=supabase-auth`, `databaseProviderId=local-db`, and missing config reports the generic unavailable message. |
| 64 | +- Add local Supabase URL and anon key in the local environment only; call `/api/auth/sign-in`, `/api/auth/create-account`, and `/api/auth/password-reset` and verify they route through backend auth APIs. |
| 65 | +- Confirm `.env.example` has blank Supabase URL/key values and no secrets. |
| 66 | +- Confirm `.env.local` or user env files are unchanged. |
| 67 | + |
| 68 | +## Changed Files |
| 69 | +See `docs_build/dev/reports/codex_changed_files.txt`. |
0 commit comments