Skip to content

Commit 6c92905

Browse files
ToolboxAidToolboxAid
committed
Add config-gated Supabase Auth and Postgres providers with DEV activation checklist - PR_26166_126-128-supabase-provider-implementation
1 parent 76c4815 commit 6c92905

8 files changed

Lines changed: 1395 additions & 132 deletions

‎docs_build/dev/reports/codex_changed_files.txt‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,22 @@
1-
# PR_26166_125-supabase-dev-provider-prep changed files
1+
# git status --short
22
M docs_build/dev/reports/codex_changed_files.txt
3-
M docs_build/dev/reports/codex_review.diff
4-
A docs_build/dev/reports/pr125-supabase-dev-provider-prep.md
3+
M docs_build/dev/reports/codex_review.diff
4+
M docs_build/dev/reports/playwright_v8_coverage_report.txt
5+
M src/dev-runtime/auth/provider-contract-stubs.mjs
6+
M tests/dev-runtime/SupabaseProviderContractStub.test.mjs
7+
?? docs_build/dev/reports/pr126-supabase-auth-provider-adapter.md
8+
?? docs_build/dev/reports/pr127-supabase-postgres-provider-adapter.md
9+
?? docs_build/dev/reports/pr128-supabase-dev-activation-checklist.md
510

6-
# Scope note
7-
Report-only DB/Auth lane continuity PR. No runtime, AI Platform, DB schema, or dependency files changed.
11+
# git ls-files --others --exclude-standard
12+
docs_build/dev/reports/pr126-supabase-auth-provider-adapter.md
13+
docs_build/dev/reports/pr127-supabase-postgres-provider-adapter.md
14+
docs_build/dev/reports/pr128-supabase-dev-activation-checklist.md
15+
16+
# git diff --stat
17+
docs_build/dev/reports/codex_changed_files.txt | 23 +-
18+
docs_build/dev/reports/codex_review.diff | 889 ++++++++++++++++++---
19+
.../dev/reports/playwright_v8_coverage_report.txt | 2 +-
20+
src/dev-runtime/auth/provider-contract-stubs.mjs | 203 ++++-
21+
.../SupabaseProviderContractStub.test.mjs | 96 ++-
22+
5 files changed, 1080 insertions(+), 133 deletions(-)

‎docs_build/dev/reports/codex_review.diff‎

Lines changed: 786 additions & 103 deletions
Large diffs are not rendered by default.

‎docs_build/dev/reports/playwright_v8_coverage_report.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Files with executed line/function counts where available:
3030
(64%) assets/theme-v2/js/tool-display-mode.js - executed lines 209/209; executed functions 9/14
3131
(67%) admin/db-viewer.js - executed lines 49/49; executed functions 4/6
3232
(76%) assets/theme-v2/js/gamefoundry-partials.js - executed lines 722/722; executed functions 52/68
33-
(85%) src/engine/api/local-db-viewer-ui.js - executed lines 479/479; executed functions 77/91
33+
(86%) src/engine/api/local-db-viewer-ui.js - executed lines 479/479; executed functions 78/91
3434
(100%) assets/theme-v2/js/admin-db-status-panel.js - executed lines 30/30; executed functions 3/3
3535
(100%) assets/theme-v2/js/login-session.js - executed lines 45/45; executed functions 7/7
3636

‎docs_build/dev/reports/pr126-supabase-auth-provider-adapter.md‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# PR_26166_126 Supabase Auth Provider Adapter
2+
3+
## Branch Validation
4+
5+
- PASS: Current branch is `main`.
6+
- Expected branch: `main`.
7+
- Starting HEAD: `76c481568 Add config-gated Supabase Auth and Postgres providers with DEV activation checklist - PR_26166_126-128-supabase-provider-implementation`.
8+
9+
## Scope Notes
10+
11+
- PASS: Stayed in the DB/Auth migration lane.
12+
- PASS: Started from `docs_build/dev/reports/pr125-supabase-dev-provider-prep.md`.
13+
- PASS: Supabase Auth remains config-gated and inactive by default.
14+
- PASS: Local DB remains the active DEV auth path by default.
15+
- PASS: No production sign-in behavior was activated for Supabase.
16+
- PASS: No secrets or password tables were added.
17+
18+
## Supabase Auth Adapter Audit
19+
20+
- PASS: Existing provider contract exposes future Auth operations:
21+
- `getCurrentUser`
22+
- `signIn`
23+
- `signOut`
24+
- `createAccount`
25+
- `requestPasswordReset`
26+
- `requireRole`
27+
- PASS: `SupabaseAuthProviderAdapter` uses browser-safe Supabase environment config only:
28+
- `GAMEFOUNDRY_SUPABASE_URL`
29+
- `GAMEFOUNDRY_SUPABASE_ANON_KEY`
30+
- PASS: Service-role values are not used by the Auth adapter.
31+
- PASS: Missing Auth config fails visibly with actionable diagnostics.
32+
- PASS: Auth user mapping remains server-owned:
33+
- external auth user id maps to `users.key`
34+
- browser-owned authoritative user keys are not allowed
35+
- PASS: Local DB placeholder sign-in remains unchanged unless the auth provider selector is explicitly switched.
36+
37+
## Secrets Audit
38+
39+
- PASS: No real Supabase URL was committed.
40+
- PASS: No real Supabase anon key was committed.
41+
- PASS: No real Supabase service-role key was committed.
42+
- PASS: No real database URL was committed.
43+
- PASS: No package dependency was added.
44+
- PASS: No custom password table or app-owned password storage was added.
45+
- PASS: Test-only sentinel strings are not real keys and are asserted not to appear in API provider diagnostics.
46+
47+
## Local DB Default Audit
48+
49+
- PASS: `/api/providers/contract` reports active auth provider `local-db`.
50+
- PASS: `/api/session/current` remains Local DB-backed through the current local session flow.
51+
- PASS: `account/sign-in.html` opens successfully through the Local API route.
52+
- PASS: Supabase Auth reports `adapter-inactive` without DEV Supabase config.
53+
54+
## Requirement Checklist
55+
56+
- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution.
57+
- PASS: Verified current branch is `main`.
58+
- PASS: Stayed in DB/Auth migration lane.
59+
- PASS: Started from PR125 report.
60+
- PASS: Scoped PR126 to Supabase Auth provider adapter validation.
61+
- PASS: Did not make Supabase active by default.
62+
- PASS: Did not add secrets.
63+
- PASS: Did not store passwords in app tables.
64+
- PASS: Kept Local DB active by default.
65+
- PASS: Supported future Auth operations through the provider contract.
66+
- PASS: Used environment config only.
67+
- PASS: Confirmed browser/API payloads never receive service-role secrets.
68+
- PASS: Missing Supabase config produces visible actionable diagnostics.
69+
- PASS: Local DB sign-in placeholder/local flow remains unchanged unless provider is explicitly switched.
70+
71+
## Validation Lane Report
72+
73+
- Impacted lane: DB/Auth provider contract and local sign-in route.
74+
- Runtime JavaScript changed in this session: Yes, shared provider diagnostics were updated during the PR127/PR128 continuation.
75+
- Playwright impacted: Yes.
76+
- Broad lanes skipped: full samples smoke, full engine, broad toolbox, full Playwright.
77+
- Skip reason: this sequence changes only provider contract diagnostics and targeted DB/Auth adapter surfaces.
78+
- Samples decision: SKIP because no sample JSON, sample loader, or game runtime file changed.
79+
- Legacy command note: `npm run test:workspace-v2` was not used because targeted provider and route validation existed; the command name remains legacy while user-facing language is Project Workspace.
80+
81+
## Commands Run
82+
83+
- PASS: `git branch --show-current` returned `main`.
84+
- PASS: `node --check src/dev-runtime/auth/provider-contract-stubs.mjs`.
85+
- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`.
86+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs` passed 9/9 tests.
87+
- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs tests/playwright/tools/AdminDbViewer.spec.mjs -g "Sign-in page uses a production-safe account form without public Local DB controls|Protected pages block direct URL access without the required Local session role|Admin DB Viewer shows current read-only Local DB tables, filters, users, roles, and diagnostics" --project=playwright --workers=1 --reporter=list` passed 3/3 tests.
88+
- PASS: `npm run dev:local-api` started through `npm.cmd` on port `5537`.
89+
- PASS: Local API route probes returned:
90+
- `/api/providers/contract`: active auth/database providers `local-db/local-db`
91+
- `/account/sign-in.html`: HTTP 200
92+
- `/admin/db-viewer.html`: HTTP 200
93+
- PASS: `git diff --check`.
94+
95+
## Manual Validation Notes
96+
97+
- The first Local API start attempt used `npm` directly and Windows rejected it as not a Win32 executable. The same package script passed through `npm.cmd`.
98+
- Playwright V8 coverage was refreshed at `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
99+
- The changed dev-runtime provider file is server-side and is listed as advisory WARN in V8 coverage; direct Node contract coverage passed.
100+
- Repo-structured ZIP path: `tmp/PR_26166_126-supabase-auth-provider-adapter_delta.zip`.

‎docs_build/dev/reports/pr127-supabase-postgres-provider-adapter.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# PR_26166_127 Supabase Postgres Provider Adapter
2+
3+
## Branch Validation
4+
5+
- PASS: Current branch is `main`.
6+
- Expected branch: `main`.
7+
8+
## Scope Notes
9+
10+
- PASS: Scoped this PR to the Supabase Postgres provider adapter surface.
11+
- PASS: Did not activate Supabase Postgres by default.
12+
- PASS: Did not migrate data.
13+
- PASS: Did not add secrets.
14+
- PASS: Kept Local DB active.
15+
- PASS: Preserved `Browser -> API/Service Contract -> Database`.
16+
17+
## Supabase Postgres Adapter Audit
18+
19+
- PASS: Added `SupabasePostgresProviderAdapter` behind the existing provider contract.
20+
- PASS: Preserved `SupabasePostgresProviderStub` as a compatibility alias to the adapter.
21+
- PASS: Missing Supabase Postgres config fails visibly with actionable diagnostics.
22+
- PASS: Adapter stays inactive unless explicitly selected/configured.
23+
- PASS: Initial provider surface supports:
24+
- `connect`
25+
- `getUsers`
26+
- `getRoles`
27+
- `getUserRoles`
28+
- `runSiteSetup`
29+
- `getDbViewerSnapshot`
30+
- PASS: Adapter restricts table access to key-based identity tables:
31+
- `users`
32+
- `roles`
33+
- `user_roles`
34+
- PASS: DB Viewer readiness is exposed through provider diagnostics.
35+
- PASS: Site Setup readiness is exposed through provider diagnostics.
36+
- PASS: Data migration remains inactive.
37+
- PASS: Server/API owns key generation through adapter-side ULID creation.
38+
- PASS: Static ULID exception remains documented as DEV seed users only.
39+
40+
## Secrets Audit
41+
42+
- PASS: Browser/API diagnostics do not expose server-only secret values.
43+
- PASS: Browser/API diagnostics do not expose server-only variable names.
44+
- PASS: No real Supabase key, URL, service-role key, or database URL was committed.
45+
- PASS: No Supabase package dependency was added.
46+
- PASS: No password table or password storage was added.
47+
48+
## Local DB Default Audit
49+
50+
- PASS: Provider snapshot keeps active auth provider as `local-db`.
51+
- PASS: Provider snapshot keeps active database provider as `local-db`.
52+
- PASS: DB Viewer route returned HTTP 200 while Local DB remained active.
53+
- PASS: Supabase Postgres reports `adapter-inactive` without DEV Supabase config.
54+
55+
## Requirement Checklist
56+
57+
- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution.
58+
- PASS: Verified current branch is `main`.
59+
- PASS: Scoped to Supabase Postgres provider adapter only.
60+
- PASS: Did not activate Supabase Postgres by default.
61+
- PASS: Did not migrate data.
62+
- PASS: Did not add secrets.
63+
- PASS: Kept Local DB active.
64+
- PASS: Implemented config-gated Supabase Postgres provider behind the DB provider contract.
65+
- PASS: Initial provider surface supports users, roles, user_roles, provider diagnostics, Site Setup readiness checks, and DB Viewer readiness checks.
66+
- PASS: Preserved Browser -> API/Service Contract -> Database.
67+
- PASS: Server/API owns key generation.
68+
- PASS: Static ULID exception remains DEV seed users only.
69+
- PASS: Missing Supabase config fails visibly with actionable diagnostics.
70+
71+
## Validation Lane Report
72+
73+
- Impacted lane: DB/Auth provider contract and Admin DB Viewer route.
74+
- Runtime JavaScript changed: Yes.
75+
- Playwright impacted: Yes.
76+
- Broad lanes skipped: full samples smoke, full engine, broad toolbox, full Playwright.
77+
- Skip reason: targeted Node and Playwright coverage exercised the changed provider contract, sign-in route, and DB Viewer route.
78+
- Samples decision: SKIP because this PR does not change samples or game runtime.
79+
- V8 coverage: `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
80+
- V8 coverage note: `(0%) src/dev-runtime/auth/provider-contract-stubs.mjs - WARNING: changed runtime JS file was not collected by Playwright V8 coverage; advisory only`.
81+
82+
## Commands Run
83+
84+
- PASS: `node --check src/dev-runtime/auth/provider-contract-stubs.mjs`.
85+
- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`.
86+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs` passed 9/9 tests.
87+
- PASS: Targeted Playwright passed 3/3 tests for DB Viewer and sign-in/session routes.
88+
- PASS: `npm run dev:local-api` started through `npm.cmd` on port `5537`.
89+
- PASS: Local API provider diagnostics confirmed:
90+
- active auth provider `local-db`
91+
- active database provider `local-db`
92+
- Supabase Postgres status `adapter-inactive`
93+
- DB Viewer readiness `false` before Supabase config
94+
- secret values exposed `false`
95+
- server-only names exposed `false`
96+
- PASS: `git diff --check`.
97+
98+
## Manual Validation Notes
99+
100+
- The adapter uses Supabase REST table endpoints only when configured/invoked and is not wired as the active DB provider.
101+
- Test-only sentinel values are used to prove server-only values are not emitted in API diagnostics; they are not real secrets.
102+
- Repo-structured ZIP path: `tmp/PR_26166_127-supabase-postgres-provider-adapter_delta.zip`.

‎docs_build/dev/reports/pr128-supabase-dev-activation-checklist.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# PR_26166_128 Supabase DEV Activation Checklist
2+
3+
## Branch Validation
4+
5+
- PASS: Current branch is `main`.
6+
- Expected branch: `main`.
7+
8+
## Scope Notes
9+
10+
- PASS: Scoped this PR to DEV activation checklist and diagnostics.
11+
- PASS: Did not activate Supabase automatically.
12+
- PASS: Did not add secrets.
13+
- PASS: Local DB remains active by default.
14+
15+
## DEV Activation Checklist
16+
17+
1. Create the reviewed Supabase DEV project outside the repo.
18+
2. Add local-only environment values outside source control:
19+
- `GAMEFOUNDRY_SUPABASE_URL`
20+
- `GAMEFOUNDRY_SUPABASE_ANON_KEY`
21+
- `GAMEFOUNDRY_SUPABASE_SERVICE_ROLE_KEY`
22+
- `GAMEFOUNDRY_SUPABASE_DATABASE_URL`
23+
3. Confirm `/api/providers/contract` reports:
24+
- `activationReadiness.supabaseAuthReady = true`
25+
- `activationReadiness.supabasePostgresReady = true`
26+
- `activationReadiness.siteSetupReady = true`
27+
- `activationReadiness.readyBeforeActivation = true`
28+
4. Switch the auth provider only after diagnostics are ready:
29+
- `GAMEFOUNDRY_AUTH_PROVIDER=supabase-auth`
30+
5. Switch the DB provider only after diagnostics are ready:
31+
- `GAMEFOUNDRY_DB_PROVIDER=supabase-postgres`
32+
6. Run Admin -> Site Setup readiness checks before setup execution.
33+
7. Migrate or map users and roles through reviewed Admin Site Setup behavior:
34+
- Supabase auth user id -> `users.key`
35+
- `roles.key`
36+
- `user_roles.userKey`
37+
- `user_roles.roleKey`
38+
8. Validate DB Viewer readiness and Local API provider diagnostics.
39+
9. Recommend the next PR only after the user creates the Supabase DEV project and local env vars.
40+
41+
## Expected Diagnostics
42+
43+
- PASS: Missing Supabase Auth config reports missing browser-safe variables.
44+
- PASS: Missing Supabase Postgres config reports missing URL/server-only credentials without exposing server-only names or values.
45+
- PASS: `activationReadiness.readyBeforeActivation` is `false` until both Auth and Postgres are configured.
46+
- PASS: `activationReadiness.readyBeforeActivation` is `true` when the required Auth and Postgres config exists.
47+
- PASS: `activationReadiness.rollback` states how to return to Local DB.
48+
- PASS: Active providers remain `local-db/local-db` until a future activation PR explicitly changes behavior.
49+
50+
## Rollback Checklist
51+
52+
1. Set `GAMEFOUNDRY_AUTH_PROVIDER=local-db`.
53+
2. Set `GAMEFOUNDRY_DB_PROVIDER=local-db`.
54+
3. Restart the Local API.
55+
4. Confirm `/api/providers/contract` reports active providers `local-db/local-db`.
56+
5. Confirm `account/sign-in.html` opens.
57+
6. Confirm `admin/db-viewer.html` opens and remains Local DB-backed.
58+
59+
## Requirement Checklist
60+
61+
- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution.
62+
- PASS: Verified current branch is `main`.
63+
- PASS: Scoped to activation checklist and diagnostics only.
64+
- PASS: Did not activate Supabase automatically.
65+
- PASS: Did not add secrets.
66+
- PASS: Added clear DEV activation checklist.
67+
- PASS: Included required env vars.
68+
- PASS: Included auth provider switch.
69+
- PASS: Included DB provider switch.
70+
- PASS: Included expected diagnostics.
71+
- PASS: Included rollback to Local DB.
72+
- PASS: Included Admin Site Setup steps.
73+
- PASS: Included user/role migration steps.
74+
- PASS: Added diagnostics that confirm whether Supabase Auth and Postgres are ready before activation.
75+
- PASS: Recommended next PR only after the user creates Supabase DEV project and env vars.
76+
77+
## Validation Lane Report
78+
79+
- Impacted lane: DB/Auth provider diagnostics.
80+
- Runtime JavaScript changed: Yes, because activation readiness diagnostics were added to provider contract output.
81+
- Playwright impacted: Yes.
82+
- Broad lanes skipped: full samples smoke, full engine, broad toolbox, full Playwright.
83+
- Skip reason: targeted provider contract, sign-in, and DB Viewer validation covered the affected route/runtime surface.
84+
- Samples decision: SKIP because samples are not in scope.
85+
- V8 coverage: `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
86+
- V8 coverage note: changed server-side dev-runtime JS is advisory WARN in browser V8 coverage and covered by Node tests.
87+
88+
## Commands Run
89+
90+
- PASS: `node --check src/dev-runtime/auth/provider-contract-stubs.mjs`.
91+
- PASS: `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`.
92+
- PASS: `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs` passed 9/9 tests.
93+
- PASS: Targeted Playwright passed 3/3 tests for DB Viewer and sign-in/session routes.
94+
- PASS: `npm run dev:local-api` started through `npm.cmd` on port `5537`.
95+
- PASS: Local API provider diagnostics confirmed:
96+
- `activationReadiness.readyBeforeActivation = false` before Supabase config
97+
- active providers `local-db/local-db`
98+
- Supabase Auth status `adapter-inactive`
99+
- Supabase Postgres status `adapter-inactive`
100+
- secret values exposed `false`
101+
- server-only names exposed `false`
102+
- PASS: `git diff --check`.
103+
104+
## Manual Validation Notes
105+
106+
- No Supabase runtime is active by default after this PR.
107+
- No UAT/PROD auth behavior changed.
108+
- No package dependency was added.
109+
- No secrets were committed.
110+
- Repo-structured ZIP path: `tmp/PR_26166_128-supabase-dev-activation-checklist_delta.zip`.

0 commit comments

Comments
 (0)