PR_26169_auth-preview-signin-regression

Fix preview sign-in fallback blocking Supabase authentication.

Author: ToolboxAid

docs_build/dev/codex_commands.md

@@ -2679,3 +2679,38 @@ Required reports:
 
 Packaging:
 - `tmp/PR_26168_247-memberships-page_delta.zip`
+
+
+## PR_26169_auth-preview-signin-regression
+
+Changes:
+- Read `docs_build/dev/PROJECT_INSTRUCTIONS.md`.
+- Verified the current branch is `main`.
+- Reviewed `account/sign-in.html`, `assets/theme-v2/js/login-session.js`, `assets/theme-v2/js/account-auth-service.js`, `assets/theme-v2/js/account-auth-actions.js`, and the Local API auth routes.
+- Changed `/api/auth/status` to report browser action availability from Supabase Auth configuration instead of strict operator preflight readiness.
+- Changed sign-in, create-account, and password-reset action gates to attempt the configured Supabase Auth provider when browser-safe auth config is present.
+- Kept strict connectivity and identity-table checks on operator preflight and post-auth session/identity resolution.
+- Preserved preview fallback behavior when Supabase Auth browser-safe config is missing.
+- Updated targeted Node and Playwright auth tests for config-gated status, safe identity failures, and real Supabase Auth calls.
+
+Validation:
+- `node --check src/dev-runtime/server/local-api-router.mjs`
+- `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `node --check tests/playwright/tools/LoginSessionMode.spec.mjs`
+- `node --test --test-name-pattern "Missing Supabase config|Configured Supabase Auth enables sign-in attempt before identity readiness|Account auth routes call external Supabase Auth|Default Supabase Auth routes call external auth|Supabase account actions fail actionably when identity tables are missing|Operator auth preflight reports failed Supabase connectivity" tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- `node node_modules/@playwright/test/cli.js test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses a production-safe|Configured account auth actions" --project=playwright --workers=1 --reporter=line`
+- `node node_modules/@playwright/test/cli.js test tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs --project=playwright --workers=1 --reporter=line`
+- `node scripts/validate-browser-env-agnostic.mjs` reported existing product-data route guardrail failures in `local-api-router.mjs`.
+- `git diff --check`
+- Full samples smoke skipped because samples and `start_of_day` folders were not touched.
+
+Required reports:
+- `docs_build/dev/reports/codex_review.diff`
+- `docs_build/dev/reports/codex_changed_files.txt`
+- `docs_build/dev/reports/PR_26169_auth-preview-signin-regression.md`
+- `docs_build/dev/reports/playwright_v8_coverage_report.txt`
+- `docs_build/dev/reports/coverage_changed_js_guardrail.txt`
+- `docs_build/dev/reports/environment_agnostic_browser_gate_report.md`
+
+Packaging:
+- `tmp/PR_26169_auth-preview-signin-regression_delta.zip`

docs_build/dev/commit_comment.txt

@@ -1,2 +1,2 @@
-PR_26168_247-memberships-page
-Add public Memberships page with Free, Creator, and Studio tiers.
+PR_26169_auth-preview-signin-regression
+Fix preview sign-in fallback blocking Supabase authentication.

docs_build/dev/reports/PR_26169_auth-preview-signin-regression.md

@@ -0,0 +1,42 @@
+# PR_26169_auth-preview-signin-regression
+
+## Branch Validation
+- PASS - Current branch is `main`.
+
+## Summary
+- Fixed the preview fallback regression by changing `/api/auth/status` to report account action availability from configured Supabase Auth browser-safe env, not strict operator preflight readiness.
+- Sign In, Create Account, and Password Reset now reach the configured Supabase Auth adapter when config is present.
+- Strict Supabase connectivity and identity-table readiness checks remain on operator preflight and post-auth session/identity resolution.
+- Missing Supabase Auth config still shows the safe preview fallback message.
+
+## Requirement Checklist
+- PASS - Reviewed `/account/sign-in.html` and related auth JS.
+- PASS - Root cause identified: `/api/auth/status` used `authStatusForRoute()`, which ran live connectivity and identity readiness checks before enabling the form.
+- PASS - Safe fallback preserved when no Supabase Auth provider/config is available.
+- PASS - Supabase config present enables Sign In and attempts real Supabase Auth.
+- PASS - Create Account and Password Reset links remain wired and covered by Playwright.
+- PASS - Existing operator preflight/toggle activation behavior remains strict and reports failed connectivity.
+- PASS - Guest/static browsing support remains available.
+- PASS - No memberships, legal, billing, marketplace, database schema, or backend enforcement changes.
+- PASS - No secrets or passwords exposed in responses or tests.
+
+## Validation Lanes
+- PASS - `node --check src/dev-runtime/server/local-api-router.mjs`
+- PASS - `node --check tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS - `node --check tests/playwright/tools/LoginSessionMode.spec.mjs`
+- PASS - Targeted Node auth route validation:
+  `node --test --test-name-pattern "Missing Supabase config|Configured Supabase Auth enables sign-in attempt before identity readiness|Account auth routes call external Supabase Auth|Default Supabase Auth routes call external auth|Supabase account actions fail actionably when identity tables are missing|Operator auth preflight reports failed Supabase connectivity" tests/dev-runtime/SupabaseProviderContractStub.test.mjs`
+- PASS - Targeted Playwright sign-in behavior:
+  `node node_modules/@playwright/test/cli.js test tests/playwright/tools/LoginSessionMode.spec.mjs --grep "Sign-in page uses a production-safe|Configured account auth actions" --project=playwright --workers=1 --reporter=line`
+- PASS - Static-only account API fallback:
+  `node node_modules/@playwright/test/cli.js test tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs --project=playwright --workers=1 --reporter=line`
+- PASS - `git diff --check` before generating `codex_review.diff`; final check also passed with `docs_build/dev/reports/codex_review.diff` excluded because the generated diff artifact contains diff-context whitespace.
+- FAIL - `node scripts/validate-browser-env-agnostic.mjs` still reports existing product-data route guardrail findings in `src/dev-runtime/server/local-api-router.mjs`; no auth-specific account service findings were reported.
+
+## Manual Validation Notes
+- With Supabase Auth URL and anon key present, `/api/auth/status` returns ready and the Sign In page enables the submit button.
+- In the targeted test fixture without a configured Postgres database, Sign In calls `/auth/v1/token?grant_type=password` and then shows the safe identity setup failure.
+- Without Supabase Auth config, the Sign In button remains disabled and shows: `Sign In is not available in this preview. You can continue browsing.`
+- Password Reset reaches Supabase Auth and returns the expected safe success copy.
+- The Playwright fixture logs known missing product-data/database resource noise for platform banner and expected 503 auth identity failures; no browser page errors were observed.
+- Runtime startup still reads `.env`; `.env.local` was not modified and no secrets were printed.

docs_build/dev/reports/codex_changed_files.txt

@@ -1,68 +1,11 @@
-# Codex Changed Files
-
-## git status --short (PR-scoped)
-
-M assets/theme-v2/js/gamefoundry-partials.js
- M assets/theme-v2/partials/footer.html
- M assets/theme-v2/partials/header-nav.html
- M docs_build/dev/codex_commands.md
- M docs_build/dev/commit_comment.txt
- M docs_build/dev/reports/codex_changed_files.txt
- M docs_build/dev/reports/codex_review.diff
- M docs_build/dev/reports/filesystem_scan_reduction_report.md
- M docs_build/dev/reports/playwright_discovery_ownership_report.md
- M docs_build/dev/reports/playwright_discovery_scope_report.md
- M docs_build/dev/reports/playwright_structure_audit.md
- M src/dev-runtime/admin/header-nav.local.html
- M tests/playwright/tools/RootToolsFutureState.spec.mjs
-?? docs_build/dev/reports/PR_26168_247-memberships-page.md
-?? memberships/index.html
-?? tests/playwright/tools/PublicMembershipsPage.spec.mjs
-
-## git diff --stat (PR-scoped)
-
-assets/theme-v2/js/gamefoundry-partials.js         |  3 +-
- assets/theme-v2/partials/footer.html               |  1 +
- assets/theme-v2/partials/header-nav.html           |  8 ++++-
- docs_build/dev/codex_commands.md                   | 36 ++++++++++++++++++++++
- docs_build/dev/commit_comment.txt                  |  3 +-
- .../reports/filesystem_scan_reduction_report.md    |  2 +-
- .../playwright_discovery_ownership_report.md       |  6 ++--
- .../reports/playwright_discovery_scope_report.md   |  6 ++--
- .../dev/reports/playwright_structure_audit.md      |  8 ++---
- src/dev-runtime/admin/header-nav.local.html        |  8 ++++-
- .../playwright/tools/RootToolsFutureState.spec.mjs |  4 +--
- 11 files changed, 65 insertions(+), 20 deletions(-)
- .../dev/reports/PR_26168_247-memberships-page.md   | 90 ++++++++++++++++++++++
- 1 file changed, 90 insertions(+)
- /dev/null => memberships/index.html | 122 ++++++++++++++++++++++++++++++++++++
- 1 file changed, 122 insertions(+)
- .../tools/PublicMembershipsPage.spec.mjs           | 110 +++++++++++++++++++++
- 1 file changed, 110 insertions(+)
- docs_build/dev/reports/codex_changed_files.txt |  108 +-
- docs_build/dev/reports/codex_review.diff       | 1918 +++++++-----------------
- 2 files changed, 603 insertions(+), 1423 deletions(-)
-
-## Full working tree note
-
-- Unrelated pre-existing working tree change remains: `D test.sql` (excluded from PR diff and ZIP).
-
-## Full git status --short
-
-M assets/theme-v2/js/gamefoundry-partials.js
- M assets/theme-v2/partials/footer.html
- M assets/theme-v2/partials/header-nav.html
- M docs_build/dev/codex_commands.md
- M docs_build/dev/commit_comment.txt
- M docs_build/dev/reports/codex_changed_files.txt
- M docs_build/dev/reports/codex_review.diff
- M docs_build/dev/reports/filesystem_scan_reduction_report.md
- M docs_build/dev/reports/playwright_discovery_ownership_report.md
- M docs_build/dev/reports/playwright_discovery_scope_report.md
- M docs_build/dev/reports/playwright_structure_audit.md
- M src/dev-runtime/admin/header-nav.local.html
- D test.sql
- M tests/playwright/tools/RootToolsFutureState.spec.mjs
-?? docs_build/dev/reports/PR_26168_247-memberships-page.md
-?? memberships/index.html
-?? tests/playwright/tools/PublicMembershipsPage.spec.mjs
+docs_build/dev/codex_commands.md
+docs_build/dev/commit_comment.txt
+docs_build/dev/reports/PR_26169_auth-preview-signin-regression.md
+docs_build/dev/reports/codex_changed_files.txt
+docs_build/dev/reports/codex_review.diff
+docs_build/dev/reports/coverage_changed_js_guardrail.txt
+docs_build/dev/reports/environment_agnostic_browser_gate_report.md
+docs_build/dev/reports/playwright_v8_coverage_report.txt
+src/dev-runtime/server/local-api-router.mjs
+tests/dev-runtime/SupabaseProviderContractStub.test.mjs
+tests/playwright/tools/LoginSessionMode.spec.mjs