Sync DEV Creator identities and remove duplicate test accounts - PR_26167_185-dev-creator-identity-seed-sync

Author: ToolboxAid

docs_build/database/dml/DML_INDEX.md

@@ -2,11 +2,11 @@
 
 This index classifies each grouped DEV/review DML file.
 
-Direct SQL setup is intentionally narrow. Account DEV users are SQL-executable so local sign-in scripts can target stable seeded users. Non-user setup is server-seed-owned so direct SQL does not bypass server/API key generation or audit ownership.
+Direct SQL setup is intentionally narrow. Account DEV users now require server-side Supabase Auth synchronization so `users.authProviderUserId` matches real `auth.users.id` values. Non-user setup is server-seed-owned so direct SQL does not bypass server/API key generation or audit ownership.
 
 | Group | File | Status | Owner |
 | --- | --- | --- | --- |
-| Account | `account.sql` | SQL-executable | DEV static user seed only |
+| Account | `account.sql` | Review-only | DEV static user shape; execute through server-side sync only |
 | Admin | `admin.sql` | Server-seed-owned | Admin Site Setup/server-side seed API |
 | Asset | `asset.sql` | Server-seed-owned | Server-side seed API |
 | Controls | `controls.sql` | Server-seed-owned | Server-side seed API |
@@ -29,7 +29,7 @@ Static ULIDs are allowed only for these DEV user records and required user-role
 - User 1
 - User 2
 - User 3
-- DavidQ admin
+- DavidQ
 
 All non-user records must use server/API-generated ULID-style keys.
 

docs_build/database/dml/account.sql

@@ -2,15 +2,17 @@
 -- Group: Account
 -- Ownership: docs_build/database/dml/account.sql
 -- DEV review only. Codex may execute DEV database setup only.
--- DML status: SQL-executable DEV static user seed.
+-- DML status: review-only DEV static user shape.
 -- UAT and production SQL execution is user-controlled.
 -- Runtime reseed/setup must be called through Admin-owned server-side APIs.
+-- Supabase Auth identity sync must use scripts/sync-supabase-dev-creator-identities.mjs.
 -- Target DEV database: gamefoundry_dev
 -- Temporary DEV static user ULID exception:
---   Static ULIDs are allowed only for User 1, User 2, User 3, and DavidQ admin.
+--   Static ULIDs are allowed only for User 1, User 2, User 3, and DavidQ.
 --   Static ULIDs are allowed for user_roles only to bind these DEV users to existing roles.
 --   Non-user records, including roles, must use real server/API-generated keys.
 -- No passwords, password hashes, password reset tokens, or authProvider='mock' records are defined here.
+-- authProviderUserId values must be replaced by the server-side sync with real auth.users.id values before runtime validation.
 
 INSERT INTO users (
     key,
@@ -29,7 +31,7 @@ VALUES
         '01K2GFSJ0Y0000000000000051',
         'User 1',
         'user1@example.invalid',
-        'dev-static-seed',
+        'supabase-auth',
         'user-1',
         true,
         now(),
@@ -41,7 +43,7 @@ VALUES
         '01K2GFSJ0Y0000000000000052',
         'User 2',
         'user2@example.invalid',
-        'dev-static-seed',
+        'supabase-auth',
         'user-2',
         true,
         now(),
@@ -53,7 +55,7 @@ VALUES
         '01K2GFSJ0Y0000000000000053',
         'User 3',
         'user3@example.invalid',
-        'dev-static-seed',
+        'supabase-auth',
         'user-3',
         true,
         now(),
@@ -63,10 +65,10 @@ VALUES
     ),
     (
         '01K2GFSJ0Y0000000000000054',
-        'DavidQ admin',
-        'admin@example.invalid',
-        'dev-static-seed',
-        'davidq-admin',
+        'DavidQ',
+        'qbytes.dq@gmail.com',
+        'supabase-auth',
+        'davidq',
         true,
         now(),
         now(),
@@ -92,8 +94,7 @@ BEGIN
         VALUES
             ('admin'),
             ('creator'),
-            ('guest'),
-            ('user')
+            ('guest')
     ) AS required_roles(role_slug)
     LEFT JOIN roles ON roles."roleSlug" = required_roles.role_slug
     WHERE roles.key IS NULL;
@@ -105,11 +106,10 @@ END $$;
 
 WITH user_role_seed (user_role_key, user_key, role_slug) AS (
     VALUES
-        ('01K2GFSJ0Y0000000000000082', '01K2GFSJ0Y0000000000000051', 'user'),
-        ('01K2GFSJ0Y0000000000000083', '01K2GFSJ0Y0000000000000052', 'user'),
-        ('01K2GFSJ0Y0000000000000084', '01K2GFSJ0Y0000000000000053', 'user'),
-        ('01K2GFSJ0Y0000000000000085', '01K2GFSJ0Y0000000000000054', 'user'),
-        ('01K2GFSJ0Y0000000000000086', '01K2GFSJ0Y0000000000000054', 'admin')
+        ('01K2GFSJ0Y0000000000000082', '01K2GFSJ0Y0000000000000051', 'creator'),
+        ('01K2GFSJ0Y0000000000000083', '01K2GFSJ0Y0000000000000052', 'creator'),
+        ('01K2GFSJ0Y0000000000000084', '01K2GFSJ0Y0000000000000053', 'creator'),
+        ('01K2GFSJ0Y0000000000000085', '01K2GFSJ0Y0000000000000054', 'creator')
 ),
 resolved_user_roles AS (
     SELECT

docs_build/database/seed/account.json

@@ -21,27 +21,27 @@
         "key": "01K2GFSJ0Y0000000000000053"
       },
       {
-        "displayName": "DavidQ admin",
+        "displayName": "DavidQ",
         "key": "01K2GFSJ0Y0000000000000054"
       }
     ],
     "staticUserRoleKeysAllowedOnlyFor": [
       "01K2GFSJ0Y0000000000000082",
       "01K2GFSJ0Y0000000000000083",
       "01K2GFSJ0Y0000000000000084",
-      "01K2GFSJ0Y0000000000000085",
-      "01K2GFSJ0Y0000000000000086"
+      "01K2GFSJ0Y0000000000000085"
     ]
   },
   "tables": {
     "users": {
       "mode": "server-side-upsert",
-      "authProvider": "dev-static-seed",
+      "authProvider": "supabase-auth",
       "passwordStorage": "none"
     },
     "roles": {
       "mode": "server-api-generated-keys",
-      "requiredRoleSlugs": ["admin", "creator", "guest", "user"]
+      "requiredRoleSlugs": ["admin", "creator", "guest"],
+      "deprecatedRoleSlugs": ["user"]
     },
     "user_roles": {
       "mode": "server-side-upsert",

docs_build/database/seed/account/supabase-dev-identity-bootstrap.md

@@ -1,6 +1,6 @@
 # Supabase DEV Identity Bootstrap
 
-Use this only for the DEV Supabase project while product data remains on Local DB.
+Use this only for the DEV Supabase project. Identity seeding is server-side only so app `users.authProviderUserId` values stay synchronized with real Supabase Auth `auth.users.id` values.
 
 ## Bootstrap Order
 
@@ -11,24 +11,29 @@ Use this only for the DEV Supabase project while product data remains on Local D
    - `users table`
    - `roles table`
    - `user_roles table`
-4. Keep `GAMEFOUNDRY_DB_PROVIDER=local-db`.
+4. Run `node .\scripts\sync-supabase-dev-creator-identities.mjs` against DEV only.
 
 ## Seed Rules
 
 - Passwords remain owned by Supabase Auth.
 - Do not create password tables.
 - Browser JavaScript must not generate authoritative identity keys.
 - Create Account provisions app `users`, `roles`, and `user_roles` records server-side.
+- Static DEV identity sync provisions only User 1, User 2, User 3, and DavidQ.
+- Authenticated users receive the `creator` role by default.
+- The `guest` role remains for unauthenticated browsing.
+- The `admin` role is preserved only for actual admin assignments.
+- The legacy `user` role is deprecated and inactive.
 - Static DEV user ULIDs are allowed only for these DEV seed users:
   - User 1: `01K2GFSJ0Y0000000000000051`
   - User 2: `01K2GFSJ0Y0000000000000052`
   - User 3: `01K2GFSJ0Y0000000000000053`
-  - DavidQ admin: `01K2GFSJ0Y0000000000000054`
+  - DavidQ: `01K2GFSJ0Y0000000000000054`
 - Do not use static keys for games, assets, objects, controls, votes, tickets, tool metadata, tool planning, tool state records, guest seed data, roles, or user_roles.
 - Do not use `authProvider: mock` for Supabase account identity records.
 
 ## Existing Auth Users
 
 For existing DEV Supabase Auth users, provision app identity through the server/API provisioning path so the `users.authProviderUserId` value matches the real Supabase Auth user id.
 
-Do not commit Supabase Auth user ids, access tokens, service role keys, or database URLs.
+Do not commit Supabase Auth user ids, access tokens, service role keys, database URLs, or DEV identity passwords in reports.

docs_build/dev/reports/PR_26167_185-dev-creator-identity-seed-sync.md

@@ -0,0 +1,102 @@
+# PR_26167_185-dev-creator-identity-seed-sync
+
+## Overall Result
+
+FAIL / blocked.
+
+The implementation was prepared and targeted validation passed, but the live DEV seed/sync could not complete because Supabase Auth rejected the requested User 1/User 2/User 3 password values as shorter than the project minimum password length. Supabase returned HTTP 422: password must be at least 6 characters. Supabase settings were not changed.
+
+## Branch Validation
+
+PASS - current branch was `main` before changes.
+
+## Requirement Checklist
+
+- PASS - Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` first.
+- PASS - Hard stop branch check passed on `main`.
+- PASS - DEV-only sync path added under server-side scripts/runtime testing code.
+- FAIL - Requested User 1/User 2/User 3 passwords could not be applied; Supabase Auth rejected the requested short values.
+- PASS - DavidQ seed name is `DavidQ`, not `DavidQ admin`.
+- PASS - DavidQ is not statically seeded as admin; explicit existing admin assignments are preserved when present.
+- FAIL - Extra codex/qbytes DEV accounts were identified but not deleted because the live sync hard-stopped before cleanup.
+- FAIL - Auth users and `public.users` were not fully synced in DEV because the live sync failed.
+- PASS - `authProvider="supabase-auth"` and real `auth.users.id` sync behavior is implemented in the server-side sync path.
+- PASS - `creator` is the default authenticated Creator role in seed data and create-account provisioning.
+- PASS - `guest` remains available for unauthenticated browsing.
+- PASS - `admin` is retained only as an explicit assignment.
+- PASS - `roleSlug=user` is marked inactive/deprecated in seed data.
+- PASS - Dev-static seed docs/data and server-side seed/setup scripts were updated.
+- PASS - Seeding remains server-side only.
+- PASS - No SQLite/local-db fallback was added.
+- PASS - No browser-owned user records were added.
+- PASS - Startup wording reports configured account/product-data connections; script name retained as legacy command naming only.
+
+## Before/After Identity Counts
+
+Live sync hard-stopped before mutation. A dry-run snapshot after the failed attempt reported:
+
+| Count | Before | After Dry Run |
+| --- | ---: | ---: |
+| Supabase Auth users | 12 | 12 |
+| `public.users` rows | 12 | 12 |
+| Canonical Auth identities | 2 | 2 |
+| Canonical `public.users` identities | 3 | 3 |
+| Managed extra Auth identities | 10 | 10 |
+| Managed extra `public.users` identities | 8 | 8 |
+
+Actual created records: 0.
+
+Actual deleted records: 0.
+
+## Deleted DEV Account List
+
+No live deletions were performed because the sync failed before cleanup.
+
+Dry-run cleanup candidates identified:
+
+- `codex-pr162-1781561056924-35f5412b0f339@example.com`
+- `codex-pr162-1781561106580-fe3f2462707fc@example.com`
+- `codex-pr163-repeat-1781562780241-ccbc9d07d9f97@example.com`
+- `codex-pr163-success-1781562780241-ccbc9d07d9f97@example.com`
+- `codex-pr156-missing-identity-1781555713293-c32794@example.test`
+- `codex-pr156-admin-probe-1781554902135-23gra6@example.com`
+- `qbytes.dq1@gmail.com`
+- `qbytes.dq2@gmail.com`
+- `qbytes.dq3@gmail.com`
+- `qbytes.dq4@gmail.com`
+
+## Auth/Public Users Sync Evidence
+
+Dry-run verification, with Auth IDs omitted:
+
+- `user1@example.invalid`: Auth present, `public.users` present, not synced to real Auth ID yet.
+- `user2@example.invalid`: Auth missing, `public.users` present.
+- `user3@example.invalid`: Auth missing, `public.users` present.
+- `qbytes.dq@gmail.com`: Auth present, `public.users` missing.
+
+Creator role assignments were not present for the four canonical identities in live DEV at dry-run time.
+
+## Validation Lane Report
+
+- PASS - `node --check` for changed JS/MJS files.
+- FAIL - `node .\scripts\validate-supabase-dev.mjs`; local TLS trust failed with `UNABLE_TO_VERIFY_LEAF_SIGNATURE` / `SELF_SIGNED_CERT_IN_CHAIN`.
+- PASS - `npm run validate:supabase-dev`; REST/API readiness passed, direct PostgreSQL TLS warning remained advisory.
+- FAIL - `node --use-system-ca .\scripts\sync-supabase-dev-creator-identities.mjs --json`; Supabase Auth HTTP 422 for requested short passwords.
+- PASS - `node --use-system-ca .\scripts\sync-supabase-dev-creator-identities.mjs --dry-run --json`.
+- PASS - `node --test tests/dev-runtime/SupabaseDevCreatorIdentitySeedSync.test.mjs`.
+- PASS - `node --test tests/dev-runtime/SupabaseProductDataCutover.test.mjs`.
+- PASS - Targeted provider contract tests for Auth admin methods, auth routes, create-account provisioning, and Supabase session/product read path.
+- TIMEOUT - Full `node --test tests/dev-runtime/SupabaseProviderContractStub.test.mjs` did not complete within 240 seconds; targeted changed cases passed.
+- PASS - `npm run dev:local-api` startup check on port 55185 returned HTTP 200 for `/api/auth/status`; startup logs contained no SQLite/local-db/provider-selection wording.
+- PASS - `npx playwright test tests/playwright/account/SupabaseSignInSession.spec.mjs --project=playwright --workers=1 --reporter=list`.
+- PASS - `npm run test:workspace-v2`.
+
+Playwright V8 coverage report: `docs_build/dev/reports/playwright_v8_coverage_report.txt`.
+
+## Manual Validation Notes
+
+- Live DEV sign-in with the requested canonical short passwords was not validated because Supabase Auth rejected those passwords before sync completed.
+- No UAT/PROD resources were touched.
+- No `.env.local` or secret files were changed.
+- No password values are recorded in this report.
+- Startup command remains `scripts/start-local-api-server.mjs`; report and logs treat that as legacy command naming only.