Require email account authentication

scripts/smoke-multiplayer.mjs

@@ -38,14 +38,30 @@ async function jsonRequest(url, options = {}) {
   return payload
 }
 
-async function createGuest(label) {
-  const session = await jsonRequest(`${supabaseUrl}/auth/v1/signup`, {
+function serviceHeaders() {
+  return {
+    apikey: serviceKey,
+    ...(serviceKey.split('.').length === 3 ? { Authorization: `Bearer ${serviceKey}` } : {}),
+    'Content-Type': 'application/json',
+  }
+}
+
+async function createEmailAccount(label) {
+  const email = `smoke-${randomUUID()}@example.com`
+  const password = `Smoke-${randomUUID()}!aA1`
+  const user = await jsonRequest(`${supabaseUrl}/auth/v1/admin/users`, {
+    method: 'POST',
+    headers: serviceHeaders(),
+    body: JSON.stringify({ email, password, email_confirm: true, user_metadata: { display_name: label } }),
+  })
+  const session = await jsonRequest(`${supabaseUrl}/auth/v1/token?grant_type=password`, {
     method: 'POST',
     headers: { apikey: anonKey, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ data: { display_name: label }, gotrue_meta_security: {} }),
+    body: JSON.stringify({ email, password }),
   })
-  if (!session?.access_token || !session?.user?.id) throw new Error('[smoke] Supabase returned an incomplete anonymous session.')
-  return { token: session.access_token, id: session.user.id }
+  if (!session?.access_token || !session?.user?.id) throw new Error('[smoke] Supabase returned an incomplete email session.')
+  if (session.user.id !== user.id) throw new Error('[smoke] Email login returned the wrong user.')
+  return { token: session.access_token, id: session.user.id, email }
 }
 
 function appRequest(path, token, options = {}) {
@@ -56,15 +72,10 @@ function appRequest(path, token, options = {}) {
 }
 
 async function servicePatch(path, body) {
-  const serviceAuthorization = serviceKey.split('.').length === 3
-    ? { Authorization: `Bearer ${serviceKey}` }
-    : {}
   await jsonRequest(`${supabaseUrl}/rest/v1/${path}`, {
     method: 'PATCH',
     headers: {
-      apikey: serviceKey,
-      ...serviceAuthorization,
-      'Content-Type': 'application/json',
+      ...serviceHeaders(),
       Prefer: 'return=representation',
     },
     body: JSON.stringify(body),
@@ -72,10 +83,10 @@ async function servicePatch(path, body) {
 }
 
 const suffix = Date.now().toString(36).toUpperCase()
-console.log('[smoke] Creating two isolated guest sessions…')
+console.log('[smoke] Creating two confirmed email accounts…')
 const [owner, player] = await Promise.all([
-  createGuest(`Smoke Owner ${suffix}`),
-  createGuest(`Smoke Player ${suffix}`),
+  createEmailAccount(`Smoke Owner ${suffix}`),
+  createEmailAccount(`Smoke Player ${suffix}`),
 ])
 
 console.log('[smoke] Creating a private world and campaign through the public API…')