Improve authentication recovery and mobile gameplay

2026-10-07 11:10:29 +05:00
parent 233e4d57f0
commit ce26e6fdbc
22 changed files with 763 additions and 97 deletions
--- a/scripts/test-initial-password-sql.mjs
+++ b/scripts/test-initial-password-sql.mjs
@@ -0,0 +1,71 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { PGlite } from "../.data/sql-verification/node_modules/@electric-sql/pglite/dist/index.js";
+const db = new PGlite();
+try {
+  await db.exec(`create role anon; create role authenticated; create role service_role bypassrls;
+    create schema auth;
+    create function auth.uid() returns uuid language sql as $$ select nullif(current_setting('test.uid',true),'')::uuid $$;
+    create table auth.users(id uuid primary key,encrypted_password text,email text,email_confirmed_at timestamptz,is_anonymous boolean);
+    insert into auth.users values
+      ('00000000-0000-4000-8000-000000000001','', 'legacy@example.com',now(),false),
+      ('00000000-0000-4000-8000-000000000002','existing-hash','password@example.com',now(),false),
+      ('00000000-0000-4000-8000-000000000003',null,'unverified@example.com',null,false),
+      ('00000000-0000-4000-8000-000000000004',null,null,null,true);`);
+  await db.exec(
+    await readFile(
+      "supabase/migrations/20261007055439_legacy_password_claims.sql",
+      "utf8",
+    ),
+  );
+  for (const role of ["anon", "authenticated"]) {
+    await db.exec(`set role ${role}`);
+    await assert.rejects(
+      db.query(
+        "select public.claim_legacy_password('00000000-0000-4000-8000-000000000001')",
+      ),
+      /permission denied/,
+    );
+    await assert.rejects(
+      db.query(
+        "select public.legacy_password_needed('00000000-0000-4000-8000-000000000001')",
+      ),
+      /permission denied/,
+    );
+    await db.exec("reset role");
+  }
+  await db.exec("set role service_role");
+  const call = async (fn, ending) =>
+    (
+      await db.query(
+        `select public.${fn}('00000000-0000-4000-8000-00000000000${ending}') as result`,
+      )
+    ).rows[0].result;
+  assert.equal(await call("legacy_password_needed", 1), true);
+  for (const ending of [2, 3, 4, 5]) {
+    assert.equal(await call("legacy_password_needed", ending), false);
+    assert.equal(await call("claim_legacy_password", ending), false);
+  }
+  await db.exec(
+    "select set_config('test.uid','00000000-0000-4000-8000-000000000002',false)",
+  );
+  assert.equal(await call("claim_legacy_password", 1), false);
+  await db.exec("select set_config('test.uid','',false)");
+  assert.equal(await call("claim_legacy_password", 1), true);
+  assert.equal(await call("claim_legacy_password", 1), false);
+  assert.equal(await call("legacy_password_needed", 1), false);
+  const columns = (
+    await db.query(
+      "select column_name from information_schema.columns where table_schema='minegeo_private' and table_name='legacy_password_claims'",
+    )
+  ).rows.map((r) => r.column_name);
+  assert.deepEqual(columns.sort(), ["claimed_at", "user_id"]);
+  console.log(
+    "Initial password SQL passed: verified legacy owners eligible once; existing passwords protected; anonymous, unverified and cross-account attempts denied; no password stored.",
+  );
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+} finally {
+  await db.close();
+}