Closes P0 #6 (no rate limiting) from PARTIAL → RESOLVED. With
this merge, all 8 P0 ship-blockers are RESOLVED. fix-auth-bypass
Brief 4 shipped lib/rate-limit.js with a single 5/15min auth
limiter wired into login + register; this brief extends the
module to 5 named limiters (auth/search/upload/generate/import)
and wires them into the remaining abusable surface.
Per architect Decision 1 — Option A (gate all 3 import routes
uniformly). The architect's investigation found a critical
secondary bug: pages/admin/card-import.js's fetch sends NO
Authorization header today. Adding getUserFromRequest to the
import APIs without fixing the admin UI atomically would have
returned 401 on every "Import Cards" click. Both edits ship in
this single commit — API gating + admin UI Bearer fix — for
atomic safety. Lorcana is dead in frontend today (only
scripts/import-lorcana.js uses that path) but gated uniformly
to future-proof per AGENTS.md § 1 status; a
delete-dead-lorcana-import follow-up convoy is queued for later
if we decide to drop Lorcana entirely.
Per Decision 2 — hybrid named-limiter shape in lib/rate-limit.js.
checkAuthRateLimit(req) signature + return shape preserved
verbatim (don't break Brief 4's contract); 4 new named functions
added (checkSearchRateLimit, checkUploadRateLimit,
checkGenerateRateLimit, checkImportRateLimit). Map<className,
Ratelimit> cache, per-class Redis prefix (tcgvault:auth,
tcgvault:search, tcgvault:upload, tcgvault:generate,
tcgvault:import) so each class has its own budget.
Per Decision 3 — per-class limit values tuned with evidence:
auth 5 / 15min IP-keyed (unchanged from Brief 4)
search 60 / 1min IP-keyed (bumped from 30 — ShareModal
has no debounce; 17-char email
= 16 requests in <5s)
upload 10 / 1hr user-keyed
generate 5 / 1hr user-keyed (DiceBear is free, kept at 5)
import 5 / 1hr user-keyed (admin-only; external APIs
have their own limits)
Per Decision 4 — two extractors. extractIpIdentifier (existing,
unchanged) and extractUserIdentifier (new). The new one THROWS on
null/undefined/empty/NaN userId to prevent silent fallback-to-IP
(which would convert per-user limits into per-IP and lock out
households). Architect's R-finding: places the gate AFTER the
auth check on every per-user-keyed route, never before.
Per Decision 5 — uniform 429 response shape verbatim matching
login.js/register.js: Retry-After header + JSON
{ error: 'Too many attempts. Try again later.' }. Anti-
fingerprinting (per-class messages would tell an attacker which
classes have which limits).
Per Decision 6 — no new per-route handler tests this convoy.
Vitest 21/21 unchanged at merge.
Verification:
- npm run lint: 128 problems (baseline match)
- npm run test:run: 21/21 vitest pass (no regression;
auth-utils tests don't transitively load rate-limit per
architect D6 evidence)
- 5 named limiter exports verified via per-route grep counts
- Admin UI sends Authorization: Bearer <token> from
localStorage in the import fetch (matching pattern from
other admin pages)
- Brief 4's login.js + register.js byte-identical at HEAD
- .cursor/rules/api-routes.mdc § Rate limiting extended with
per-class table + gate-ordering rules
No new dependencies (Brief 4's @upstash/ratelimit + @upstash/redis
suffice). No workflow YAML changes. No AGENTS.md edits (doc-
writer pass at convoy close handles Gotcha #12 update + § 6
testing update + ship-readiness Status summary 7/8 → 8/8).
Co-authored-by: Cursor <cursoragent@cursor.com>
Closes P0 #5 from PARTIAL to RESOLVED. Sweeps the remaining 24 pages/api/** handlers that carried the identical scaffolded wildcard-CORS + OPTIONS preflight pattern (Brief 4 cleaned login + register; this finishes the job). Adds a blocking forbidden-cors-headers CI job modeled on forbidden-endpoints to lock the cleanup against future regression. 25 files changed (+29/-261). Local: lint 128 baseline, vitest 21/21, zero CORS matches, YAML valid. CI: Playwright smoke 3/3 in 3.3s against post-removal preview (login/verify flow still works), new forbidden-cors-headers job passes in 4s, all gates green. PR #19 architect-commit ec22b70, implementer-commit a843736.
🐛 Root Cause:
- API was selecting non-existent columns (flavor_text, hp, type, form, weakness, retreat_cost)
- Database schema only includes columns defined in setup scripts
- Caused 'column does not exist' errors preventing cards from loading
🔧 Schema Alignment:
- Updated all SELECT statements to only use existing columns
- Removed references to flavor_text, hp, type, form, weakness, retreat_cost
- Kept all valid columns: id, name, set_name, set_code, card_number, rarity, game, mana_cost, cmc, card_type, colors, oracle_text, power, toughness, image_url, stock_image_url, current_price, market_price, scryfall_id, verified, quantity
📊 Database Status:
- 29,834 cards currently in database (MTG, Pokemon, Lorcana)
- Added sample cards for testing (Lightning Bolt, Black Lotus, Pikachu, Charizard, Mickey Mouse, Elsa)
- All filter combinations working correctly
✅ API Testing Results:
- ✅ No filters: Returns all cards with pagination
- ✅ Game filter: MTG cards returned correctly
- ✅ Search filter: Pikachu search returns 50+ variants
- ✅ Pagination: 29,834 total cards across 5,967 pages
- ✅ Filter metadata: Games, rarities, and sets populated correctly
🎯 Expected Frontend Behavior:
- Cards page should now load and display cards
- Search, filters, and infinite scroll should work properly
- No more API errors or empty card grids
The cards database is populated and the API is fully functional! 🃏✨
🔍 Search & Filter Fixes:
- Completely rewrote /api/cards/search.js to support all frontend filters
- Added support for query, game, rarity, set, and price range filters
- Implemented proper pagination with page/limit/offset handling
- Added individual filter combinations for optimal performance
📡 API Enhancements:
- Support for complex filter combinations with JavaScript fallback
- Proper total count calculation for pagination
- Enhanced card data selection including all necessary fields
- Better error handling and response structure
🔄 Infinite Scroll Support:
- Fixed pagination metadata (page, total, pages, hasMore)
- Proper LIMIT/OFFSET implementation for database queries
- Support for incremental loading with page-based navigation
🎯 Filter Combinations Supported:
- No filters (all cards)
- Search by name only
- Filter by game only
- Filter by rarity only
- Game + rarity combination
- Search + game combination
- Complex multi-filter combinations
✅ Expected Behavior:
- Search bar should now filter cards by name
- TCG filter buttons should work (MTG, Pokemon, Lorcana)
- Rarity, Set, and Price range dropdowns should filter results
- Infinite scroll should load more cards as you scroll down
- Proper card count and pagination information displayed
The cards page should now be fully functional with working search, filters, and infinite scroll! 🃏✨
- Updated /api/cards/search to return expected format with success, cards, pagination, and filters
- This fixes the empty cards page when clicking 'Add Cards'
- Removed debug console logs since TCG tags and CollaboratorFacepile are working
- Cards page should now display the sample cards properly
✅ Database & API Fixes:
- Fixed collection detail API to use correct column names (card_type, market_price, image_url)
- Removed all mock data and fallbacks
- Updated field mappings throughout collection detail page
- Fixed hero section to use real collection data with proper image support
�� Test Users Created:
- admin@tcgvault.com / admin123 (Admin)
- alice@tcgvault.com / alice123 (User)
- bob@tcgvault.com / bob123 (User)
🃏 Sample Cards Added:
- Lightning Bolt (MTG) - $2.50
- Black Lotus (MTG) - $25,000
- Pikachu (Pokemon) - $8.50
- Charizard (Pokemon) - $350
- Mickey Mouse (Lorcana) - $45
- Elsa (Lorcana) - $15.75
🔧 Collaboration Features:
- Added CollaborationManager to collection detail page
- Integrated real user permissions (isOwner check)
- Updated hero section with real stats and creator info
🔍 Card Management:
- Created cards search API (/api/cards/search)
- Implemented quick add functionality in empty state
- Real-time card search with dropdown results
- Add cards directly to collection with quantity
�� Ready for Testing:
1. Login as any user to see only their collections
2. Create collections with real data
3. Add cards using search functionality
4. Invite collaborators via email system
5. Switch users to test collaboration workflow
Complete end-to-end testing environment ready! 🚀
- Redesigned card display with 2.5:3.5 aspect ratio and image-only view
- Added infinite scroll to replace pagination
- Implemented authentic card back placeholders for MTG, Pokemon, and Lorcana
- Added rarity-based particle effects with tiered intensity (mythic/enchanted/rare/uncommon)
- Enhanced hover details panel with structured card information
- Fixed search functionality with debouncing and Enter key support
- Improved filter system with working TCG, rarity, set, and price filters
- Added favorite system for cards in both hover and detail views
- Updated card detail page with comprehensive metadata and actions
- Fixed API filtering with proper Vercel Postgres implementation
- Added particle animations and rarity glow effects
- Improved overall UX with better visual hierarchy and interactions
