`scripts/create-test-users.js` hardcoded `bcrypt.hash('alice123', 12)`
+ `bcrypt.hash('bob123', 12)` and echoed those literals back to stdout
both per-user and in a final summary block. `TESTING_GUIDE.md`'s Test
Accounts table documented the same `admin123` / `alice123` / `bob123`
trio. These were the last two weak-credential surfaces left in the
helper-script + manual-QA-doc tree after `drop-public-setup` (commits
`ff80753` + `b63b509`) and `fix-reset-db-script` (squash `3ab9bf8`,
PR #25) closed the `setup-neon-db.js` and `reset-db.js` halves of the
umbrella `purge-weak-creds-from-helpers` queued follow-up.
The fix mirrors the post-`drop-public-setup` `setup-neon-db.js`
pattern and the post-PR-#25 `reset-db.js` pattern verbatim, with one
deliberate simplification: a single `TEST_USERS_PASSWORD` env var
covers both alice + bob rather than per-user env vars (risk R2 in the
convoy file argues this — these are fixture users for the
collaboration demo flow, not independent identities, and per-user
sprawl would double the env-var contract for zero security benefit).
`createTestUsers()` now reads `process.env.TEST_USERS_PASSWORD` at the
top of the function body and exits with code 1 BEFORE opening any DB
connection if the var is unset or whitespace-only, with the same
helpful-error wording template the other two scripts use (names the
var, points at `.env.local`, suggests `openssl rand -base64 24`,
references README's "First-time admin setup" section). All four
password-echo `console.log` lines are deleted; the new summary
documents *where* the password comes from without ever printing it.
`TESTING_GUIDE.md`'s Test Accounts table is rewritten to show password
source per user instead of the literal value; the two inline
`Password: alice123` / `Password: bob123` workflow snippets are
replaced with placeholder text. Unlike the previous two convoys, no
CJS→ESM conversion was needed — `create-test-users.js` was already
top-level ESM.
Verification (all static — script is destructive and not live-tested):
`node --check scripts/create-test-users.js` exit 0; `npm run lint` 128
problems (baseline preserved, no regression); `npm run test:run` 21/21
pass; grep `scripts/ TESTING_GUIDE.md` for
`admin123|password123|test123|alice123|bob123` → 0 hits;
`TEST_USERS_PASSWORD` referenced 10 times total (5 script + 5 doc).
Operator caveat: anyone running `node scripts/create-test-users.js`
post-merge must add `TEST_USERS_PASSWORD=<value>` to their
`.env.local` first; existing alice + bob rows in already-seeded
environments are NOT rotated by re-running this script
(`ON CONFLICT (email) DO NOTHING` preserves the old hashes). Same
caveat that applies to the `drop-public-setup` admin row.
Co-authored-by: Cursor <cursoragent@cursor.com>
✅ Database & API Fixes:
- Fixed collection detail API to use correct column names (card_type, market_price, image_url)
- Removed all mock data and fallbacks
- Updated field mappings throughout collection detail page
- Fixed hero section to use real collection data with proper image support
�� Test Users Created:
- admin@tcgvault.com / admin123 (Admin)
- alice@tcgvault.com / alice123 (User)
- bob@tcgvault.com / bob123 (User)
🃏 Sample Cards Added:
- Lightning Bolt (MTG) - $2.50
- Black Lotus (MTG) - $25,000
- Pikachu (Pokemon) - $8.50
- Charizard (Pokemon) - $350
- Mickey Mouse (Lorcana) - $45
- Elsa (Lorcana) - $15.75
🔧 Collaboration Features:
- Added CollaborationManager to collection detail page
- Integrated real user permissions (isOwner check)
- Updated hero section with real stats and creator info
🔍 Card Management:
- Created cards search API (/api/cards/search)
- Implemented quick add functionality in empty state
- Real-time card search with dropdown results
- Add cards directly to collection with quantity
�� Ready for Testing:
1. Login as any user to see only their collections
2. Create collections with real data
3. Add cards using search functionality
4. Invite collaborators via email system
5. Switch users to test collaboration workflow
Complete end-to-end testing environment ready! 🚀
