fix(api): delete dev endpoints + CI guard (Brief 3 of fix-auth-bypass) #7

Merged

varutasu merged 1 commit from brief/fix-auth-bypass/3-delete-dev-endpoints into main

2026-05-23 11:40:44 -04:00

varutasu commented

2026-05-23 10:54:29 -04:00

(Migrated from github.com)

Summary

Convoy fix-auth-bypass / Brief 3 of 5. Resolves AGENTS.md gotcha #5 (pages/api/setup-database.js was a public endpoint that triggers DDL). See .convoys/fix-auth-bypass.md for the full convoy plan. This brief has no dependency on Brief 1 (PR #6) — they can ship in either order.

Deletes four unauthenticated dev endpoints currently shipped to prod (/api/simple, /api/test-auth, /api/test-db, /api/setup-database). setup-database is the highest-impact — public POST that ran schema bootstrap + seeded the default admin@tcgvault.com / admin123 credentials.
Adds a forbidden-endpoints job to .github/workflows/ci.yml that blocks the build if any of those four paths reappear OR if a new pages/api/test-*.js file shows up. Cheap insurance against a future agent re-introducing one from an outdated tutorial.
Removes the single GET /api/test-db line from the README's API list. The rest of the API list is intentionally left for the doc-writer pass at the end of the convoy.

Files changed

Deleted: pages/api/simple.js, pages/api/test-auth.js, pages/api/test-db.js, pages/api/setup-database.js
Modified: .github/workflows/ci.yml (new forbidden-endpoints job after schema-map-fresh)
Modified: README.md (one-line removal under "Health Check")

Test plan

npm run build exits 0 (no broken imports — zero source callers across pages/, components/, lib/)
CI guard local simulation: clean tree → `OK`; with temp `pages/api/test-fake.js` → `FAIL: pages/api/test-fake.js`; after cleanup → `OK`
`git grep -l 'api/simple|test-auth|test-db|setup-database' pages components lib` → zero source files
Reviewer to verify on preview deployment: hitting `https:///api/setup-database` returns 404 instead of running DDL. Same for the other three paths.
Reviewer to verify on CI: the new `forbidden-endpoints` job runs and passes on this PR. (Negative test was simulated locally; CI will exercise the live workflow.)

Pre-merge requirements

None. This PR is purely deletion + CI hardening.

Out of scope (intentionally — see convoy plan)

pages/api/cards/import-*.js deletion/gating → `add-rate-limiting` convoy (admin-imports have rate-limit concerns)
`pages/api/auth/*` changes → Brief 1 (PR #6), Brief 2, Brief 4
README rewrite of the API list → doc-writer pass at end of convoy
New test files → Brief 5
Cleanup of stale docs that reference these endpoints (`.cursor/rules/api-routes.mdc` § "Dev/test endpoints", `.convoys/ship-readiness.md`) → doc-writer pass

Audit cohort

Reviewer dispatch follows post-push. No UI surface → design-system + a11y + browser-smoke auditors do not run for this PR.

🤖 Pipeline metadata: convoy=fix-auth-bypass, brief=3, depends_on=[], audit=reviewer-only

Made with Cursor

## Summary Convoy `fix-auth-bypass` / Brief 3 of 5. Resolves AGENTS.md gotcha #5 (`pages/api/setup-database.js` was a public endpoint that triggers DDL). See [`.convoys/fix-auth-bypass.md`](https://github.com/varutasu/tcg-vault/blob/convoy/fix-auth-bypass/.convoys/fix-auth-bypass.md) for the full convoy plan. **This brief has no dependency on Brief 1 (PR #6) — they can ship in either order.** - Deletes four unauthenticated dev endpoints currently shipped to prod (`/api/simple`, `/api/test-auth`, `/api/test-db`, `/api/setup-database`). `setup-database` is the highest-impact — public POST that ran schema bootstrap + seeded the default `admin@tcgvault.com` / `admin123` credentials. - Adds a `forbidden-endpoints` job to `.github/workflows/ci.yml` that blocks the build if any of those four paths reappear OR if a new `pages/api/test-*.js` file shows up. Cheap insurance against a future agent re-introducing one from an outdated tutorial. - Removes the single `GET /api/test-db` line from the README's API list. The rest of the API list is intentionally left for the doc-writer pass at the end of the convoy. ## Files changed - **Deleted:** `pages/api/simple.js`, `pages/api/test-auth.js`, `pages/api/test-db.js`, `pages/api/setup-database.js` - **Modified:** `.github/workflows/ci.yml` (new `forbidden-endpoints` job after `schema-map-fresh`) - **Modified:** `README.md` (one-line removal under "Health Check") ## Test plan - [x] `npm run build` exits 0 (no broken imports — zero source callers across `pages/`, `components/`, `lib/`) - [x] CI guard local simulation: clean tree → \`OK\`; with temp \`pages/api/test-fake.js\` → \`FAIL: pages/api/test-fake.js\`; after cleanup → \`OK\` - [x] \`git grep -l 'api/simple|test-auth|test-db|setup-database' pages components lib\` → zero source files - [ ] **Reviewer to verify on preview deployment:** hitting \`https://<preview>/api/setup-database\` returns 404 instead of running DDL. Same for the other three paths. - [ ] **Reviewer to verify on CI:** the new \`forbidden-endpoints\` job runs and passes on this PR. (Negative test was simulated locally; CI will exercise the live workflow.) ## Pre-merge requirements - None. This PR is purely deletion + CI hardening. ## Out of scope (intentionally — see convoy plan) - `pages/api/cards/import-*.js` deletion/gating → \`add-rate-limiting\` convoy (admin-imports have rate-limit concerns) - \`pages/api/auth/*\` changes → Brief 1 (PR #6), Brief 2, Brief 4 - README rewrite of the API list → doc-writer pass at end of convoy - New test files → Brief 5 - Cleanup of stale docs that reference these endpoints (\`.cursor/rules/api-routes.mdc\` § \"Dev/test endpoints\", \`.convoys/ship-readiness.md\`) → doc-writer pass ## Audit cohort Reviewer dispatch follows post-push. No UI surface → design-system + a11y + browser-smoke auditors do not run for this PR. --- 🤖 Pipeline metadata: convoy=fix-auth-bypass, brief=3, depends_on=[], audit=reviewer-only Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-05-23 10:54:34 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	May 23, 2026 2:54pm

[vc]: #Z1rJ1/WunrSbuDPIdaiIYItrReo8A/cDKwFfCN5UhEY=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWJyaWVmLWZpeC1hdXRoLTZiOGJlZi1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCJ9LCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20vcmFuZGFsbC1zdGlsbHdlbGxzLXByb2plY3RzL3RjZy12YXVsdC9IRFhDWGFQOW01ejI5V0tqdzJ3SHZ4WlRoYUdTIiwicHJldmlld1VybCI6InRjZy12YXVsdC1naXQtYnJpZWYtZml4LWF1dGgtNmI4YmVmLXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIn1dLCJyZXF1ZXN0UmV2aWV3VXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3ZlcmNlbC1hZ2VudC9yZXF1ZXN0LXJldmlldz9vd25lcj12YXJ1dGFzdSZyZXBvPXRjZy12YXVsdCZwcj03In0= The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/HDXCXaP9m5z29WKjw2wHvxZThaGS) | [Preview](https://tcg-vault-git-brief-fix-auth-6b8bef-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-brief-fix-auth-6b8bef-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | May 23, 2026 2:54pm | <a href="https://vercel.com/vercel-agent/request-review?owner=varutasu&repo=tcg-vault&pr=7" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-05-23 10:54:38 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	❌ failure
Visual diff	❌ failure

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ❌ failure | | Visual diff | ❌ failure | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.