docs: post-convoy cleanup for fix-auth-bypass #12

Merged

varutasu merged 1 commit from docs/fix-auth-bypass-cleanup into main

2026-05-23 13:22:50 -04:00

varutasu commented

2026-05-23 12:28:16 -04:00

(Migrated from github.com)

Summary

Closes out the fix-auth-bypass convoy (PRs #6, #7, #8, #9, #10, #11, merged through 1629afb) on the docs side. Docs only — no code touched.

Refreshes guidance to reflect what shipped, marks resolved AGENTS.md gotchas + ship-readiness P0s, restores the convoy's planning artifacts (architect plan + 5 briefs) that were authored on convoy/fix-auth-bypass but never landed on main, and records the mid-flight env-var rename (UPSTASH_REDIS_REST_* → KV_REST_API_*).

What changed (file-by-file)

AGENTS.md — §1 auth bullet upgraded; §3 conventions point at lib/auth-secret.js + lib/rate-limit.js; §4 gotchas #2/#3/#5 → "Resolved" notes (kept numbered, not renumbered, to preserve cross-references); new #12 documents KV_REST_API_* env-var convention; §5 setup adds rate-limit env vars; §6 testing rewritten for Vitest.
.cursor/rules/auth-and-permissions.mdc — canonical-surface table gains lib/auth-secret.js + lib/rate-limit.js; token model now 24h (was 7d) with fail-loud explanation; server-side patterns lead with the null → 401 contract.
.cursor/rules/api-routes.mdc — "CRITICAL — known bug" callout removed (resolved by Brief 2); new "Rate limiting" section with verbatim shape; "Dev/test endpoints" → "Removed" historical note (so future agents searching for test-db understand why it's gone).
.convoys/fix-auth-bypass.md — restored from convoy/fix-auth-bypass branch (was never merged to main), frontmatter → status: shipped, new Convoy outcome section: briefs + merge commits, resolved gotchas, R1–R12 risk walk, env-var-rename deviation record, queued follow-up convoys (expand-auth-tests, cors-tighten, drop-public-setup, fix-layout-default-user, single-sql-client, migration-tool, dual-is-public), lessons learned.
.convoys/fix-auth-bypass/brief-{1,2,3,5}-*.md — restored verbatim from convoy branch (audit-trail completeness).
.convoys/fix-auth-bypass/brief-4-tighten-auth-surface.md — restored + updated: UPSTASH_REDIS_REST_* → KV_REST_API_* across init rules / smoke / pre-deploy checklist; new "Post-merge addendum" explaining the rename + the parent-agent interrupt approval.
.convoys/ship-readiness.md — P0 #1, #2, #4 marked RESOLVED with merge-commit citations; P0 #5 (CORS) and #6 (rate limit) marked PARTIAL with deferral pointers; each item gains an "As-shipped" line.
README.md — Next.js 15 → 16, TypeScript claim corrected to JS-with-devDep, auth + rate-limit + testing bullets updated, env-var template extended, deleted dev-endpoints note added. Default admin section left alone — that's drop-public-setup's territory.

Renumbering map

No renumbering. Gotchas #2/#3/#5 converted to Resolved notes in their original slots. New #12 added. This preserves all existing cross-references in .cursor/rules/**, .cursor/skills/**, and .convoys/**.

Test plan

git diff --stat confirms scope: 11 docs files, no code, no workflow, no package.json, no vitest.config.js
npm run lint — 128/81/47 baseline preserved
JWT_SECRET=test-dummy npm run build — exit 0
npm run test:run — 16/16 vitest tests pass (Briefs 1/2/4 regression locks all green)

Items flagged but intentionally NOT changed

pages/api/auth/verify.js still ships Access-Control-Allow-Origin: '*' + OPTIONS preflight. Documented in convoy outcome + ship-readiness P0 #5 PARTIAL note. Belongs to the queued cors-tighten convoy.
README.md § "Default Admin Account" still publishes admin@tcgvault.com / admin123. Gotcha #4 / P0 #3 — drop-public-setup convoy.
README.md § "📁 Project Structure" is stale (mentions lib/database.js as the lone lib entry). Worth a small follow-up doc PR; out of scope here.
No CHANGELOG.md exists. Ship-readiness flags this as its own scope ("Adopt Keep-a-Changelog format. Backfill [0.1.0] — initial private alpha"). fix-auth-bypass is a natural first entry under ### Security once that file exists.
Convoy-planning-artifacts-never-merged was a process gap — the architect plan + briefs lived only on convoy/fix-auth-bypass. This PR restores them. For future convoys: either include planning files in the umbrella merge or have the doc-writer always restore them at close-out.

After this merges

The fix-auth-bypass convoy is officially closed. Follow-up convoys queued (see .convoys/fix-auth-bypass.md § Convoy outcome for the full list).

🤖 Pipeline metadata: convoy=fix-auth-bypass, role=role-doc-writer, audit=none (docs-only)

Made with Cursor

## Summary Closes out the `fix-auth-bypass` convoy (PRs [#6](https://github.com/varutasu/tcg-vault/pull/6), [#7](https://github.com/varutasu/tcg-vault/pull/7), [#8](https://github.com/varutasu/tcg-vault/pull/8), [#9](https://github.com/varutasu/tcg-vault/pull/9), [#10](https://github.com/varutasu/tcg-vault/pull/10), [#11](https://github.com/varutasu/tcg-vault/pull/11), merged through `1629afb`) on the docs side. **Docs only — no code touched.** Refreshes guidance to reflect what shipped, marks resolved AGENTS.md gotchas + ship-readiness P0s, restores the convoy's planning artifacts (architect plan + 5 briefs) that were authored on `convoy/fix-auth-bypass` but never landed on `main`, and records the mid-flight env-var rename (`UPSTASH_REDIS_REST_*` → `KV_REST_API_*`). ## What changed (file-by-file) - **`AGENTS.md`** — §1 auth bullet upgraded; §3 conventions point at `lib/auth-secret.js` + `lib/rate-limit.js`; §4 gotchas #2/#3/#5 → "Resolved" notes (**kept numbered, not renumbered, to preserve cross-references**); new #12 documents `KV_REST_API_*` env-var convention; §5 setup adds rate-limit env vars; §6 testing rewritten for Vitest. - **`.cursor/rules/auth-and-permissions.mdc`** — canonical-surface table gains `lib/auth-secret.js` + `lib/rate-limit.js`; token model now 24h (was 7d) with fail-loud explanation; server-side patterns lead with the `null → 401` contract. - **`.cursor/rules/api-routes.mdc`** — \"CRITICAL — known bug\" callout removed (resolved by Brief 2); new \"Rate limiting\" section with verbatim shape; \"Dev/test endpoints\" → \"Removed\" historical note (so future agents searching for `test-db` understand why it's gone). - **`.convoys/fix-auth-bypass.md`** — restored from `convoy/fix-auth-bypass` branch (was never merged to main), frontmatter → `status: shipped`, new **Convoy outcome** section: briefs + merge commits, resolved gotchas, R1–R12 risk walk, env-var-rename deviation record, queued follow-up convoys (`expand-auth-tests`, `cors-tighten`, `drop-public-setup`, `fix-layout-default-user`, `single-sql-client`, `migration-tool`, `dual-is-public`), lessons learned. - **`.convoys/fix-auth-bypass/brief-{1,2,3,5}-*.md`** — restored verbatim from convoy branch (audit-trail completeness). - **`.convoys/fix-auth-bypass/brief-4-tighten-auth-surface.md`** — restored + updated: `UPSTASH_REDIS_REST_*` → `KV_REST_API_*` across init rules / smoke / pre-deploy checklist; new \"Post-merge addendum\" explaining the rename + the parent-agent interrupt approval. - **`.convoys/ship-readiness.md`** — P0 #1, #2, #4 marked **RESOLVED** with merge-commit citations; P0 #5 (CORS) and #6 (rate limit) marked **PARTIAL** with deferral pointers; each item gains an \"As-shipped\" line. - **`README.md`** — Next.js 15 → 16, TypeScript claim corrected to JS-with-devDep, auth + rate-limit + testing bullets updated, env-var template extended, deleted dev-endpoints note added. **Default admin section left alone** — that's `drop-public-setup`'s territory. ## Renumbering map **No renumbering.** Gotchas #2/#3/#5 converted to **Resolved** notes in their original slots. New #12 added. This preserves all existing cross-references in `.cursor/rules/**`, `.cursor/skills/**`, and `.convoys/**`. ## Test plan - [x] `git diff --stat` confirms scope: 11 docs files, no code, no workflow, no `package.json`, no `vitest.config.js` - [x] `npm run lint` — 128/81/47 baseline preserved - [x] `JWT_SECRET=test-dummy npm run build` — exit 0 - [x] `npm run test:run` — 16/16 vitest tests pass (Briefs 1/2/4 regression locks all green) ## Items flagged but intentionally NOT changed 1. **`pages/api/auth/verify.js` still ships `Access-Control-Allow-Origin: '*'`** + OPTIONS preflight. Documented in convoy outcome + ship-readiness P0 #5 PARTIAL note. Belongs to the queued `cors-tighten` convoy. 2. **`README.md` § \"Default Admin Account\"** still publishes `admin@tcgvault.com` / `admin123`. Gotcha #4 / P0 #3 — `drop-public-setup` convoy. 3. **`README.md` § \"📁 Project Structure\"** is stale (mentions `lib/database.js` as the lone lib entry). Worth a small follow-up doc PR; out of scope here. 4. **No `CHANGELOG.md` exists.** Ship-readiness flags this as its own scope (\"Adopt Keep-a-Changelog format. Backfill `[0.1.0] — initial private alpha`\"). `fix-auth-bypass` is a natural first entry under `### Security` once that file exists. 5. **Convoy-planning-artifacts-never-merged was a process gap** — the architect plan + briefs lived only on `convoy/fix-auth-bypass`. This PR restores them. For future convoys: either include planning files in the umbrella merge or have the doc-writer always restore them at close-out. ## After this merges The `fix-auth-bypass` convoy is officially closed. Follow-up convoys queued (see `.convoys/fix-auth-bypass.md § Convoy outcome` for the full list). --- 🤖 Pipeline metadata: convoy=fix-auth-bypass, role=role-doc-writer, audit=none (docs-only) Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-05-23 12:28:23 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	May 23, 2026 4:28pm

[vc]: #bdAbNb6oFlm4BLvPDsPFrhXnhD8MkKavPiUuAlowVB8=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWRvY3MtZml4LWF1dGgtYWZlMWM1LXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIn0sImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS9yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMvdGNnLXZhdWx0LzlOdU5nd29WVkZpNm1MM1NaTHhYUFVhRnVqV3giLCJwcmV2aWV3VXJsIjoidGNnLXZhdWx0LWdpdC1kb2NzLWZpeC1hdXRoLWFmZTFjNS1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCIsIm5leHRDb21taXRTdGF0dXMiOiJERVBMT1lFRCJ9XSwicmVxdWVzdFJldmlld1VybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS92ZXJjZWwtYWdlbnQvcmVxdWVzdC1yZXZpZXc/b3duZXI9dmFydXRhc3UmcmVwbz10Y2ctdmF1bHQmcHI9MTIifQ== The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/9NuNgwoVVFi6mL3SZLxXPUaFujWx) | [Preview](https://tcg-vault-git-docs-fix-auth-afe1c5-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-docs-fix-auth-afe1c5-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | May 23, 2026 4:28pm | <a href="https://vercel.com/vercel-agent/request-review?owner=varutasu&repo=tcg-vault&pr=12" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-05-23 12:28:25 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	❌ failure
Visual diff	⏭ skipped or pending

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ❌ failure | | Visual diff | ⏭ skipped or pending | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.