5f2b234cc8
`scripts/create-test-users.js` hardcoded `bcrypt.hash('alice123', 12)`
+ `bcrypt.hash('bob123', 12)` and echoed those literals back to stdout
both per-user and in a final summary block. `TESTING_GUIDE.md`'s Test
Accounts table documented the same `admin123` / `alice123` / `bob123`
trio. These were the last two weak-credential surfaces left in the
helper-script + manual-QA-doc tree after `drop-public-setup` (commits
`ff80753` + `b63b509`) and `fix-reset-db-script` (squash `3ab9bf8`,
PR #25) closed the `setup-neon-db.js` and `reset-db.js` halves of the
umbrella `purge-weak-creds-from-helpers` queued follow-up.
The fix mirrors the post-`drop-public-setup` `setup-neon-db.js`
pattern and the post-PR-#25 `reset-db.js` pattern verbatim, with one
deliberate simplification: a single `TEST_USERS_PASSWORD` env var
covers both alice + bob rather than per-user env vars (risk R2 in the
convoy file argues this — these are fixture users for the
collaboration demo flow, not independent identities, and per-user
sprawl would double the env-var contract for zero security benefit).
`createTestUsers()` now reads `process.env.TEST_USERS_PASSWORD` at the
top of the function body and exits with code 1 BEFORE opening any DB
connection if the var is unset or whitespace-only, with the same
helpful-error wording template the other two scripts use (names the
var, points at `.env.local`, suggests `openssl rand -base64 24`,
references README's "First-time admin setup" section). All four
password-echo `console.log` lines are deleted; the new summary
documents *where* the password comes from without ever printing it.
`TESTING_GUIDE.md`'s Test Accounts table is rewritten to show password
source per user instead of the literal value; the two inline
`Password: alice123` / `Password: bob123` workflow snippets are
replaced with placeholder text. Unlike the previous two convoys, no
CJS→ESM conversion was needed — `create-test-users.js` was already
top-level ESM.
Verification (all static — script is destructive and not live-tested):
`node --check scripts/create-test-users.js` exit 0; `npm run lint` 128
problems (baseline preserved, no regression); `npm run test:run` 21/21
pass; grep `scripts/ TESTING_GUIDE.md` for
`admin123|password123|test123|alice123|bob123` → 0 hits;
`TEST_USERS_PASSWORD` referenced 10 times total (5 script + 5 doc).
Operator caveat: anyone running `node scripts/create-test-users.js`
post-merge must add `TEST_USERS_PASSWORD=<value>` to their
`.env.local` first; existing alice + bob rows in already-seeded
environments are NOT rotated by re-running this script
(`ON CONFLICT (email) DO NOTHING` preserves the old hashes). Same
caveat that applies to the `drop-public-setup` admin row.
Co-authored-by: Cursor <cursoragent@cursor.com>
4.2 KiB
4.2 KiB
🎯 Deck Hearth Collaboration Testing Guide
👥 Test Accounts
| User | Role | Password source | |
|---|---|---|---|
| Admin | admin@deckhearth.com |
Admin | ADMIN_INITIAL_PASSWORD env var (seeded by npm run setup-db) |
| Alice | alice@deckhearth.com |
User | TEST_USERS_PASSWORD env var (seeded by node scripts/create-test-users.js) |
| Bob | bob@deckhearth.com |
User | TEST_USERS_PASSWORD env var (seeded by node scripts/create-test-users.js) |
Both env vars must be set in .env.local before running the
corresponding seed script — each script fails loud (exit 1, no DB
connection opened) if its env var is unset. Generate strong values
with openssl rand -base64 24; see README.md → "First-time admin
setup" for the canonical env-var pattern.
Alice + Bob share a single TEST_USERS_PASSWORD value because this is
a test-fixture surface; that's intentional and documented in the
purge-weak-creds-from-helpers convoy.
🃏 Sample Cards Available
- Lightning Bolt (MTG) - $2.50
- Black Lotus (MTG) - $25,000
- Pikachu (Pokemon) - $8.50
- Charizard (Pokemon) - $350
- Mickey Mouse (Lorcana) - $45
- Elsa (Lorcana) - $15.75
🧪 Testing Workflow
1. Login as Alice
Email: alice@deckhearth.com
Password: <value of TEST_USERS_PASSWORD from .env.local>
2. Create a Collection
- Go to
/collections - Click "Create Collection"
- Fill out:
- Name: "Alice's Pokemon Collection"
- Description: "My favorite Pokemon cards"
- Image: (optional)
https://images.unsplash.com/photo-1606092195730-5d7b9af1efc5?w=1200 - Show in Community: Toggle ON for public visibility
3. Add Cards to Collection
- Navigate to the new collection (auto-redirect after creation)
- Use "Quick Add" search in empty state
- Search for "Pikachu" and click to add
- Search for "Charizard" and click to add
- See real-time collection value updates
4. Invite Bob as Collaborator
- Click "Invite Collaborator" button
- Enter:
bob@deckhearth.com - Role: Collaborator (default)
- Message: "Help me build this Pokemon collection!"
- Click "Send Invitation"
5. Switch to Bob's Account
- Logout and login as Bob
- Email:
bob@deckhearth.com - Password:
<value of TEST_USERS_PASSWORD from .env.local>
6. Accept Invitation (Simulated)
Since we're testing locally, simulate email acceptance:
- Go to:
/invite/accept?token=MOCK_TOKEN - Or manually add Bob to Alice's collection via database
7. Test Collaboration
As Bob:
- Go to
/collections- should see Alice's collection - Open Alice's collection
- Add more cards using Quick Add
- See Bob's activity in collaboration panel
8. Test Permission Levels
- Bob can add/edit cards (Collaborator role)
- Bob cannot delete collection (only Alice can)
- Collection shows as "Public" but editing requires invitation
🔧 Quick Database Commands
Add Bob to Alice's Collection Manually:
-- Get collection ID (usually 1 for first collection)
SELECT id FROM collections WHERE name LIKE '%Alice%';
-- Add Bob as collaborator
INSERT INTO collection_permissions (collection_id, user_id, role, status)
VALUES (1, 3, 'editor', 'active');
Check Users:
node scripts/list-users.js
🎯 What to Test
✅ Collection Management:
- Create collection with image and visibility
- Real-time stats (card count, value)
- Only see your own collections initially
✅ Card Management:
- Search and add cards via Quick Add
- Real card data with images and prices
- Collection value updates automatically
✅ Collaboration:
- Invite collaborators with email
- Permission indicators throughout UI
- Activity logging for all changes
✅ User Experience:
- Beautiful empty states with guidance
- Real-time search with dropdown results
- Success confirmations and navigation
- Permission-based UI elements
🚀 Ready to Test!
The system now provides a complete, real-world testing environment with:
- Real user authentication
- Database-driven collections and cards
- Working collaboration system
- Beautiful UX with proper empty states
- Permission-based access control
Start testing by logging in as Alice and creating your first collection! 🎮