1c18d214c1
Closes the pick-a-name convoy. Applies D1-D5 + Risk 4 PRESERVE per
operator gate-1 ratification.
Infrastructure renames:
- lib/rate-limit.js: 5 Redis key prefixes tcgvault:* → deckhearth:* (D5).
One-time per-15-min / per-1-hour counter reset accepted; no user impact
because counter windows are short anyway. Existing rate-limit state in
Upstash will accumulate at the new prefix on first request.
- package.json: name field tcg-vault → deck-hearth (D2)
- package-lock.json: regenerated for the name change; STOP-on-churn
protocol confirmed only the two name lines changed (no dep churn)
- All three test users (admin/alice/bob) renamed to @deckhearth.com (D4)
- One-off migration script scripts/migrations/2026-05-24-rename-admin-
email.js (NEW): ESM, idempotent, UNIQUE-collision-safe. Per the
no-go-zones rule for new migrations. Operator MUST run post-deploy.
- README.md + TESTING_GUIDE.md operator-caveat blockquotes flagged
- pages/login.js demo-credential pre-fill updated
PRESERVED per Risk 4:
- test/lib/permission-middleware.test.js literal admin@tcgvault.com
with 7-line architect-authored "why" comment block. This is the
documented pre-fix-auth-bypass bug shape; the regression-lock
literal stays as historical truth.
Verification:
- npm run lint: 128 problems (baseline preserved)
- npm run test:run: 21/21 pass (preserved literal keeps green)
- Grep across full repo: 0 hits for TCG Vault / tcgvault / tcg-vault
except the explicit preserve in the test file + .convoys/ historical
- lib/rate-limit.js: 5 deckhearth: prefixes, 0 tcgvault: prefixes
- node --check on the new migration script: exit 0
- git diff package-lock.json: only the 2 "name": lines changed (no churn)
Operator post-merge action:
- Run `node scripts/migrations/2026-05-24-rename-admin-email.js` against
the production Neon DB. Order matters: migration FIRST, then any
subsequent `npm run setup-db` invocation. Migration script will refuse
to run if collision detected (means setup-db already ran post-rename).
Architect brief: .convoys/pick-a-name/brief-2-infrastructure-and-email-migration.md
Architect commit: 50ce9ab
Operator gate-1: D1-D5 + Risk 4 PRESERVE ratified.
Co-authored-by: Cursor <cursoragent@cursor.com>
3.5 KiB
3.5 KiB
🎯 Deck Hearth Collaboration Testing Guide
👥 Test Accounts
| User | Password | Role | |
|---|---|---|---|
| Admin | admin@deckhearth.com |
admin123 |
Admin |
| Alice | alice@deckhearth.com |
alice123 |
User |
| Bob | bob@deckhearth.com |
bob123 |
User |
🃏 Sample Cards Available
- Lightning Bolt (MTG) - $2.50
- Black Lotus (MTG) - $25,000
- Pikachu (Pokemon) - $8.50
- Charizard (Pokemon) - $350
- Mickey Mouse (Lorcana) - $45
- Elsa (Lorcana) - $15.75
🧪 Testing Workflow
1. Login as Alice
Email: alice@deckhearth.com
Password: alice123
2. Create a Collection
- Go to
/collections - Click "Create Collection"
- Fill out:
- Name: "Alice's Pokemon Collection"
- Description: "My favorite Pokemon cards"
- Image: (optional)
https://images.unsplash.com/photo-1606092195730-5d7b9af1efc5?w=1200 - Show in Community: Toggle ON for public visibility
3. Add Cards to Collection
- Navigate to the new collection (auto-redirect after creation)
- Use "Quick Add" search in empty state
- Search for "Pikachu" and click to add
- Search for "Charizard" and click to add
- See real-time collection value updates
4. Invite Bob as Collaborator
- Click "Invite Collaborator" button
- Enter:
bob@deckhearth.com - Role: Collaborator (default)
- Message: "Help me build this Pokemon collection!"
- Click "Send Invitation"
5. Switch to Bob's Account
- Logout and login as Bob
- Email:
bob@deckhearth.com - Password:
bob123
6. Accept Invitation (Simulated)
Since we're testing locally, simulate email acceptance:
- Go to:
/invite/accept?token=MOCK_TOKEN - Or manually add Bob to Alice's collection via database
7. Test Collaboration
As Bob:
- Go to
/collections- should see Alice's collection - Open Alice's collection
- Add more cards using Quick Add
- See Bob's activity in collaboration panel
8. Test Permission Levels
- Bob can add/edit cards (Collaborator role)
- Bob cannot delete collection (only Alice can)
- Collection shows as "Public" but editing requires invitation
🔧 Quick Database Commands
Add Bob to Alice's Collection Manually:
-- Get collection ID (usually 1 for first collection)
SELECT id FROM collections WHERE name LIKE '%Alice%';
-- Add Bob as collaborator
INSERT INTO collection_permissions (collection_id, user_id, role, status)
VALUES (1, 3, 'editor', 'active');
Check Users:
node scripts/list-users.js
🎯 What to Test
✅ Collection Management:
- Create collection with image and visibility
- Real-time stats (card count, value)
- Only see your own collections initially
✅ Card Management:
- Search and add cards via Quick Add
- Real card data with images and prices
- Collection value updates automatically
✅ Collaboration:
- Invite collaborators with email
- Permission indicators throughout UI
- Activity logging for all changes
✅ User Experience:
- Beautiful empty states with guidance
- Real-time search with dropdown results
- Success confirmations and navigation
- Permission-based UI elements
🚀 Ready to Test!
The system now provides a complete, real-world testing environment with:
- Real user authentication
- Database-driven collections and cards
- Working collaboration system
- Beautiful UX with proper empty states
- Permission-based access control
Start testing by logging in as Alice and creating your first collection! 🎮