1c18d214c1
Closes the pick-a-name convoy. Applies D1-D5 + Risk 4 PRESERVE per
operator gate-1 ratification.
Infrastructure renames:
- lib/rate-limit.js: 5 Redis key prefixes tcgvault:* → deckhearth:* (D5).
One-time per-15-min / per-1-hour counter reset accepted; no user impact
because counter windows are short anyway. Existing rate-limit state in
Upstash will accumulate at the new prefix on first request.
- package.json: name field tcg-vault → deck-hearth (D2)
- package-lock.json: regenerated for the name change; STOP-on-churn
protocol confirmed only the two name lines changed (no dep churn)
- All three test users (admin/alice/bob) renamed to @deckhearth.com (D4)
- One-off migration script scripts/migrations/2026-05-24-rename-admin-
email.js (NEW): ESM, idempotent, UNIQUE-collision-safe. Per the
no-go-zones rule for new migrations. Operator MUST run post-deploy.
- README.md + TESTING_GUIDE.md operator-caveat blockquotes flagged
- pages/login.js demo-credential pre-fill updated
PRESERVED per Risk 4:
- test/lib/permission-middleware.test.js literal admin@tcgvault.com
with 7-line architect-authored "why" comment block. This is the
documented pre-fix-auth-bypass bug shape; the regression-lock
literal stays as historical truth.
Verification:
- npm run lint: 128 problems (baseline preserved)
- npm run test:run: 21/21 pass (preserved literal keeps green)
- Grep across full repo: 0 hits for TCG Vault / tcgvault / tcg-vault
except the explicit preserve in the test file + .convoys/ historical
- lib/rate-limit.js: 5 deckhearth: prefixes, 0 tcgvault: prefixes
- node --check on the new migration script: exit 0
- git diff package-lock.json: only the 2 "name": lines changed (no churn)
Operator post-merge action:
- Run `node scripts/migrations/2026-05-24-rename-admin-email.js` against
the production Neon DB. Order matters: migration FIRST, then any
subsequent `npm run setup-db` invocation. Migration script will refuse
to run if collision detected (means setup-db already ran post-rename).
Architect brief: .convoys/pick-a-name/brief-2-infrastructure-and-email-migration.md
Architect commit: 50ce9ab
Operator gate-1: D1-D5 + Risk 4 PRESERVE ratified.
Co-authored-by: Cursor <cursoragent@cursor.com>
122 lines
3.5 KiB
Markdown
122 lines
3.5 KiB
Markdown
# 🎯 Deck Hearth Collaboration Testing Guide
|
|
|
|
## 👥 Test Accounts
|
|
|
|
| User | Email | Password | Role |
|
|
|------|-------|----------|------|
|
|
| Admin | `admin@deckhearth.com` | `admin123` | Admin |
|
|
| Alice | `alice@deckhearth.com` | `alice123` | User |
|
|
| Bob | `bob@deckhearth.com` | `bob123` | User |
|
|
|
|
## 🃏 Sample Cards Available
|
|
|
|
- **Lightning Bolt** (MTG) - $2.50
|
|
- **Black Lotus** (MTG) - $25,000
|
|
- **Pikachu** (Pokemon) - $8.50
|
|
- **Charizard** (Pokemon) - $350
|
|
- **Mickey Mouse** (Lorcana) - $45
|
|
- **Elsa** (Lorcana) - $15.75
|
|
|
|
## 🧪 Testing Workflow
|
|
|
|
### 1. **Login as Alice**
|
|
```
|
|
Email: alice@deckhearth.com
|
|
Password: alice123
|
|
```
|
|
|
|
### 2. **Create a Collection**
|
|
- Go to `/collections`
|
|
- Click "Create Collection"
|
|
- Fill out:
|
|
- Name: "Alice's Pokemon Collection"
|
|
- Description: "My favorite Pokemon cards"
|
|
- Image: (optional) `https://images.unsplash.com/photo-1606092195730-5d7b9af1efc5?w=1200`
|
|
- Show in Community: Toggle ON for public visibility
|
|
|
|
### 3. **Add Cards to Collection**
|
|
- Navigate to the new collection (auto-redirect after creation)
|
|
- Use "Quick Add" search in empty state
|
|
- Search for "Pikachu" and click to add
|
|
- Search for "Charizard" and click to add
|
|
- See real-time collection value updates
|
|
|
|
### 4. **Invite Bob as Collaborator**
|
|
- Click "Invite Collaborator" button
|
|
- Enter: `bob@deckhearth.com`
|
|
- Role: Collaborator (default)
|
|
- Message: "Help me build this Pokemon collection!"
|
|
- Click "Send Invitation"
|
|
|
|
### 5. **Switch to Bob's Account**
|
|
- Logout and login as Bob
|
|
- Email: `bob@deckhearth.com`
|
|
- Password: `bob123`
|
|
|
|
### 6. **Accept Invitation (Simulated)**
|
|
Since we're testing locally, simulate email acceptance:
|
|
- Go to: `/invite/accept?token=MOCK_TOKEN`
|
|
- Or manually add Bob to Alice's collection via database
|
|
|
|
### 7. **Test Collaboration**
|
|
As Bob:
|
|
- Go to `/collections` - should see Alice's collection
|
|
- Open Alice's collection
|
|
- Add more cards using Quick Add
|
|
- See Bob's activity in collaboration panel
|
|
|
|
### 8. **Test Permission Levels**
|
|
- Bob can add/edit cards (Collaborator role)
|
|
- Bob cannot delete collection (only Alice can)
|
|
- Collection shows as "Public" but editing requires invitation
|
|
|
|
## 🔧 Quick Database Commands
|
|
|
|
### Add Bob to Alice's Collection Manually:
|
|
```sql
|
|
-- Get collection ID (usually 1 for first collection)
|
|
SELECT id FROM collections WHERE name LIKE '%Alice%';
|
|
|
|
-- Add Bob as collaborator
|
|
INSERT INTO collection_permissions (collection_id, user_id, role, status)
|
|
VALUES (1, 3, 'editor', 'active');
|
|
```
|
|
|
|
### Check Users:
|
|
```bash
|
|
node scripts/list-users.js
|
|
```
|
|
|
|
## 🎯 What to Test
|
|
|
|
### ✅ Collection Management:
|
|
- [x] Create collection with image and visibility
|
|
- [x] Real-time stats (card count, value)
|
|
- [x] Only see your own collections initially
|
|
|
|
### ✅ Card Management:
|
|
- [x] Search and add cards via Quick Add
|
|
- [x] Real card data with images and prices
|
|
- [x] Collection value updates automatically
|
|
|
|
### ✅ Collaboration:
|
|
- [x] Invite collaborators with email
|
|
- [x] Permission indicators throughout UI
|
|
- [x] Activity logging for all changes
|
|
|
|
### ✅ User Experience:
|
|
- [x] Beautiful empty states with guidance
|
|
- [x] Real-time search with dropdown results
|
|
- [x] Success confirmations and navigation
|
|
- [x] Permission-based UI elements
|
|
|
|
## 🚀 Ready to Test!
|
|
|
|
The system now provides a complete, real-world testing environment with:
|
|
- Real user authentication
|
|
- Database-driven collections and cards
|
|
- Working collaboration system
|
|
- Beautiful UX with proper empty states
|
|
- Permission-based access control
|
|
|
|
Start testing by logging in as Alice and creating your first collection! 🎮
|