Randall Stillwell fc0dd73fdc fix(api): delete dev endpoints + CI guard (Brief 3 of fix-auth-bypass)

Removes four unauthenticated dev endpoints that were shipped to production:

- pages/api/simple.js          (info leak)
- pages/api/test-auth.js       (auth diagnostic / token-mint side door)
- pages/api/test-db.js         (DB connection diagnostic)
- pages/api/setup-database.js  (public POST that ran DDL + seeded admin)

setup-database is the highest-impact removal: it was a public endpoint
that triggered schema bootstrap and seeded the default admin credentials
(admin@tcgvault.com / admin123). AGENTS.md gotcha #5.

Also adds a new `forbidden-endpoints` job to .github/workflows/ci.yml
that fails the build if any of the four deleted paths re-appear OR if
any new pages/api/test-*.js file is added. Cheap insurance against a
future agent re-introducing a dev endpoint from an outdated tutorial.

README: drops the single `GET /api/test-db` line under "Health Check".
Rest of the API list is intentionally left for the doc-writer pass.

Verified locally:
- npm run build exits 0 (no source callers — confirmed via grep across
  pages/, components/, lib/)
- CI guard local simulation: clean → OK; with test-fake.js → FAIL; OK
  after cleanup

Resolves AGENTS.md gotcha #5. Brief 1/2/4/5 still pending in convoy.

Convoy: fix-auth-bypass / Brief 3
Co-authored-by: Cursor <cursoragent@cursor.com>

2026-05-23 10:40:44 -05:00

2.9 KiB

Raw Blame History

TCG Vault

A modern trading card game collection manager built with Next.js and Neon Database.

🚀 Features

Card Management: Track your MTG, Pokémon, and Lorcana cards
Collection Organization: Create and manage card collections
Deck Building: Build and share decks
Authentication: Secure user accounts with JWT
Admin Panel: Manage cards and users
Real-time Pricing: Track card values

🛠️ Tech Stack

Frontend: Next.js 15, React 18, TypeScript
Backend: Next.js API Routes
Database: Neon PostgreSQL (serverless)
Authentication: JWT with bcrypt
Styling: Tailwind CSS
Deployment: Vercel

📦 Installation

Clone the repository

git clone <repository-url>
cd tcg-vault

Install dependencies
```
npm install
```

Set up environment variables

cp .env.example .env.local

Update .env.local with your Neon database URL:

POSTGRES_URL="postgresql://your-username:your-password@your-host/your-database"
JWT_SECRET="your-super-secret-jwt-key"

Set up the database
```
npm run setup-db
```
Start development server
```
npm run dev
```

🗄️ Database Schema

The application uses the following tables:

users - User accounts and authentication
cards - Card information and metadata
user_cards - User's card collections
collections - Named card collections
collection_cards - Cards in collections
decks - Deck definitions
deck_cards - Cards in decks

🔧 API Endpoints

Authentication

POST /api/auth/register - User registration
POST /api/auth/login - User login

Admin

GET /api/admin - Admin panel data

Health Check

GET /api/health - Application health

🚀 Deployment

This app is configured for deployment on Vercel:

Connect your repository to Vercel
Set environment variables in Vercel dashboard
Deploy automatically on push to main branch

📁 Project Structure

tcg-vault/
├── pages/                 # Next.js pages and API routes
│   ├── api/              # API endpoints
│   │   ├── auth/         # Authentication routes
│   │   └── admin/        # Admin routes
│   ├── _app.js           # App wrapper
│   └── index.js          # Home page
├── lib/                  # Utility libraries
│   └── database.js       # Database adapter
├── scripts/              # Database setup scripts
├── public/               # Static assets
└── .env.local           # Environment variables

🔐 Default Admin Account

After running the database setup:

Email: admin@tcgvault.com
Password: admin123

🤝 Contributing

Fork the repository
Create a feature branch
Make your changes
Submit a pull request

📄 License

MIT License - see LICENSE file for details

2.9 KiB Raw Blame History