TCG Vault - Trading Card Game Collection Management with OCR Scanning
Removes four unauthenticated dev endpoints that were shipped to production: - pages/api/simple.js (info leak) - pages/api/test-auth.js (auth diagnostic / token-mint side door) - pages/api/test-db.js (DB connection diagnostic) - pages/api/setup-database.js (public POST that ran DDL + seeded admin) setup-database is the highest-impact removal: it was a public endpoint that triggered schema bootstrap and seeded the default admin credentials (admin@tcgvault.com / admin123). AGENTS.md gotcha #5. Also adds a new `forbidden-endpoints` job to .github/workflows/ci.yml that fails the build if any of the four deleted paths re-appear OR if any new pages/api/test-*.js file is added. Cheap insurance against a future agent re-introducing a dev endpoint from an outdated tutorial. README: drops the single `GET /api/test-db` line under "Health Check". Rest of the API list is intentionally left for the doc-writer pass. Verified locally: - npm run build exits 0 (no source callers — confirmed via grep across pages/, components/, lib/) - CI guard local simulation: clean → OK; with test-fake.js → FAIL; OK after cleanup Resolves AGENTS.md gotcha #5. Brief 1/2/4/5 still pending in convoy. Convoy: fix-auth-bypass / Brief 3 Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|---|---|---|
| .convoys | ||
| .cursor | ||
| .github | ||
| components | ||
| docs | ||
| lib | ||
| pages | ||
| public | ||
| scripts | ||
| styles | ||
| tests/smoke | ||
| .agent-context-manifest.yml | ||
| .gitignore | ||
| .npmrc | ||
| AGENTS.md | ||
| eslint.config.mjs | ||
| next.config.js | ||
| package-lock.json | ||
| package.json | ||
| postcss.config.js | ||
| README.md | ||
| tailwind.config.js | ||
| TESTING_GUIDE.md | ||
| vercel.json | ||
TCG Vault
A modern trading card game collection manager built with Next.js and Neon Database.
🚀 Features
- Card Management: Track your MTG, Pokémon, and Lorcana cards
- Collection Organization: Create and manage card collections
- Deck Building: Build and share decks
- Authentication: Secure user accounts with JWT
- Admin Panel: Manage cards and users
- Real-time Pricing: Track card values
🛠️ Tech Stack
- Frontend: Next.js 15, React 18, TypeScript
- Backend: Next.js API Routes
- Database: Neon PostgreSQL (serverless)
- Authentication: JWT with bcrypt
- Styling: Tailwind CSS
- Deployment: Vercel
📦 Installation
-
Clone the repository
git clone <repository-url> cd tcg-vault -
Install dependencies
npm install -
Set up environment variables
cp .env.example .env.localUpdate
.env.localwith your Neon database URL:POSTGRES_URL="postgresql://your-username:your-password@your-host/your-database" JWT_SECRET="your-super-secret-jwt-key" -
Set up the database
npm run setup-db -
Start development server
npm run dev
🗄️ Database Schema
The application uses the following tables:
users- User accounts and authenticationcards- Card information and metadatauser_cards- User's card collectionscollections- Named card collectionscollection_cards- Cards in collectionsdecks- Deck definitionsdeck_cards- Cards in decks
🔧 API Endpoints
Authentication
POST /api/auth/register- User registrationPOST /api/auth/login- User login
Admin
GET /api/admin- Admin panel data
Health Check
GET /api/health- Application health
🚀 Deployment
This app is configured for deployment on Vercel:
- Connect your repository to Vercel
- Set environment variables in Vercel dashboard
- Deploy automatically on push to main branch
📁 Project Structure
tcg-vault/
├── pages/ # Next.js pages and API routes
│ ├── api/ # API endpoints
│ │ ├── auth/ # Authentication routes
│ │ └── admin/ # Admin routes
│ ├── _app.js # App wrapper
│ └── index.js # Home page
├── lib/ # Utility libraries
│ └── database.js # Database adapter
├── scripts/ # Database setup scripts
├── public/ # Static assets
└── .env.local # Environment variables
🔐 Default Admin Account
After running the database setup:
- Email: admin@tcgvault.com
- Password: admin123
🤝 Contributing
- Fork the repository
- Create a feature branch
- Make your changes
- Submit a pull request
📄 License
MIT License - see LICENSE file for details