28 commits

Author	SHA1	Message	Date
cschlaefke	127f765d85	test(db): close surviving mutants in merge tests, extend runbook (KAT-05, 2b) ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 21:04:12 +01:00
cschlaefke	2c2546ab47	docs(db): runbook section merging, data model and spec notes (KAT-05, 2b) ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 20:49:42 +01:00
cschlaefke	a9a7990636	chore: merge main into feature/2a-game-cover ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 20:07:46 +01:00
cschlaefke	9952efa2fe	test(catalog): address review findings on PR 2a ... Replace tests that could not fail (manual_fields stability, no-op update), select runbook games by id, add grant matrix and forged-admin tests, assert vocabulary seeding and Deno checksum in CI, clarify the set local convention and API notes. Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 18:18:32 +01:00
cschlaefke	52cbd79fb4	feat(catalog): run checks.sql in CI and document seed loader result ... Adds the checks.sql smoke step, the verified CLI result for generated seed content and the created_at/updated_at note for the API. Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 16:40:55 +01:00
cschlaefke	24b27c3776	docs(catalog): add catalog runbook, data model and README updates ... Includes the checked CLI assumptions (sql_paths, begin/commit) and implementation notes in the spec. Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 15:38:28 +01:00
cschlaefke	f99c82b1e0	feat(catalog): address review of GameCover (labels, tests, spec notes) ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 15:26:38 +01:00
cschlaefke	b77146eabf	docs(catalog): mark design choices W1, W4, W6, W7, H1, H2, H7 as confirmed ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 14:07:21 +00:00
cschlaefke	6dd5854eab	docs(catalog): address re-review of KAT-05 spec and record clarification N15 ... Visibility is immutable, variant copying is derived from visibility, startbestand idempotency and vocabulary handling are defined, and the edition deviation from KAT-04 criterion 4 is recorded as N15. Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 14:02:17 +00:00
cschlaefke	8c57e05458	docs(catalog): address review findings on KAT-05 spec ... Variants are no longer copied when repointing provisional entries, all PRs only reference #2, grants, idempotency, checks and merge rules are spelled out. Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 13:35:40 +00:00
cschlaefke	c0f832fd1d	docs(catalog): record approval and decisions F1-F9 in KAT-05 spec ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 13:15:52 +00:00
cschlaefke	074118db69	docs(catalog): note default privileges, studio role and schema test count ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 13:08:49 +00:00
cschlaefke	34eaab12e1	docs(catalog): add technical spec for KAT-05 catalog data ... Refs #2 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 13:02:24 +00:00
cschlaefke	ffc30db2e5	fix(auth): address review findings for semantics split ... Refs #41 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 13:17:09 +01:00
cschlaefke	3805c71225	fix(auth): address review findings for smtp-neutral handling ... Refs #37 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 12:24:25 +01:00
cschlaefke	de093b68ed	docs(auth): renumber SMTP risk to R17 (R16 was taken) ... Refs #37 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 12:03:11 +01:00
cschlaefke	7d094a6732	fix(auth): treat SMTP failures like success on enumeration-sensitive calls ... Refs #37 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 12:03:04 +01:00
cschlaefke	aa421b12b0	test(auth): address review findings for e2e ... Refs #38 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 10:55:27 +01:00
cschlaefke	7c2f684098	fix(auth): address review findings for password reset ... Finish the recovery guard only after the password change, mark the change in the repository so a late userUpdated event is harmless, keep the form locked after success, carry from through the reset check-email page, share the password error texts and focus the continue button. Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 09:58:31 +01:00
cschlaefke	3b2995463e	docs(auth): document 01c deviations, reset mode route and AppBanner actionEnabled ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 09:50:42 +01:00
cschlaefke	87c0d7d1ec	feat(auth): add password reset (forgot password, recovery link, new password) ... ForgotPasswordScreen with neutral reaction (F12), CheckEmail reset mode on its own path, recovery link handling and ResetPasswordScreen with the recovery guard held until the user confirms the success message. Carries the from parameter between login, register and forgot password. Removes the route placeholders. Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 09:47:03 +01:00
cschlaefke	239d0e1ac2	fix(auth): address review findings for registration ... - expose legal links to screen readers on web - allow only http(s) legal URLs, prevent double submit - detect transport errors without runtimeType, keep extra in memory - ship third-party license text, document decisions Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-03 00:47:42 +01:00
cschlaefke	3158abc344	docs(auth): use trim_ws in spec ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:58:11 +01:00
cschlaefke	9f36cd0c33	feat(db): reject U+200B in display names ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:51:56 +01:00
cschlaefke	fb0f4b9d3f	fix(db): trim all Unicode whitespace in display name, harden templates ... - add public.trim_ws mirroring Dart String.trim - require JSON string metadata, tolerate non-string locale in templates - add tests, align docs with review Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:48:01 +01:00
cschlaefke	47721a48e8	docs(auth): align spec with spike results and add AUTH-CFG-25 ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 23:26:03 +01:00
cschlaefke	395816609f	feat(db): enforce registration rules and add terms_version ... Adds display name validation, terms_version, locale sync trigger and pgTAP tests (KTO-01 criteria 1, 2, 10, 11). Includes GoTrue spike results. Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 22:36:21 +01:00
cschlaefke	e56f75a5e1	docs(auth): add spec for KTO-01 registration, login and password reset ... Refs #1 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-02 20:10:07 +01:00