v1.1.0: session guard on all game routes + register + sign-in screen (ISS-107)

app/api/test/mint-player-session/route.test.ts

@@ -0,0 +1,75 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import { getGameDb } from '@/lib/db/client';
+import { POST } from './route';
+
+// v1.1.0 (ISS-107) — the e2e session-mint hook. CI runs unit tests with FLIGHT_TEST_HOOKS=1 set
+// (docker-compose.ci.yml), so the gate test stubs the env explicitly instead of relying on absence.
+
+let dir: string;
+
+beforeAll(async () => {
+  dir = await fs.mkdtemp(path.join(os.tmpdir(), 'flight-mint-'));
+  process.env.FLIGHT_DB_PATH = path.join(dir, 'mint.db');
+});
+
+afterAll(async () => {
+  vi.unstubAllEnvs();
+  delete process.env.FLIGHT_DB_PATH;
+  await fs.rm(dir, { recursive: true, force: true });
+});
+
+const post = (body?: unknown) =>
+  POST(
+    new Request('http://localhost/api/test/mint-player-session', {
+      method: 'POST',
+      body: body === undefined ? undefined : JSON.stringify(body),
+    }),
+  );
+
+describe('POST /api/test/mint-player-session', () => {
+  it('404s when FLIGHT_TEST_HOOKS is not "1" (like its /api/test/* siblings)', async () => {
+    vi.stubEnv('FLIGHT_TEST_HOOKS', '');
+    const res = await post();
+    expect(res.status).toBe(404);
+  });
+
+  it('creates the default test account + player row and mints a session when enabled', async () => {
+    vi.stubEnv('FLIGHT_TEST_HOOKS', '1');
+    const res = await post(); // no body → DEFAULT_USERNAME
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { sessionId: string };
+    expect(body.sessionId).toMatch(/^[0-9a-f-]{36}$/);
+
+    const inst = await getGameDb();
+    const userRow = inst.raw.exec("SELECT id FROM users WHERE username = 'e2e-tester'")[0].values[0];
+    expect(userRow.length).toBe(1);
+    const playerRow = inst.raw.exec("SELECT id, cash FROM players WHERE username = 'e2e-tester'")[0].values[0];
+    expect(String(playerRow[0])).toBe(String(userRow[0])); // one UUID for both rows
+
+    // The minted session resolves to the new user.
+    const sess = inst.raw.exec('SELECT user_id FROM sessions WHERE id = ?', [body.sessionId])[0].values[0];
+    expect(String(sess[0])).toBe(String(userRow[0]));
+  });
+
+  it('is idempotent — re-minting an existing username mints another session, no duplicate rows', async () => {
+    vi.stubEnv('FLIGHT_TEST_HOOKS', '1');
+    const count = async () => Number((await getGameDb()).raw.exec("SELECT COUNT(*) FROM users WHERE username = 'e2e-tester'")[0].values[0][0]);
+    expect(await count()).toBe(1);
+
+    const res = await post();
+    expect(res.status).toBe(200);
+    expect(await count()).toBe(1); // still one account…
+  });
+
+  it('rejects bad usernames and unknown fields with 400', async () => {
+    vi.stubEnv('FLIGHT_TEST_HOOKS', '1');
+    for (const body of [{ username: 'x' }, { username: 'BAD USER!' }, { bogus: 1 }]) {
+      const res = await post(body);
+      expect(res.status).toBe(400);
+      expect(((await res.json()) as { error: string }).error).toBeTruthy();
+    }
+  });
+});