78 lines
3.0 KiB
TypeScript
78 lines
3.0 KiB
TypeScript
import { randomUUID } from 'node:crypto';
|
||
import * as schema from '@/lib/db/schema';
|
||
import { getGameDb, persist } from '@/lib/db/client';
|
||
import { createSession, hashPassword } from '@/lib/auth';
|
||
import { STARTING_CASH, STARTING_REPUTATION } from '@/lib/game/seed';
|
||
|
||
// TEST-ONLY hook (v1.1.0, ISS-107) — mints a session for a test player so the e2e suite can hit
|
||
// the guarded game routes WITHOUT any real credentials in test code (same reason as its sibling
|
||
// /api/test/admin-session). Creates the users + players rows if missing — idempotent across
|
||
// container restarts, since the CI DB volume persists. Disabled unless FLIGHT_TEST_HOOKS=1; every
|
||
// other deployment 404s here, like its /api/test/* siblings.
|
||
//
|
||
// POST /api/test/mint-player-session
|
||
// body { username?: string } — defaults to 'e2e-tester'; must match the register rules when given.
|
||
// Returns { sessionId }.
|
||
|
||
const DEFAULT_USERNAME = 'e2e-tester';
|
||
// Test-only credential for the minted users row — e2e never logs in with it (sessions are minted
|
||
// server-side); a fixed value keeps the row debuggable from the admin panel.
|
||
const TEST_PASSWORD = 'e2e-mint-password-42';
|
||
|
||
export async function POST(req: Request) {
|
||
if (process.env.FLIGHT_TEST_HOOKS !== '1') {
|
||
return Response.json({ error: 'test hooks disabled' }, { status: 404 });
|
||
}
|
||
|
||
let body: unknown = {};
|
||
try {
|
||
const text = await req.text();
|
||
body = text ? JSON.parse(text) : {};
|
||
} catch {
|
||
return Response.json({ error: 'invalid JSON body' }, { status: 400 });
|
||
}
|
||
if (typeof body !== 'object' || body === null || Array.isArray(body)) {
|
||
return Response.json({ error: 'body must be a JSON object' }, { status: 400 });
|
||
}
|
||
const input = body as Record<string, unknown>;
|
||
for (const key of Object.keys(input)) {
|
||
if (key !== 'username') {
|
||
return Response.json({ error: `unknown field "${key}"` }, { status: 400 });
|
||
}
|
||
}
|
||
let username = DEFAULT_USERNAME;
|
||
if (input.username !== undefined) {
|
||
if (typeof input.username !== 'string' || !/^[a-z0-9_-]{3,20}$/.test(input.username)) {
|
||
return Response.json(
|
||
{ error: 'username must be 3–20 characters of a-z, 0-9, _ or -' },
|
||
{ status: 400 },
|
||
);
|
||
}
|
||
username = input.username;
|
||
}
|
||
|
||
const inst = await getGameDb();
|
||
let res = inst.raw.exec('SELECT id FROM users WHERE username = ?', [username]);
|
||
let userId = res[0]?.values?.[0]?.[0];
|
||
if (typeof userId !== 'string') {
|
||
// New test account — one UUID for both rows, starter economy like a fresh world.
|
||
const id = randomUUID();
|
||
inst.raw.run('INSERT INTO users (id, username, password_hash, admin, created_at) VALUES (?, ?, ?, 0, ?)', [
|
||
id,
|
||
username,
|
||
hashPassword(TEST_PASSWORD),
|
||
Date.now(),
|
||
]);
|
||
await inst.db.insert(schema.players).values({
|
||
id,
|
||
provider: 'local',
|
||
username,
|
||
cash: STARTING_CASH,
|
||
reputation: STARTING_REPUTATION,
|
||
});
|
||
userId = id;
|
||
}
|
||
const sessionId = await createSession(inst, userId); // persists the rows + session together
|
||
return Response.json({ sessionId });
|
||
}
|