4 months ago
26c2dfba local convenience, compile-time excluded from prod. inspired by spatie/laravel-login-link, adapted to tripwire's real product STATES. - auto-login: a gated route with no session in a dev build trampolines through /dev/auto-login, mints the default persona (active — the populated dashboard), and lands you in the app. you never see /login; it stays reachable directly with a persona panel. - switcher (floating in the shell + /login panel) jumps between six states: fresh maintainer, one repo (auto-select), many repos (picker), empty dashboard, active dashboard, and anonymous (signs out and opens a seeded PUBLIC run as a stranger). - sessions are REAL better-auth sessions minted via email/password (asResponse → forwarded set-cookie), never oauth, never bypassing verification. createAuth gains a devLogin flag enabled only when the web head is a dev build. - two guards, both throw: compile-time import.meta.env.DEV (code absent from prod) + runtime loopback-host check. no escape hatch. - fixtures auto-create per persona on click, namespaced tripwire-demo/*; "reset dev data" wipes only that namespace, never a real table. - the shape-correct seed builder lives in @tripwire/db (shared with the coming dev:demo), building contract-valid runs without importing core. tests: guard (prod ⇒ throws, non-localhost ⇒ throws), the session-mint mechanism over real postgres, the seeded story's home stats. checks: typecheck all, biome, boundaries, 215 tests.
Parentcb4771e
