Player accounts backend: schema, registration, self-service, SSO provision

- Widen users.role enum to include 'player'; make password_hash nullable;
  add email/email_verified/status/last_login_ip; pin username _ci collation.
- POST /auth/register (honeypot + registerLimiter + botScore, reserved-name
  blocklist, duplicate->409, auto-login). player_registration setting gates it.
- SSO auto-provision in finishLogin (setting-gated); return/portal-aware SSO
  redirects for the player portal; status refusal on login + requireAuth.
- New /player self-service group (account, change username/password, TOTP,
  identities), reusing account.controller; accountChangeLimiter.
- Admin: 'player' role + status/email on user create/update, role/status audit,
  player_registration enum validation, derived public registration flags.
- usernamePolicy module (reserved, sanitize, derive, dedup) + unit tests;
  extend SSO callback tests. 133 server tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/test/playerAccounts.test.js

@@ -0,0 +1,89 @@
+// Point the DB at a closed port BEFORE requiring anything that builds the pool,
+// so the one branch that reaches the DB fails fast instead of hanging the runner.
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const { test, beforeEach, after } = require('node:test')
+const assert = require('node:assert/strict')
+const bcrypt = require('bcryptjs')
+
+const authCtrl = require('../src/router/v1/auth/auth.controller')
+const users = require('../src/model/users/users.model')
+const settings = require('../src/model/settings/settings.model')
+const botScore = require('../src/middleware/botScore')
+const lp = require('../src/middleware/loginProtection')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+function mockRes() {
+  return {
+    statusCode: 200,
+    body: null,
+    status(c) {
+      this.statusCode = c
+      return this
+    },
+    json(b) {
+      this.body = b
+      return this
+    },
+    set() {
+      return this
+    },
+    cookie() {
+      return this
+    },
+  }
+}
+
+beforeEach(() => {
+  botScore._reset()
+  lp._reset()
+})
+
+// ── Derived public registration flags ─────────────────────────────────────
+test('registrationFlags maps each mode to password/sso booleans', () => {
+  assert.deepEqual(settings.registrationFlags('disabled'), { password: false, sso: false })
+  assert.deepEqual(settings.registrationFlags('password'), { password: true, sso: false })
+  assert.deepEqual(settings.registrationFlags('sso'), { password: false, sso: true })
+  assert.deepEqual(settings.registrationFlags('both'), { password: true, sso: true })
+})
+
+test('REGISTRATION_MODES is the closed set of allowed values', () => {
+  assert.deepEqual(settings.REGISTRATION_MODES, ['disabled', 'password', 'sso', 'both'])
+})
+
+// ── Null-hash password rule ────────────────────────────────────────────────
+test('validatePassword rejects an SSO-only account with a null hash', async () => {
+  assert.equal(await users.validatePassword({ password_hash: null }, 'anything'), false)
+  assert.equal(await users.validatePassword(null, 'anything'), false)
+})
+
+test('validatePassword accepts a correct password against a real hash', async () => {
+  const password_hash = await bcrypt.hash('correct horse', 10)
+  assert.equal(await users.validatePassword({ password_hash }, 'correct horse'), true)
+  assert.equal(await users.validatePassword({ password_hash }, 'wrong'), false)
+})
+
+test('isDuplicateUsername recognizes the driver duplicate-key error', () => {
+  assert.equal(users.isDuplicateUsername({ code: 'ER_DUP_ENTRY' }), true)
+  assert.equal(users.isDuplicateUsername({ errno: 1062 }), true)
+  assert.equal(users.isDuplicateUsername({ code: 'ER_NO_SUCH_TABLE' }), false)
+  assert.equal(users.isDuplicateUsername(null), false)
+})
+
+// ── Registration honeypot (does not need the DB) ──────────────────────────
+test('register with a filled honeypot fails and bans the IP before any DB hit', async () => {
+  const ip = '203.0.113.90'
+  const req = {
+    ip,
+    body: { username: 'newplayer', password: 'password123', [authCtrl.HONEYPOT_FIELD]: 'Acme' },
+  }
+  const res = mockRes()
+  await authCtrl.register(req, res)
+
+  assert.equal(res.statusCode, 400)
+  assert.doesNotMatch(res.body.message, /honeypot|bot|company/i)
+  assert.equal(botScore.isBanned(ip), true)
+})

server/test/ssoCallback.test.js

@@ -14,6 +14,7 @@ const users = require('../src/model/users/users.model')
 const activity = require('../src/model/activity/activity.model')
 const authProviders = require('../src/model/authProviders/authProviders.model')
 const userIdentities = require('../src/model/userIdentities/userIdentities.model')
+const settings = require('../src/model/settings/settings.model')
 const registry = require('../src/auth/providers/registry')
 const totp = require('../src/utils/totp')
 const db = require('../src/utils/db')
@@ -34,6 +35,9 @@ beforeEach(() => {
   userIdentities.link = async () => 1
   users.getById = async (id) => ({ id, username: 'alice', role: 'admin' })
   users.recordLogin = async () => {} // avoid the real DB on the success path
+  // Default: registration closed, so login stays strictly link-only unless a
+  // test opts into SSO sign-up.
+  settings.getRegistrationMode = async () => 'disabled'
 })
 
 function mockRes() {
@@ -87,6 +91,39 @@ test('UNLINKED identity → no session, redirect to not_linked (link-only policy
   assert.equal(logged.length, 0)
 })
 
+test('UNLINKED identity + SSO sign-up enabled → auto-provisions a player and logs in', async () => {
+  settings.getRegistrationMode = async () => 'both'
+  userIdentities.findByProviderSubject = async () => null
+  let created = null
+  users.createUser = async (args) => {
+    created = args
+    return { id: 42, username: args.username, role: 'player', status: 'active' }
+  }
+  let linkArgs = null
+  userIdentities.link = async (args) => { linkArgs = args; return 1 }
+  const tx = ssoState.createTx({ provider: 'google', mode: 'login' })
+  const res = mockRes()
+  await ssoCtrl.callback(makeReq(tx), res)
+
+  assert.equal(created.role, 'player')
+  assert.equal(created.email, 'alice@example.com')
+  assert.equal(linkArgs.userId, 42)
+  assert.ok(res.cookies[token.COOKIE_NAME], 'session cookie set for the new player')
+  assert.equal(res.redirectedTo, '/admin')
+  // Both the provision and the login are audited.
+  assert.deepEqual(logged.map((e) => e.action), ['auth.sso.provision', 'auth.sso.login'])
+})
+
+test('UNLINKED identity from the player portal lands back in /account', async () => {
+  settings.getRegistrationMode = async () => 'both'
+  userIdentities.findByProviderSubject = async () => null
+  users.createUser = async (args) => ({ id: 43, username: args.username, role: 'player', status: 'active' })
+  const tx = ssoState.createTx({ provider: 'google', mode: 'login', returnTo: '/account' })
+  const res = mockRes()
+  await ssoCtrl.callback(makeReq(tx), res)
+  assert.equal(res.redirectedTo, '/account')
+})
+
 test('link mode → identity linked to the acting user, redirect to account', async () => {
   let linkArgs = null
   userIdentities.link = async (args) => { linkArgs = args; return 1 }

server/test/usernamePolicy.test.js

@@ -0,0 +1,52 @@
+// Unit tests for the pure username policy (no DB): validation, reserved-name
+// blocklist, case normalization, SSO derivation + the dedup suffix loop.
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+
+const policy = require('../src/auth/usernamePolicy')
+
+test('validateUsername accepts a normal name and trims whitespace', () => {
+  const r = policy.validateUsername('  Frodo_99  ')
+  assert.equal(r.ok, true)
+  assert.equal(r.name, 'Frodo_99') // trimmed, case preserved
+})
+
+test('validateUsername rejects too-short / too-long / bad-charset names', () => {
+  assert.equal(policy.validateUsername('ab').ok, false) // < 3
+  assert.equal(policy.validateUsername('x'.repeat(33)).ok, false) // > 32
+  assert.equal(policy.validateUsername('has space').ok, false)
+  assert.equal(policy.validateUsername('emoji😀here').ok, false)
+})
+
+test('reserved names are rejected case-insensitively', () => {
+  for (const name of ['admin', 'ADMIN', 'Administrator', 'root', 'moderator', 'support', 'me']) {
+    assert.equal(policy.isReserved(name), true, `${name} should be reserved`)
+    assert.equal(policy.validateUsername(name).ok, false, `${name} should be rejected`)
+  }
+  assert.equal(policy.isReserved('frodo'), false)
+})
+
+test('sanitizeToUsername strips disallowed chars and leading punctuation', () => {
+  assert.equal(policy.sanitizeToUsername('Fró.do Baggins!'), 'Fro.doBaggins')
+  assert.equal(policy.sanitizeToUsername('...weird'), 'weird')
+  assert.equal(policy.sanitizeToUsername('a'.repeat(50)).length, policy.MAX_LEN)
+})
+
+test('deriveUsernameBase prefers display name, then email local-part, then player', () => {
+  assert.equal(policy.deriveUsernameBase({ name: 'Gandalf', email: 'g@x.com' }), 'Gandalf')
+  assert.equal(policy.deriveUsernameBase({ name: '💥', email: 'samwise@shire.net' }), 'samwise')
+  assert.equal(policy.deriveUsernameBase({ name: '', email: '' }), 'player')
+  // A reserved derived base is skipped in favor of the next candidate.
+  assert.equal(policy.deriveUsernameBase({ name: 'admin', email: 'realuser@x.com' }), 'realuser')
+})
+
+test('candidateUsername yields the base then increasing suffixes, clamped to length', () => {
+  assert.equal(policy.candidateUsername('bilbo', 0), 'bilbo')
+  assert.equal(policy.candidateUsername('bilbo', 1), 'bilbo2')
+  assert.equal(policy.candidateUsername('bilbo', 2), 'bilbo3')
+  // Long base: the numeric suffix must survive the MAX_LEN clamp.
+  const long = 'a'.repeat(policy.MAX_LEN)
+  const c = policy.candidateUsername(long, 10)
+  assert.ok(c.length <= policy.MAX_LEN)
+  assert.ok(c.endsWith('11'))
+})