2 Commits

Author	SHA1	Message	Date
Claude	387db52510	Fix player getAccount has_password: read the raw row, not sanitized req.user ... req.user comes from getById which strips password_hash, so has_password was always false — the account page mis-rendered a real password account as the SSO-only 'set a password' variant (and the change-password form omitted the required current-password field). Read the raw row for that one flag. Caught by a browser click-through of the /account portal. Adds a regression test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV	2026-07-06 05:11:36 -05:00
Claude	f8bcc7f6a3	Player accounts backend: schema, registration, self-service, SSO provision ... - Widen users.role enum to include 'player'; make password_hash nullable; add email/email_verified/status/last_login_ip; pin username _ci collation. - POST /auth/register (honeypot + registerLimiter + botScore, reserved-name blocklist, duplicate->409, auto-login). player_registration setting gates it. - SSO auto-provision in finishLogin (setting-gated); return/portal-aware SSO redirects for the player portal; status refusal on login + requireAuth. - New /player self-service group (account, change username/password, TOTP, identities), reusing account.controller; accountChangeLimiter. - Admin: 'player' role + status/email on user create/update, role/status audit, player_registration enum validation, derived public registration flags. - usernamePolicy module (reserved, sanitize, derive, dedup) + unit tests; extend SSO callback tests. 133 server tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV	2026-07-06 01:36:51 -05:00