POST /api/auth/register now requires a real date_of_birth (ISO YYYY-MM-DD).
The server computes age (auth.calculate_age) and rejects under-18s with 403;
a future/nonsensical date is 400. The DOB is stored and surfaced only to
that user (/api/auth/me).
Still self-attested (a user can enter a false DOB) -- but a concrete,
stored, legally-meaningful data point and the seam for a future ID-check
pass. Encryption-at-rest for the column and the Tier-2 hook are not done;
the limitation is stated plainly in docs/architecture/content_moderation.md 5.2.
- auth.py: RegisterRequest.date_of_birth (date); MIN_AGE=18; register()
computes + enforces; UserResponse.date_of_birth typed `date | None`
(the old `str | None` would have 500'd /me once a DOB was actually stored).
- api_client.gd / main_menu.gd: the Over18 checkbox is now a
"Date of birth (YYYY-MM-DD)" field with a client-side sanity check.
- tests: test_auth_age_gate.py rewritten around the endpoint + age math
(adult/minor/exactly-18/future-dob/stored); ~25 over_18 references across
6 backend test files + 6 game smoke tests updated. Backend 74 passed;
game smokes green (auth 6/6, menu_full_flow 12/12, e2e 4/4, etc.);
fresh-clone boot PASS.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015jtxAiu5dAW4WxCNdGkrkJ
_show_authenticated() (the session-restore path, used when returning to
main_menu.tscn -- e.g. after clicking Back from world_list) only hid
EmailEdit/Over18Check, unlike _on_auth_complete() (the fresh-login path)
which hides the full form: UsernameEdit, PasswordEdit, EmailEdit,
Over18Check, AuthButton, AuthModeLabel. Play was correctly enabled and
the welcome message was correctly visible, so a check that stopped at
those two passed clean -- but the actual login fields were still on
screen, which is what a real user sees as "it's making me log in again."
Confirmed via live PC1 playtest today.
Reported by: real playtest, 2026-08-20 (yesterday's automated regression
test for this exact Play -> Back flow only asserted Play/welcome/auth
buttons row -- strengthened smoke_test_main_menu_back.gd to also check
the individual form fields, and confirmed it fails exactly this way with
the bug reintroduced before restoring the fix).
Verified against a live backend: 61/61 pytest (unaffected), 8/8 Godot
smoke tests (including 20/20 on the strengthened back-nav test).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6rUEynmv2QmweocAQYARN
Two things, found together while investigating a stuck blocker task:
1. URGENT: main_menu.gd currently fails to parse at all on main
("Identifier '_dob_edit' not declared in the current scope"). PR #44
(hide-all-fields-on-auth-success) and PR #45 (DOBEdit -> Over18Check
checkbox) each merged cleanly on their own -- Gitea's merge reported
mergeable:true for both -- but together they left a reference to the
old _dob_edit var on a line neither PR's diff touched, so no conflict
was ever flagged. Same failure mode in smoke_test_main_menu_full_flow.gd
(dob_edit, would have failed to even parse in the checkpoint suite).
Fixed both to reference _over_18_check / over_18_check.
2. Lands the Play -> Back session-persistence fix (PR #43, task
28357bca192d) that was stuck behind review the whole time main didn't
have it yet: signal auth_state_ready, _show_authenticated() /
_reset_to_logged_out() helpers, and _ready() restoring the
authenticated UI (not resetting it) when ApiClient already holds a
valid token. Plus the real fix a review round caught on top of that
(task 9186405a6373): _show_authenticated() was hiding AuthPanel while
claiming the welcome label inside it was visible -- a no-op UI-wise,
since WelcomeLabel.visible=true does nothing once its parent is
hidden. AuthPanel now stays visible; the regression test
(smoke_test_main_menu_back.gd, new) asserts is_visible_in_tree(), not
just .visible, so this class of bug can't pass silently again.
Verified against a live backend: 61/61 pytest, 7/7 Godot smoke tests
(including the new smoke_test_main_menu_back.gd, 12/12).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6rUEynmv2QmweocAQYARN
daddy
claude-checkpoint-tooling