daddy
7bd8124199
POST /api/auth/register now requires a real date_of_birth (ISO YYYY-MM-DD). The server computes age (auth.calculate_age) and rejects under-18s with 403; a future/nonsensical date is 400. The DOB is stored and surfaced only to that user (/api/auth/me). Still self-attested (a user can enter a false DOB) -- but a concrete, stored, legally-meaningful data point and the seam for a future ID-check pass. Encryption-at-rest for the column and the Tier-2 hook are not done; the limitation is stated plainly in docs/architecture/content_moderation.md 5.2. - auth.py: RegisterRequest.date_of_birth (date); MIN_AGE=18; register() computes + enforces; UserResponse.date_of_birth typed `date | None` (the old `str | None` would have 500'd /me once a DOB was actually stored). - api_client.gd / main_menu.gd: the Over18 checkbox is now a "Date of birth (YYYY-MM-DD)" field with a client-side sanity check. - tests: test_auth_age_gate.py rewritten around the endpoint + age math (adult/minor/exactly-18/future-dob/stored); ~25 over_18 references across 6 backend test files + 6 game smoke tests updated. Backend 74 passed; game smokes green (auth 6/6, menu_full_flow 12/12, e2e 4/4, etc.); fresh-clone boot PASS. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015jtxAiu5dAW4WxCNdGkrkJ
87 lines
4.2 KiB
GDScript
87 lines
4.2 KiB
GDScript
extends SceneTree
|
|
## Full click-through simulation of the real user flow: press Register,
|
|
## fill the form exactly as a human would, submit, confirm Play actually
|
|
## becomes clickable. Also verifies that after successful auth the auth
|
|
## form fields are hidden, leaving only the welcome message visible.
|
|
|
|
var passed := 0
|
|
var failed := 0
|
|
|
|
|
|
func _initialize() -> void:
|
|
_run()
|
|
|
|
|
|
func _run() -> void:
|
|
await process_frame
|
|
|
|
var packed: PackedScene = load("res://scenes/main_menu.tscn")
|
|
var instance: Control = packed.instantiate()
|
|
root.add_child(instance)
|
|
await process_frame
|
|
|
|
var register_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton")
|
|
var auth_buttons_row: HBoxContainer = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow")
|
|
var username_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit")
|
|
var password_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit")
|
|
var email_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit")
|
|
var dob_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/DobEdit")
|
|
var auth_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton")
|
|
var auth_mode_label: Label = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthModeLabel")
|
|
var welcome_label: Label = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel")
|
|
var play_button: Button = instance.get_node("CenterContainer/VBoxContainer/PlayButton")
|
|
|
|
_check("Play starts disabled", play_button.disabled)
|
|
|
|
# Click Register -- a real signal emission is fine here since
|
|
# _on_register_button_pressed() is synchronous (no await), same as a
|
|
# real click's GUI event dispatch would drive it.
|
|
register_button.pressed.emit()
|
|
await process_frame
|
|
|
|
_check("auth panel opened in register mode", instance.get_node("CenterContainer/VBoxContainer/AuthPanel").visible)
|
|
|
|
# Fill the form exactly as a user would type into it.
|
|
var unique_id := int(Time.get_unix_time_from_system() * 1000)
|
|
username_edit.text = "mainmenu_e2e_%d" % unique_id
|
|
password_edit.text = "TestPass123!"
|
|
email_edit.text = "mainmenu_e2e_%d@test.example.com" % unique_id
|
|
dob_edit.text = "1990-01-01"
|
|
|
|
# Call the submit handler directly (awaited) rather than via
|
|
# auth_button.pressed.emit() -- a synthetic .emit() in --script/
|
|
# SceneTree headless mode doesn't drive an await-using handler's
|
|
# coroutine forward the same way real GUI input event dispatch does
|
|
# (confirmed via a direct-call vs emit() comparison: the direct call
|
|
# always resolves, the synthetic emit sometimes doesn't advance past
|
|
# its own await point even after 50 real process_frame waits). This
|
|
# is a headless-mode test-harness limitation, not a bug in the actual
|
|
# click-driven flow.
|
|
await instance._on_auth_button_pressed()
|
|
|
|
_check("Play became enabled after real register submission", not play_button.disabled)
|
|
_check("Welcome label visible in tree", welcome_label.is_visible_in_tree())
|
|
_check("Auth buttons row hid itself after success", not auth_buttons_row.visible)
|
|
|
|
# Verify the auth form fields are hidden after successful auth,
|
|
# leaving only the welcome message visible within the panel.
|
|
_check("Username edit hidden after auth", not username_edit.visible)
|
|
_check("Password edit hidden after auth", not password_edit.visible)
|
|
_check("Email edit hidden after auth", not email_edit.visible)
|
|
_check("DOB field hidden after auth", not dob_edit.visible)
|
|
_check("Auth button hidden after auth", not auth_button.visible)
|
|
_check("Auth mode label hidden after auth", not auth_mode_label.visible)
|
|
_check("Welcome label contains username", welcome_label.text.begins_with("Welcome, mainmenu_e2e_"))
|
|
|
|
print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
|
|
quit(0 if failed == 0 else 1)
|
|
|
|
|
|
func _check(description: String, condition: bool) -> void:
|
|
if condition:
|
|
print(" PASS: ", description)
|
|
passed += 1
|
|
else:
|
|
printerr(" FAIL: ", description)
|
|
failed += 1
|