feat: accounts v1, sign up with a Username, sign in on any device, reset a password by email

root commented

2026-10-14 10:36:04 +00:00

(Migrated from gitlab.core-project.space)

Summary

A Player can create an Account (email, password, Username), sign in on any device, and reset a forgotten password by email. A signed-in browser holds Seats and owns Games as its Account, and every name shows as a Username or "Guest".

apps/api/src/
├── auth/        # Accounts, Sessions (ADR 0030 cookies), the global guard, reset flow, Username rules (ADR 0040)
├── mail/        # one port; nodemailer over SMTP_URL, an in-memory outbox in tests
├── common/      # schema (accounts, sessions, reset tokens, games' account owners), rate limiter (ADR 0041)
├── games/       # Games read and stored as an Account; account.export
├── room/        # a Seat's occupant is an Account or a Guest; either identity proves it
└── devtools/    # the probe also names the Demo Accounts and the stack's Mailpit
apps/front/src/
├── auth/        # /sign-up, /sign-in, /forgot-password, /reset-password, /account
├── lib/         # refresh-and-retry on UNAUTHORIZED, the session signal, the account query
└── app/         # navigation names the Account; devtools Account panel

sequenceDiagram
    participant Tab
    participant API
    Tab->>API: room.get (access JWT expired)
    API-->>Tab: 401 UNAUTHORIZED
    Tab->>API: auth.refresh (once per tab at a time)
    API-->>Tab: new access + refresh cookies
    Tab->>API: room.get, retried once
    Note over Tab: a refused refresh marks the Account signed out

 Seat occupant
-  Guest
+  Guest | Account (id, Username)
 a call occupies a Seat when
-  its Guest matches
+  its Account or its Guest matches   # a Guest-held Seat survives sign-in; a second device picks up the Account's

Delivered in tickets #378 (Sessions on the wire), #379 (sign-up and sign-in pages), #380 (password reset, Mailpit), #381 (rate limits), #382 (Seats and Games as an Account), #383 (account page), #384 (names by Username, switching devices end to end), then:

the code review's fixes: atomic sign-in limits, any reused older refresh token revokes its Session, a dummy hash computed at start-up, one PGN name for an ownerless side ("?"), a Room stream that resumes signed out after a failed refresh;
the owner's lint changes: new-cap and max-params off for Nest modules, controllers, services and guards; max-lines 800 in source and off in tests;
Demo Accounts in the seed and a devtools Account panel (Demo Account A and B, demo-account-a@chess.example / demo-account-a-password, same for B), with Games between Accounts, against a Demo Guest, and one with an ownerless side.

Evidence

Before: no auth or account router; a Player is a Guest on one browser.
After: gate green on the tip (engine 742, api 710+, front 1206+ tests), browser suite 38/38 on a built stack with Postgres and Mailpit, including:

accounts.spec.ts
  ✓ signs up, creates a Room; a Guest sees the Username; a second device signs in, is seated with the same Color and plays a Move the Guest sees
  ✓ asks for a reset link, reads it from Mailpit, sets a new password and is signed in; the old password then fails

Wire tests (apps/api/test/rpc-*.integration.test.ts) cover each cookie and its attributes, refresh rotation, the 30-second grace and revocation on reuse, each Username rule, each rate limit one under and at its boundary with its retry-after, concurrent sign-in bursts, the reset link's single use and expiry, export contents, deletion cascades, and Seats held across devices.
Chromium keeps __Host-access and __Secure-refresh on plain-HTTP localhost and 127.0.0.1 (Playwright Chromium 151): the refresh cookie travels only to its path, document.cookie stays empty, Max-Age=0 clears both.

Merge Danger

Door: one-way

Three migrations add accounts, sessions, password_reset_tokens and the account-owner columns on games. Once production has Accounts, rolling back the code strands their rows and their Sessions.

Blast Radius: production

The production API refuses to start without SESSION_SECRET and SMTP_URL. Before merging, run deploy/owner-setup.sh stages 4 and 6–9 (Session secret, Resend domain, DMARC, SMTP URL, preview Mailpit credentials), and stage 10 after the deploy.
Preview deploys fail until PREVIEW_MAILPIT_USER and PREVIEW_MAILPIT_PASSWORD exist (masked, not protected).
Other checkouts need pnpm env:sync then pnpm db (session secret, mail settings, raised per-IP limits, Mailpit).
Every page now reads account.me; every Room and game call goes through the guard, so a broken guard refuses everything.
The CI Mailpit service and the preview Mailpit overlay were checked with docker compose config and shellcheck only, not on the runner or the VPS.
The blocked-word list in apps/api/src/auth/username.ts holds slurs, as a name filter must; worth a look.

Proposed rule changes

Not edited here; each needs the owner's word.

apps/api/CODING_STANDARDS.md: reword "one feature module" to cover auth/, mail/ and the guard; replace rule 5's Seat-token header line with the Guest header plus the access cookie the guard reads; name common/rate-limit.service.ts as a Nest service in common/.
apps/front/CODING_STANDARDS.md: review rule 1's vertical list misses games/ and auth/; rule 7 should allow a change of identity to reset the whole Query cache on success, as sign-in, sign-up, reset and deletion do.
Layer order: the tables live in common/schema.ts and account.export in games/, because common cannot import auth and auth cannot import games. An account/ folder after games/ would give the export a natural home.
ADR 0039: note that the seed also writes Demo Accounts with public credentials, and the probe may name the stack's Mailpit from MAILPIT_URL. Spec #394 listed Demo Accounts as out of scope; the owner brought them in under this spec.
Remaining lint fits: #398.

Closes #364
Closes #378
Closes #379
Closes #380
Closes #381
Closes #382
Closes #383
Closes #384

## Summary A **Player** can create an **Account** (email, password, **Username**), sign in on any device, and reset a forgotten password by email. A signed-in browser holds **Seats** and owns **Games** as its **Account**, and every name shows as a **Username** or "Guest". ```text apps/api/src/ ├── auth/ # Accounts, Sessions (ADR 0030 cookies), the global guard, reset flow, Username rules (ADR 0040) ├── mail/ # one port; nodemailer over SMTP_URL, an in-memory outbox in tests ├── common/ # schema (accounts, sessions, reset tokens, games' account owners), rate limiter (ADR 0041) ├── games/ # Games read and stored as an Account; account.export ├── room/ # a Seat's occupant is an Account or a Guest; either identity proves it └── devtools/ # the probe also names the Demo Accounts and the stack's Mailpit apps/front/src/ ├── auth/ # /sign-up, /sign-in, /forgot-password, /reset-password, /account ├── lib/ # refresh-and-retry on UNAUTHORIZED, the session signal, the account query └── app/ # navigation names the Account; devtools Account panel ``` ```mermaid sequenceDiagram participant Tab participant API Tab->>API: room.get (access JWT expired) API-->>Tab: 401 UNAUTHORIZED Tab->>API: auth.refresh (once per tab at a time) API-->>Tab: new access + refresh cookies Tab->>API: room.get, retried once Note over Tab: a refused refresh marks the Account signed out ``` ```diff Seat occupant - Guest + Guest | Account (id, Username) a call occupies a Seat when - its Guest matches + its Account or its Guest matches # a Guest-held Seat survives sign-in; a second device picks up the Account's ``` Delivered in tickets #378 (Sessions on the wire), #379 (sign-up and sign-in pages), #380 (password reset, Mailpit), #381 (rate limits), #382 (Seats and Games as an Account), #383 (account page), #384 (names by Username, switching devices end to end), then: - the code review's fixes: atomic sign-in limits, any reused older refresh token revokes its **Session**, a dummy hash computed at start-up, one PGN name for an ownerless side ("?"), a **Room** stream that resumes signed out after a failed refresh; - the owner's lint changes: `new-cap` and `max-params` off for Nest modules, controllers, services and guards; `max-lines` 800 in source and off in tests; - **Demo Accounts** in the seed and a devtools Account panel (Demo Account A and B, `demo-account-a@chess.example` / `demo-account-a-password`, same for B), with **Games** between Accounts, against a **Demo Guest**, and one with an ownerless side. ## Evidence - **Before:** no `auth` or `account` router; a **Player** is a **Guest** on one browser. **After:** gate green on the tip (engine 742, api 710+, front 1206+ tests), browser suite 38/38 on a built stack with Postgres and Mailpit, including: ```text accounts.spec.ts ✓ signs up, creates a Room; a Guest sees the Username; a second device signs in, is seated with the same Color and plays a Move the Guest sees ✓ asks for a reset link, reads it from Mailpit, sets a new password and is signed in; the old password then fails ``` - Wire tests (`apps/api/test/rpc-*.integration.test.ts`) cover each cookie and its attributes, refresh rotation, the 30-second grace and revocation on reuse, each **Username** rule, each rate limit one under and at its boundary with its retry-after, concurrent sign-in bursts, the reset link's single use and expiry, export contents, deletion cascades, and **Seats** held across devices. - Chromium keeps `__Host-access` and `__Secure-refresh` on plain-HTTP `localhost` and `127.0.0.1` (Playwright Chromium 151): the refresh cookie travels only to its path, `document.cookie` stays empty, `Max-Age=0` clears both. ## Merge Danger **Door:** one-way Three migrations add `accounts`, `sessions`, `password_reset_tokens` and the account-owner columns on `games`. Once production has **Accounts**, rolling back the code strands their rows and their **Sessions**. **Blast Radius:** production - The production API refuses to start without `SESSION_SECRET` and `SMTP_URL`. Before merging, run `deploy/owner-setup.sh` stages 4 and 6–9 (Session secret, Resend domain, DMARC, SMTP URL, preview Mailpit credentials), and stage 10 after the deploy. - Preview deploys fail until `PREVIEW_MAILPIT_USER` and `PREVIEW_MAILPIT_PASSWORD` exist (masked, not protected). - Other checkouts need `pnpm env:sync` then `pnpm db` (session secret, mail settings, raised per-IP limits, Mailpit). - Every page now reads `account.me`; every **Room** and `game` call goes through the guard, so a broken guard refuses everything. - The CI Mailpit service and the preview Mailpit overlay were checked with `docker compose config` and shellcheck only, not on the runner or the VPS. - The blocked-word list in `apps/api/src/auth/username.ts` holds slurs, as a name filter must; worth a look. ## Proposed rule changes Not edited here; each needs the owner's word. - `apps/api/CODING_STANDARDS.md`: reword "one feature module" to cover `auth/`, `mail/` and the guard; replace rule 5's Seat-token header line with the **Guest** header plus the access cookie the guard reads; name `common/rate-limit.service.ts` as a Nest service in `common/`. - `apps/front/CODING_STANDARDS.md`: review rule 1's vertical list misses `games/` and `auth/`; rule 7 should allow a change of identity to reset the whole Query cache on success, as sign-in, sign-up, reset and deletion do. - Layer order: the tables live in `common/schema.ts` and `account.export` in `games/`, because `common` cannot import `auth` and `auth` cannot import `games`. An `account/` folder after `games/` would give the export a natural home. - ADR 0039: note that the seed also writes **Demo Accounts** with public credentials, and the probe may name the stack's Mailpit from `MAILPIT_URL`. Spec #394 listed Demo Accounts as out of scope; the owner brought them in under this spec. - Remaining lint fits: #398. Closes #364 Closes #378 Closes #379 Closes #380 Closes #381 Closes #382 Closes #383 Closes #384

project_1_bot_a8dd9262857d850eef8dca5206e61de5 commented

2026-10-14 10:43:03 +00:00

(Migrated from gitlab.core-project.space)

Screenshots

Before is production, after is this merge request's review app at 349270e.

Desktop

Page	Before	After
Home
Local game
Room

Mobile

Page	Before	After
Home
Local game
Room

### Screenshots Before is production, after is this merge request's review app at 349270e. #### Desktop | Page | Before | After | | --- | --- | --- | | Home | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/before/home-desktop.png" width="400"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/after/home-desktop.png" width="400"> | | Local game | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/before/local-desktop.png" width="400"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/after/local-desktop.png" width="400"> | | Room | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/before/room-desktop.png" width="400"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/after/room-desktop.png" width="400"> | #### Mobile | Page | Before | After | | --- | --- | --- | | Home | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/before/home-mobile.png" width="200"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/after/home-mobile.png" width="200"> | | Local game | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/before/local-mobile.png" width="200"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/after/local-mobile.png" width="200"> | | Room | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/before/room-mobile.png" width="200"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/893/artifacts/raw/review-screenshots/after/room-mobile.png" width="200"> |

root commented

2026-10-14 10:54:29 +00:00

(Migrated from gitlab.core-project.space)

added 2 commits

605d73dd - chore(front): declare the auth vertical in the per-vertical import rules
0b08e202 - feat(front): sign-up and sign-in pages, the Account in the navigation, refresh on UNAUTHORIZED

Compare with previous version

added 2 commits <ul><li>605d73dd - chore(front): declare the auth vertical in the per-vertical import rules</li><li>0b08e202 - feat(front): sign-up and sign-in pages, the Account in the navigation, refresh on UNAUTHORIZED</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=139&start_sha=a6157e1eeed3447cb75cdf29d988ceae3a2364b8)

root commented

2026-10-14 11:01:19 +00:00

(Migrated from gitlab.core-project.space)

added 2 commits

a9852fab - feat(api): take Seats and own decided Games as an Account, and name each occupant
e9801a33 - Merge remote-tracking branch 'origin/spec-364-accounts' into ticket-382-seats-games-account

Compare with previous version

added 2 commits <ul><li>a9852fab - feat(api): take Seats and own decided Games as an Account, and name each occupant</li><li>e9801a33 - Merge remote-tracking branch 'origin/spec-364-accounts' into ticket-382-seats-games-account</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=143&start_sha=0b08e2029728c8e52364090fe8c189c0e68cc008)

root commented

2026-10-14 11:15:17 +00:00

(Migrated from gitlab.core-project.space)

added 1 commit

b379bb71 - feat(front): account page with an export download and deletion by password

Compare with previous version

added 1 commit <ul><li>b379bb71 - feat(front): account page with an export download and deletion by password</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=145&start_sha=e9801a33c98f46706599081a97ec9cae270d2d8a)

root commented

2026-10-14 11:19:43 +00:00

(Migrated from gitlab.core-project.space)

added 4 commits

2c7a9444 - feat(front): name Seats and sides by Username, list an Account's Games, follow sign-in
28225bbd - test(e2e): switch devices mid-Game as an Account, named by Username to a Guest
c24a93ae - Merge remote-tracking branch 'origin/spec-364-accounts' into ticket-384-names-e2e
6c498577 - refactor(front): export a Game's PGN through lib's download

Compare with previous version

added 4 commits <ul><li>2c7a9444 - feat(front): name Seats and sides by Username, list an Account's Games, follow sign-in</li><li>28225bbd - test(e2e): switch devices mid-Game as an Account, named by Username to a Guest</li><li>c24a93ae - Merge remote-tracking branch 'origin/spec-364-accounts' into ticket-384-names-e2e</li><li>6c498577 - refactor(front): export a Game's PGN through lib's download</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=146&start_sha=b379bb71bd539f891a7fcfafd73e436230ffbcd7)

root commented

2026-10-14 11:27:23 +00:00

(Migrated from gitlab.core-project.space)

added 8 commits

4dcf6673 - chore(api): declare the mail folder in the API's layer order and framework-import rules
41a1f52c - feat(contracts): request a password reset link and reset the password with its token
a2edcd45 - feat(api): reset a password by an emailed single-use link, and sweep expired rows hourly
dff0ddb2 - feat(front): forgot-password and reset-password pages
83aa9fc8 - feat(repo): catch dev mail in a shared Mailpit and give each worktree its mail settings
6674fb74 - test(e2e): a Player resets a forgotten password from the link Mailpit caught
b2d87c7c - feat(ci): send production's mail through Resend and catch each preview's in its own Mailpit
6206744f - Merge remote-tracking branch 'origin/spec-364-accounts' into ticket-380-password-reset

Compare with previous version

added 8 commits <ul><li>4dcf6673 - chore(api): declare the mail folder in the API's layer order and framework-import rules</li><li>41a1f52c - feat(contracts): request a password reset link and reset the password with its token</li><li>a2edcd45 - feat(api): reset a password by an emailed single-use link, and sweep expired rows hourly</li><li>dff0ddb2 - feat(front): forgot-password and reset-password pages</li><li>83aa9fc8 - feat(repo): catch dev mail in a shared Mailpit and give each worktree its mail settings</li><li>6674fb74 - test(e2e): a Player resets a forgotten password from the link Mailpit caught</li><li>b2d87c7c - feat(ci): send production's mail through Resend and catch each preview's in its own Mailpit</li><li>6206744f - Merge remote-tracking branch 'origin/spec-364-accounts' into ticket-380-password-reset</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=147&start_sha=6c4985771768f212a24d8b6de2684294a3eda982)

root commented

2026-10-14 11:43:08 +00:00

(Migrated from gitlab.core-project.space)

added 3 commits

2d3fa759 - docs(repo): record ADR 0040, rate limits as in-memory counters in the API
08aef0bb - feat(api): limit sign-ups, failed sign-ins and reset requests per IP and per email
26e6d979 - feat(front): tell a rate-limited Player when to try again on sign-up, sign-in and reset requests

Compare with previous version

added 3 commits <ul><li>2d3fa759 - docs(repo): record ADR 0040, rate limits as in-memory counters in the API</li><li>08aef0bb - feat(api): limit sign-ups, failed sign-ins and reset requests per IP and per email</li><li>26e6d979 - feat(front): tell a rate-limited Player when to try again on sign-up, sign-in and reset requests</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=148&start_sha=6206744f602499af820fe3e62c6c4b94cb1a94dc)

root commented

2026-10-14 12:04:51 +00:00

(Migrated from gitlab.core-project.space)

added 6 commits

97256e79 - fix(api): count sign-in failures atomically and revoke a Session on any old refresh token
4f30f03c - feat(engine): name a PGN side and date a PGN once, for every app that writes one
728f917c - refactor(api): write the export's PGN names and date through the engine's helpers
d9b54011 - fix(front): name a side nobody owned ? in the PGN, as the account export does
90b5f37d - fix(front): follow a Room signed out once a lost Session refuses its stream
d6342dbe - refactor(front): read who is signed in through one account query, and fire lib's signals once

Compare with previous version

added 6 commits <ul><li>97256e79 - fix(api): count sign-in failures atomically and revoke a Session on any old refresh token</li><li>4f30f03c - feat(engine): name a PGN side and date a PGN once, for every app that writes one</li><li>728f917c - refactor(api): write the export's PGN names and date through the engine's helpers</li><li>d9b54011 - fix(front): name a side nobody owned ? in the PGN, as the account export does</li><li>90b5f37d - fix(front): follow a Room signed out once a lost Session refuses its stream</li><li>d6342dbe - refactor(front): read who is signed in through one account query, and fire lib's signals once</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=149&start_sha=26e6d97940eaab86b68fd4f88c5d19879e68ead6)

root commented

2026-10-14 12:19:58 +00:00

(Migrated from gitlab.core-project.space)

added 56 commits

d6342dbe...960aace0 - 22 commits from branch main
960aace0...264bc50a - 24 earlier commits
447c6e61 - feat(front): tell a rate-limited Player when to try again on sign-up, sign-in and reset requests
54f82a1a - fix(api): count sign-in failures atomically and revoke a Session on any old refresh token
e525470d - feat(engine): name a PGN side and date a PGN once, for every app that writes one
4adadd10 - refactor(api): write the export's PGN names and date through the engine's helpers
b5e8c265 - fix(front): name a side nobody owned ? in the PGN, as the account export does
4fe09757 - fix(front): follow a Room signed out once a lost Session refuses its stream
e0834c28 - refactor(front): read who is signed in through one account query, and fire lib's signals once
28ec752a - docs(repo): cite the Username and rate-limit ADRs as 0040 and 0041
0ab4a52d - fix(api): answer the devtools probe without reading the Session cookie
8f876665 - test(front): fit main's devtools tests to the account-aware games server and root calls

Compare with previous version

added 56 commits <ul><li>d6342dbe...960aace0 - 22 commits from branch <code>main</code></li><li>960aace0...264bc50a - 24 earlier commits</li><li>447c6e61 - feat(front): tell a rate-limited Player when to try again on sign-up, sign-in and reset requests</li><li>54f82a1a - fix(api): count sign-in failures atomically and revoke a Session on any old refresh token</li><li>e525470d - feat(engine): name a PGN side and date a PGN once, for every app that writes one</li><li>4adadd10 - refactor(api): write the export's PGN names and date through the engine's helpers</li><li>b5e8c265 - fix(front): name a side nobody owned ? in the PGN, as the account export does</li><li>4fe09757 - fix(front): follow a Room signed out once a lost Session refuses its stream</li><li>e0834c28 - refactor(front): read who is signed in through one account query, and fire lib's signals once</li><li>28ec752a - docs(repo): cite the Username and rate-limit ADRs as 0040 and 0041</li><li>0ab4a52d - fix(api): answer the devtools probe without reading the Session cookie</li><li>8f876665 - test(front): fit main's devtools tests to the account-aware games server and root calls</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=150&start_sha=d6342dbefb2c31e7287519bfad08b0a84d055bfd)

root commented

2026-10-14 12:27:13 +00:00

(Migrated from gitlab.core-project.space)

added 4 commits

0042ac67 - chore(repo): relax new-cap, max-params and max-lines as the owner decided
9f3dd020 - refactor(api): name the replaced token's grace check now the 500-line ceiling is gone
f2f4eff5 - test(front): let the devtools probe and who-is-signed-in through apart again
87a43b72 - test(front): smoke-test the /account route beside the other auth pages

Compare with previous version

added 4 commits <ul><li>0042ac67 - chore(repo): relax new-cap, max-params and max-lines as the owner decided</li><li>9f3dd020 - refactor(api): name the replaced token's grace check now the 500-line ceiling is gone</li><li>f2f4eff5 - test(front): let the devtools probe and who-is-signed-in through apart again</li><li>87a43b72 - test(front): smoke-test the /account route beside the other auth pages</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=151&start_sha=8f876665f2514fb5d02511a220393d2a2bb614ea)

root commented

2026-10-14 12:34:18 +00:00

(Migrated from gitlab.core-project.space)

mentioned in issue #398

root commented

2026-10-14 12:42:58 +00:00

(Migrated from gitlab.core-project.space)

added 6 commits

5e1b695a - feat(contracts): let the devtools probe answer Demo Accounts and the stack's Mailpit
6c9ec5e9 - feat(api): seed two Demo Accounts and their Games, and name them and Mailpit in the probe
cde2e5d1 - feat(ci): name each preview's Mailpit to its app, for the devtools to link to
3df5b3ad - feat(repo): name the dev Mailpit to each worktree's API, for the devtools to link to
0cc8ff14 - feat(front): sign in as a Demo Account from an Account panel in the devtools
349270ed - docs(repo): define Demo Account, and stop the Demo Guest row calling itself one

Compare with previous version

added 6 commits <ul><li>5e1b695a - feat(contracts): let the devtools probe answer Demo Accounts and the stack's Mailpit</li><li>6c9ec5e9 - feat(api): seed two Demo Accounts and their Games, and name them and Mailpit in the probe</li><li>cde2e5d1 - feat(ci): name each preview's Mailpit to its app, for the devtools to link to</li><li>3df5b3ad - feat(repo): name the dev Mailpit to each worktree's API, for the devtools to link to</li><li>0cc8ff14 - feat(front): sign in as a Demo Account from an Account panel in the devtools</li><li>349270ed - docs(repo): define Demo Account, and stop the Demo Guest row calling itself one</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/23/diffs?diff_id=152&start_sha=87a43b72d287464dee8ffb5f4a08c2e99b742cd5)

root commented

2026-10-14 12:43:32 +00:00

(Migrated from gitlab.core-project.space)

marked this merge request as ready

marked this merge request as **ready**

root commented

2026-10-14 12:43:32 +00:00

(Migrated from gitlab.core-project.space)

changed the description

root commented

2026-10-14 13:24:41 +00:00

(Migrated from gitlab.core-project.space)