greyson/super-auto-pets-board-game
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Put the bug report behind an always-available button.

Browse Source 
The debug report was only reachable in DEBUG mode, which is the one mode
a player hitting a real bug won't be running. Move it to a "🐛 Report a
bug" item in the game menu: a note field, a download, and a copy-as-text,
on any server.

That knowingly shows the reporter their opponents' hands and the shop
deck order. Credentials are still required, so a report only ever reaches
someone seated at that table. The buy-any-card panel stays DEBUG-only —
it changes the game; a report only reads it.
This commit is contained in:
Greyson Parrelli
2026-08-10 13:42:31 -04:00
parent 8ccde03023
commit 6ae4d41976
9 changed files with 167 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/debug_report_test.go
+16 -15
View File
@@ -12,9 +12,10 @@ import (
"github.com/greyson/super-auto-pets-board-game/internal/store"
)
// reportServer stands up a server holding one started two-player game, and
// returns it with the credentials for seat 0.
func reportServer(t *testing.T, debug bool) (*httptest.Server, *game.Game, *game.Player) {
// reportServer stands up an ordinary server — DEBUG off, the way it runs in
// production — holding one started two-player game, and returns it with the
// credentials for seat 0.
func reportServer(t *testing.T) (*httptest.Server, *game.Game, *game.Player) {
t.Helper()
st, err := store.Open(t.TempDir())
if err != nil {
@@ -31,8 +32,8 @@ func reportServer(t *testing.T, debug bool) (*httptest.Server, *game.Game, *game
if err := st.Save(g); err != nil {
t.Fatal(err)
}
srv := New(st, "", debug)
srv.rooms[g.ID] = &room{game: g, conns: map[*client]struct{}{}, debug: debug}
srv := New(st, "", false)
srv.rooms[g.ID] = &room{game: g, conns: map[*client]struct{}{}}
ts := httptest.NewServer(srv.Handler())
t.Cleanup(ts.Close)
return ts, g, p1
@@ -52,10 +53,10 @@ func get(t *testing.T, url string) (int, string) {
return res.StatusCode, string(body)
}
// In DEBUG mode a seated player can pull the report, in both forms, and the
// JSON one restores to the game the server is actually holding.
// A seated player can pull the report in both forms, and the JSON one restores
// to the game the server is actually holding.
func TestDebugReportEndpoint(t *testing.T) {
ts, g, p1 := reportServer(t, true)
ts, g, p1 := reportServer(t)
url := ts.URL + "/api/debug/report?game=" + g.ID + "&player=" + p1.ID + "&token=" + p1.Token
status, body := get(t, url+"&note=shop+row+looked+wrong")
@@ -90,16 +91,16 @@ func TestDebugReportEndpoint(t *testing.T) {
}
}
// A report exposes both players' decks and the shop deck order, so it must not
// be reachable without DEBUG, and never on someone else's credentials.
func TestDebugReportIsGated(t *testing.T) {
ts, g, p1 := reportServer(t, false)
// The in-game bug report button has to work on a normal server, so the endpoint
// is not DEBUG-gated — but it is still a seated player's own artifact, and never
// reachable on someone else's credentials.
func TestDebugReportNeedsCredentialsNotDebugMode(t *testing.T) {
ts, g, p1 := reportServer(t)
status, _ := get(t, ts.URL+"/api/debug/report?game="+g.ID+"&player="+p1.ID+"&token="+p1.Token)
if status != http.StatusNotFound {
t.Fatalf("without DEBUG the endpoint should 404, got %d", status)
if status != http.StatusOK {
t.Fatalf("a player should get their report without DEBUG, got %d", status)
}
ts, g, p1 = reportServer(t, true)
status, _ = get(t, ts.URL+"/api/debug/report?game="+g.ID+"&player="+p1.ID+"&token=wrong")
if status != http.StatusForbidden {
t.Fatalf("a bad token should 403, got %d", status)