Ledger

WEB-212

game_demo schema (DEMO only): accounts, characters, items, receipts, sessions, security rules/events, sanctions, reports, channels, economy, world runs; audited RPCs; deterministic generator (seed 4242) from public-data ids; pgTAP

← Ledger

donestatus · web-db

2✓ 1✗tests passed / failed

10.20Mtokens · 9 min

0evidence files

Evidence

From logs/evidence/WEB-212/. Click a thumbnail for the full image.

No evidence files in logs/evidence/WEB-212/.

Tests

fail pgTAP game_demo: anon blocked, e-mail column private (reveal needs read_pii + reason, logged), ladder by permission with audit, grants only from an approved request by its approver once, rule tier ceiling, ban/lift/appeal reversal restores · 1.6 s · raw log$ pnpm db:test

pass pgTAP game_demo (26) + 050_cms made independent of undelivered outbox rows from e2e runs · 1.5 s · raw log$ pnpm db:test

pass @zoen/db unit tests incl. demo seed determinism + real game ids (builds, zones, bases, slots, rules) + typecheck · 4.9 s · raw log$ pnpm --filter @zoen/db test && pnpm --filter @zoen/db typecheck && pnpm db:types:check

Notes

2026-10-04 21:57 UTC · game_demo (DEMO only, labelled in the console): 12 tables with RLS by permission; writes only via 10 audited RPCs (search, reveal_email, sanction ladder, lift, rename, reset_position, apply_grant, set_rule, decide_appeal, decide_report). Security review fixes before commit: (1) the foundation's default grants would have exposed player e-mails and table writes — narrowed to a column grant without email and no write grants; e-mails only via reveal_email (players.read_pii + reason, logged). (2) apply_grant first took free parameters, so a GM (who holds gm.grant to request) could have granted without approval — it now takes only an approved request id, runs only by its approver, once (unique receipt.approval_id). Manual permanent bans are owner-only (players.ban). Generator: deterministic (seed 4242) from game ids, gitignored output, pnpm db:seed:demo loads it, db:reset regenerates it. Also fixed 050_cms pgTAP which assumed an empty outbox (51 undelivered e2e rows).