[2.0] Cloud overhaul + coaching + setup versioning + fastest lap snapshots + gdpr

.env.example

@@ -1,13 +1,45 @@
+# =============================================================================
+# Build-time configuration for Dove's DataViewer / HackTheTrack
+# =============================================================================
+#
+# Two prefixes are accepted at build time (see vite.config.ts):
+#
+#   VITE_*   Standard Vite convention. Read directly from .env at build time.
+#            Easiest for local dev. NOT accepted by Lovable's secret store
+#            (Lovable rejects the VITE_ prefix because those values are
+#            public/bundled).
+#
+#   HTT_*    Mirror prefix accepted by Lovable workspace **build secrets**.
+#            If you don't want to commit .env values, set these in
+#            Workspace Settings -> Build Secrets and leave .env empty.
+#            They are copied into the VITE_* names at build time.
+#
+# Precedence per key: VITE_* > HTT_* > built-in public fallback.
+#
+# REMINDER: Lovable build secrets do NOT auto-inject into ad-hoc rebuilds in
+# every environment yet. Until that's seamless, you may need to either:
+#   - regenerate this .env on each fresh build env, OR
+#   - re-set the HTT_* values in Workspace -> Build Secrets.
+# =============================================================================
+
+# --- Backend wiring (public anon values — safe to commit, but optional) ------
 VITE_SUPABASE_PROJECT_ID="your-supabase-project-id"
 VITE_SUPABASE_PUBLISHABLE_KEY="your-supabase-anon-key"
 VITE_SUPABASE_URL="https://your-project.supabase.co"
+# HTT_SUPABASE_PROJECT_ID=""
+# HTT_SUPABASE_PUBLISHABLE_KEY=""
+# HTT_SUPABASE_URL=""
 
-# Set to "true" to enable the admin panel (/admin route, login UI).
-# Default off — the public app works fully without admin features.
-VITE_ENABLE_ADMIN="false"
+# --- Feature flags -----------------------------------------------------------
+# Set to "true" to enable public user accounts (Cloud Sync, Google sign-in,
+# /register, /forgot-password, /reset-password, /auth/callback).
+VITE_ENABLE_CLOUD="true"
+# HTT_ENABLE_CLOUD="true"
 
-# Set to "true" to expose the /register route.
-VITE_ENABLE_REGISTRATION="false"
+# Set to "true" to enable the admin panel (/admin route, login UI).
+# Defaults ON so fresh builds get the full feature set.
+VITE_ENABLE_ADMIN="true"
+# HTT_ENABLE_ADMIN="true"
 
 # Optional: Cloudflare Turnstile site key for the public contact form.
 # Leave empty to skip CAPTCHA.

.github/workflows/build.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
       - run: npm ci
       # The build needs VITE_* env vars resolved at build time, including

.github/workflows/coverage.yml

@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
       - run: npm ci
 

.github/workflows/lint.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
       - run: npm ci
       - run: npm run lint

.github/workflows/test.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
       - run: npm ci
       - run: npm run test:run

.github/workflows/typecheck.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
       - run: npm ci
       - run: npm run typecheck

.lovable/plan.md

@@ -1,31 +1,78 @@
-# Fix: Dialogs appearing behind the File Manager drawer
 
-## Problem
+## Goal
 
-When the File Manager drawer is open (e.g. via the Bluetooth/Device tab) and a dialog opens on top of it (the BLE file download dialog from `DataloggerDownload`), the dialog renders *behind* the drawer.
+Let any user (not just admins) sign up, sign in (email or Google), and reset their password so they can use Cloud Sync and future user features — **but keep the entire cloud/auth surface behind a single build-time flag** so the offline-first repo can ship with zero cloud code paths active. Admin status stays a separate concept driven by `user_roles`.
 
-## Root cause
+## Build-time gating model
 
-Stacking values are inconsistent across the app:
+One new flag controls all user-facing cloud auth: **`VITE_ENABLE_CLOUD`** (default `"false"`).
 
-| Component | Overlay z | Content z |
-|---|---|---|
-| `src/components/ui/dialog.tsx` | `z-[9999]` | `z-[10000]` |
-| `src/components/FileManagerDrawer.tsx` | `z-[10000]` (backdrop) | `z-[10001]` (panel) |
-| `src/components/ui/sheet.tsx` | `z-50` | `z-50` |
+| Flag | Controls |
+|------|----------|
+| `VITE_ENABLE_CLOUD` | Public auth routes (`/login`, `/register`, `/forgot-password`, `/reset-password`, `/auth/callback`), header "Sign in" entry, Cloud Sync Labs panel registration, Google OAuth button |
+| `VITE_ENABLE_ADMIN` | `/admin` route + admin UI (unchanged) |
+| `VITE_ENABLE_REGISTRATION` | **Retired** — registration follows `VITE_ENABLE_CLOUD` |
 
-The drawer panel (`10001`) sits above the dialog content (`10000`), so any `Dialog` opened from inside the drawer is occluded.
+When `VITE_ENABLE_CLOUD !== 'true'`:
+- None of the new auth pages are imported (lazy boundaries + conditional `<Route>` mounting, same pattern as `/admin` today).
+- The cloud-sync plugin's `index.ts` early-returns from `setup()` so it never contributes a panel — Labs tab stays absent unless something else contributes.
+- The header "Sign in" affordance is not rendered.
+- `AuthContext` still mounts (admin build needs it), but the new `signUp` / `signInWithGoogle` methods are no-ops behind the same flag check — or, cleaner, the Google-specific lovable client import stays inside the lazy page modules so it never lands in the main chunk.
 
-## Fix
+Admin builds independently set `VITE_ENABLE_ADMIN=true`; they continue to work whether cloud is on or off (admin login uses the existing `supabase.auth.signInWithPassword` path).
 
-Raise the shared `Dialog` primitive above the custom drawer so every dialog opened from anywhere (drawer, page, etc.) always wins.
+## Scope
 
-In `src/components/ui/dialog.tsx`:
-- `DialogOverlay`: `z-[9999]` → `z-[10010]`
-- `DialogContent`: `z-[10000]` → `z-[10011]`
+1. **Routing (`src/App.tsx`)**
+   - Add `const enableCloud = import.meta.env.VITE_ENABLE_CLOUD === 'true';`
+   - Mount the new public auth routes only when `enableCloud`. `/login` is mounted when `enableCloud || enableAdmin` (admin still needs it). Drop the `VITE_ENABLE_REGISTRATION` check.
+   - All new pages lazy-loaded so the disabled build never downloads them.
 
-This keeps the drawer above normal page chrome but ensures any modal dialog (BLE download, export, confirmations, etc.) layers on top of it. No changes to `FileManagerDrawer` or `Sheet` are needed — the only known collision is dialog-vs-drawer, and `Sheet` (`z-50`) isn't used in conflict with the drawer.
+2. **New pages (all lazy)**
+   - `src/pages/ForgotPassword.tsx` — email → `supabase.auth.resetPasswordForEmail(email, { redirectTo: origin + '/reset-password' })`.
+   - `src/pages/ResetPassword.tsx` — public route, detects `type=recovery` hash, calls `supabase.auth.updateUser({ password })`, routes to `/`.
+   - `src/pages/AuthCallback.tsx` at `/auth/callback` — waits for `onAuthStateChange`, then redirects to `?next=` or `/`.
 
-## Verification
+3. **Rework `Login.tsx` / `Register.tsx`**
+   - Reframe copy from "Admin Login" → "Sign in". Add a "Continue with Google" button at the top (rendered only when `enableCloud`).
+   - Forgot-password becomes a link to `/forgot-password` instead of an inline toggle.
+   - Keep the per-IP rate-limit edge function. Success redirects to `?next=` or `/` (admins land on `/admin` via the next param, set by header link).
+   - Registration always-on under cloud flag; keep email-confirm flow (no auto-confirm).
 
-After the change: open the drawer → Device tab → trigger the BLE download dialog; the dialog and its overlay should sit above the drawer panel.
+4. **Google sign-in via Lovable Cloud managed OAuth**
+   - Run `supabase--configure_social_auth` with `providers: ["google"]` (keep email).
+   - Use `lovable.auth.signInWithOAuth("google", { redirect_uri: origin + "/auth/callback" })` from the scaffolded `src/integrations/lovable/`. Import only from the cloud-flagged pages so it tree-shakes out otherwise.
+   - PWA: add `/^\/~oauth/` to `navigateFallbackDenylist` in `vite.config.ts` so OAuth redirects bypass the service worker.
+
+5. **`AuthContext` additions**
+   - Add `signUp(email, password)` and `signInWithGoogle()` wrappers next to existing `login` / `resetPassword`. Admin role detection via `has_role` stays unchanged — regular users have no `user_roles` row, so `isAdmin` is `false`.
+
+6. **Cloud Sync plugin (`src/plugins/cloud-sync/index.ts`)**
+   - In `setup()`, early-return when `VITE_ENABLE_CLOUD !== 'true'` so the Labs panel isn't contributed. `CloudSyncPanel.tsx` stays lazy and never imports.
+   - When enabled, replace the inline email/password form with: blurb + "Sign in" / "Create account" buttons routing to `/login?next=/` and `/register`, plus a "Continue with Google" shortcut using the new context method. Smaller panel, no duplicated auth UI.
+
+7. **Header / nav affordance (`LandingPage.tsx` or top of `Index.tsx`)**
+   - Render a "Sign in" / account menu **only when `enableCloud`**. Signed-in users see email + Sign out; admins additionally see an Admin link (still gated by `isAdmin && enableAdmin`).
+
+8. **Auth settings**
+   - Call `supabase--configure_auth`: `disable_signup: false`, `auto_confirm_email: false`, `external_anonymous_users_enabled: false`, `password_hibp_enabled: true`.
+
+9. **Docs**
+   - `README.md`: add `VITE_ENABLE_CLOUD` row (default false; enables public auth + cloud sync); remove `VITE_ENABLE_REGISTRATION`; clarify `VITE_ENABLE_ADMIN` only gates `/admin`. Note offline-first invariant: with the flag off, no auth/cloud code runs.
+   - `CLAUDE.md`: update env vars section, architecture map, and plugin notes (cloud-sync now flag-gated).
+   - `CHANGELOG.md`: `[Unreleased]` entry under "Added" + "Changed" (flag rename).
+   - Update memory `mem://config/environment-variables` and `mem://architecture/cloud-sync-strategy` to reflect the new flag.
+
+## Out of scope
+
+- Apple / other social providers (easy follow-up; Lovable Cloud supports Apple).
+- Profiles table / display names / avatars — current features key off `auth.uid()` only.
+- Branded auth emails (`scaffold_auth_email_templates`) and custom email domain.
+
+## Technical notes
+
+- Files added: `src/pages/ForgotPassword.tsx`, `src/pages/ResetPassword.tsx`, `src/pages/AuthCallback.tsx`.
+- Files changed: `src/App.tsx`, `src/pages/Login.tsx`, `src/pages/Register.tsx`, `src/contexts/AuthContext.tsx`, `src/plugins/cloud-sync/index.ts`, `src/plugins/cloud-sync/CloudSyncPanel.tsx`, `vite.config.ts` (PWA denylist), `src/components/LandingPage.tsx` (or `Index.tsx` header), `README.md`, `CLAUDE.md`, `CHANGELOG.md`.
+- Tool-generated (do not hand-edit): `src/integrations/lovable/` from `configure_social_auth`. Even when generated, it only runs at import time from cloud-flagged pages → stays out of the disabled build's bundle via lazy boundaries.
+- No DB migration required.
+- Verification: `npm run build` once with `VITE_ENABLE_CLOUD` unset (confirm auth chunks absent, Labs tab not auto-mounted), once with `VITE_ENABLE_CLOUD=true` (confirm routes + Google flow work).