[Ethan-Arrowood]

Second of three PRs: fixtures + seed (#1) → dev sign-in + guard → API tests in CI.

Stacked on #1 (it reuses #1's isLocalInstance()). Once #1 merges, this retargets to main.

Why

LOCAL_DEV_LOGIN made every request one synthetic admin. That meant you couldn't try attendee vs. admin, two people racing for a task, or bans, and one misplaced env var made every visitor an admin.

What

• POST /api/dev/login { "as": "fx_alice" } signs the session in as that user, the same way the GitHub OAuth plugin does (session.update({ user })). The rest of the app can't tell the difference.
  • Calling it again switches users.
  • An unknown login is created as a plain attendee.
  • GET /api/dev/users lists who you can sign in as.
  • Sign-out is the existing POST /oauth/logout.
• A Dev menu in the nav ("Sign in as…" / "Switch user…"). /api/me reports devSignIn: true only when it's on, so production makes no extra request.
• Guards:
  • off unless LOCAL_DEV_SIGN_IN=true and the instance is local (OAUTH_REDIRECT_URI unset or loopback);
  • only for logins with an underscore, which GitHub usernames can't have. Even enabled in the wrong place, it can never act as a real account;
  • when off, the routes aren't registered at all.
• LOCAL_DEV_LOGIN and the local-dev user are removed. Setting it now logs a warning pointing at LOCAL_DEV_SIGN_IN.
• Docs: README, .env.example, fixtures/README.md.

It's a POST rather than a link because the SSR handler claims every browser navigation outside /oauth. A GET from the address bar would render the app's 404 page instead of reaching the API.

Verified on a local Harper 5.2 with fixtures

• API:
  • sign in as fx_alice and switch to fx_ada in the same session; the admin route returns 403 then 200;
  • banned fx_carol can sign in but can't claim;
  • a new fx_zed is created as an attendee and can claim;
  • ethan-arrowood → 400;
  • GET /api/dev/login doesn't sign in;
  • sign-out clears the session.
• Browser (production build): the Dev menu signs in as fx_alice, switching to fx_ada shows the Admin nav link, and Sign out returns the nav to "Sign in as…".
• Guard (OAUTH_REDIRECT_URI=https://example.com/...): logs LOCAL_DEV_SIGN_IN ignored, dev routes 404, no devSignIn flag. Not set: the same 404s.
• LOCAL_DEV_LOGIN=true logs the replacement warning and grants nothing.

Found while testing (not changed here)

• npm run dev never hydrates on a fresh install, on main too. The Vite dev server serves classnames unbundled (does not provide an export named 'default'). Production builds are fine.
• Harper's static serving refuses paths under a dot-directory, so the app can't serve its assets when run from .claude/worktrees/….
• At startup, several workers run @harperfast/vite's build at once, each emptying dist/. That churn likely explains the missing entry-server.js after production deploys.

🤖 Generated with Claude Code