Merge pull request #251 from coder13/dev

Release user-scoped solve history preview

Author: coder13

README.md

@@ -114,9 +114,10 @@ RaceSession and starts a new one; earlier attempts and solves remain preserved
 under their earlier session.
 
 Solve penalties use dedicated boolean columns rather than JSON so histories and
-statistics remain compact and index-friendly. Development-only
-`GET /api/solve-history` reads PostgreSQL session-linked history for the
-authenticated participant and is explicitly disabled in production.
+statistics remain compact and index-friendly. `GET /api/solve-history` reads
+PostgreSQL session-linked history for the authenticated participant. It is
+enabled in development and may be enabled for selected production users with
+`FEATURE_SOLVE_HISTORY_USER_IDS`.
 
 Set `POSTGRES_ENABLED=false` to disable mirroring. Production should set
 `PGHOST`, `PGDATABASE`, `PGUSER`, and `POSTGRES_PASSWORD`, or provide a

docs/data.md

@@ -51,11 +51,12 @@ new one, preserving the earlier session's attempts and solves. Complete
 snapshots are reserved for explicit backfill behavior.
 
 `GET /api/solve-history` is a PostgreSQL-only, authenticated self-history
-endpoint enabled only when `NODE_ENV=development`. It returns only
-session-linked solves for a current non-banned room participant; hidden,
-expired, and soft-deleted rooms remain readable to that participant. It never
-falls back to MongoDB or selects access codes, passwords, membership lists,
-moderation data, or email data.
+endpoint enabled in development and optionally for selected production users
+through `FEATURE_SOLVE_HISTORY_USER_IDS`. It returns only session-linked solves
+for a current non-banned room participant; hidden, expired, and soft-deleted
+rooms remain readable to that participant. It never falls back to MongoDB or
+selects access codes, passwords, membership lists, moderation data, or email
+data.
 
 The mirror intentionally catches database failures and returns control to the
 MongoDB-backed request. Monitoring must surface mirror errors because users may

server/api.js

@@ -37,11 +37,7 @@ module.exports = (app) => {
     res.json(req.user.toObject());
   });
 
-  if (isFeatureEnabled('solveHistory')) {
-    router.use('/solve-history', auth, createSolveHistoryRouter());
-  } else {
-    router.use('/solve-history', createSolveHistoryRouter());
-  }
+  router.use('/solve-history', auth, createSolveHistoryRouter());
 
   router.put('/updateUsername', auth, async (req, res) => {
     try {

server/api.test.js

@@ -4,9 +4,10 @@
 jest.mock('./models', () => ({
   User: { findOne: jest.fn() },
 }));
-jest.mock('./middlewares/auth.js', () => (req, res, next) => next());
+jest.mock('./middlewares/auth.js', () => jest.fn((req, res, next) => next()));
 
 const { User } = require('./models');
+const auth = require('./middlewares/auth.js');
 const router = require('./api')();
 
 const updateUsernameHandler = router.stack
@@ -74,3 +75,13 @@ describe('username API responses', () => {
     }));
   });
 });
+
+describe('solve history API access', () => {
+  it('requires authentication before checking the feature flag', () => {
+    const authLayer = router.stack.find((layer) => (
+      String(layer.regexp).includes('solve-history') && layer.handle === auth
+    ));
+
+    expect(authLayer).toBeDefined();
+  });
+});