BaseballHelm: make authenticated coach/player smoke tests mandatory in CI

[njrini99-code]

Problem

BaseballHelm authenticated E2E tests can be skipped entirely unless seeded Baseball fixtures are present. CI can go green without exercising the coach shell, player shell, capability-filtered nav, or core daily surfaces.

Evidence

• e2e/baseball-phase1.spec.ts skips coach tests unless PLAYWRIGHT_BASEBALL_SEEDED is set.
• The same spec skips player tests unless PLAYWRIGHT_BASEBALL_SEEDED is set.
• Existing route crawler coverage only hard-checks anonymous Baseball redirects; authenticated route crawling is Golf-only.

Why it matters

Recent PRs #344/#345 changed a huge amount of BaseballHelm shell, lifting, auth, nav, settings, and route behavior. Green CI should mean these flows actually ran.

Acceptance criteria

• Provision deterministic seeded Baseball coach and player test accounts for CI.
• CI fails loudly if required Baseball seeded auth is missing.
• Authenticated smoke covers: Command Center, Player Today, Calendar, Roster, Stats Center/My Stats, Performance/Lift, Settings, and at least one denied capability route.
• Include one fresh-account/onboarding smoke or explicit separate issue for it.
• Document required env vars and seed reset process.

[coderabbitai]

🔗 Related PRs

#25 - fix(migration): make 037_baseball_missing_tables replay-safe [closed]
#94 - fix: Codex 2026-05-26 — RLS gaps, broken inserts, LLM gov, autosave [merged]
#222 - fix(coachhelm): critical+security cluster (C1/S1/C3) + CRM archive follow-ups [merged]
#241 - chore(golf): durable guards for stat correctness (SG scales + cross-surface consistency) [merged]
#290 - feat(golf): premium coverflow course picker (new-round) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[njrini99-code]

@coderabbitai plan

[coderabbitai]

Coding Plan

Summary

• Reuse the existing idempotent seed-baseball-demo.ts accounts as the deterministic CI fixtures, exposed via a new seed:baseball:ci npm script that runs in CI before tests.
• Mirror the Golf auth.setup.ts pattern to persist coach/player storageState, but fail loudly (throw) in CI when seeded auth is missing, and wire it via a Playwright setup project plus role-scoped projects.
• Add a new non-skippable baseball-smoke.spec.ts covering Command Center, Player Today, Calendar, Roster, Stats Center/My Stats, Performance/Lift, Settings, and a player→coach denied-capability redirect, plus a lightweight onboarding render smoke (with full onboarding deferred to a tracked issue).
• Wire baseball secrets, seeding, and a blocking smoke run into playwright.yml, and document the env vars and seed reset process.

Design Choices

Design Choice 1: How should the smoke suite obtain authenticated sessions?

Options Considered:

1. Add a Playwright setup project that logs in each role once and persists storageState, then run role-scoped smoke projects that consume that state (mirrors playwright/auth.setup.ts).
2. Log in inside each smoke test via the existing e2e/helpers/auth.ts helpers.

Chosen Option: 1

Rationale: Option 1 — reuses the established Golf auth-setup pattern, is faster/more reliable in CI, and gives a single clear failure point ("fail loudly") when seeded auth is missing.

Design Choice 2: Should the mandatory smoke tests extend `baseball-phase1.spec.ts` or be a new spec?

Options Considered:

1. Add a new dedicated baseball-smoke.spec.ts that never self-skips.
2. Remove the skip guards from baseball-phase1.spec.ts.

Chosen Option: 1

Rationale: Option 1 — keeps the existing skippable exploratory tests intact while introducing a clearly-scoped mandatory suite that is easy to wire as blocking in CI.

Design Choice 3: How to handle the fresh-account/onboarding requirement?

Options Considered:

1. Include a lightweight onboarding smoke that exercises the anonymous signup/onboarding route rendering and form presence only (no persistent user creation).
2. Defer full fresh-account onboarding to a separate tracked issue.

Chosen Option: 1

Rationale: Option 1 plus a filed follow-up — include the lightweight anonymous onboarding render smoke now, and document a separate issue for full account-creation onboarding (the ticket explicitly allows "or explicit separate issue for it").

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Deterministic seed provisioning for CI

Establish a repeatable, CI-invokable way to guarantee the baseball coach/player test accounts and fixtures exist before tests run, and define the canonical env vars that identify those accounts.

Task 1: Add a CI-facing baseball seed npm script

Expose the existing idempotent seed as a first-class command so CI and developers run it the same way.

• Add a seed:baseball:ci script to package.json that invokes scripts/seed-baseball-demo.ts with the --confirm flag via tsx.
• Ensure the command passes through the Supabase URL and service-role key from environment (no hardcoded keys), relying on the script's existing deterministic/idempotent upsert behavior.

Task 2: Harden the seed script for CI invocation

Guarantee the script fails loudly when prerequisites are missing rather than silently no-op'ing.

• Update scripts/seed-baseball-demo.ts to validate required env (Supabase URL + service-role key) at startup and exit non-zero with a clear message when absent.
• Confirm the seeded coach/player emails and shared password are surfaced as named constants and align with the env-var names defined in Phase 2 (single source of truth for credentials).

🤖 Prompt for AI agents

This phase establishes a repeatable, CI-invokable seed mechanism for baseball
test accounts and defines canonical env vars for those accounts.

**Task 1.1 — Add `seed:baseball:ci` npm script:**
- In `package.json`, add a new script entry: `"seed:baseball:ci": "tsx
scripts/seed-baseball-demo.ts --confirm"`
- The script must not hardcode any credentials; Supabase URL and service-role
key should be read from environment variables already expected by the seed
script.

**Task 1.2 — Harden `scripts/seed-baseball-demo.ts` for CI:**
- At the top of the script (before any async work), add startup validation that
checks for the required environment variables (Supabase URL and service-role
key).
- If any required env var is missing, log a clear, human-readable error message
(e.g., `"Missing required env var: SUPABASE_SERVICE_ROLE_KEY — cannot seed
baseball CI accounts"`) and call `process.exit(1)`.
- Ensure the seeded coach email (`demo-coach@baseballhelmdemo.com`), player
email (`demo-player@baseballhelmdemo.com`), and shared password are defined as
named constants at the top of the file.
- Verify these constant names align with the env-var names that will be
introduced in Phase 2 (`E2E_BASEBALL_COACH_EMAIL`, `E2E_BASEBALL_PLAYER_EMAIL`,
etc.) so there is a single source of truth for credentials.

Phase 2: Durable baseball auth + mandatory smoke suite

Introduce per-role authenticated sessions modeled on the Golf setup, wire them into Playwright as a setup dependency, and add a non-skippable smoke spec covering the required surfaces and a denied-capability route.

Task 1: Add a baseball auth setup that persists role storage state

Create reusable, durable login state for coach and player, failing loudly when seeded auth is unavailable in CI.

• Add a baseball auth setup (e.g., playwright/baseball-auth.setup.ts, mirroring playwright/auth.setup.ts) that logs in coach and player against /baseball/login and persists playwright/.auth/baseball-coach.json / playwright/.auth/baseball-player.json.
• Read credentials from new env vars: E2E_BASEBALL_COACH_EMAIL, E2E_BASEBALL_COACH_PASSWORD, E2E_BASEBALL_PLAYER_EMAIL, E2E_BASEBALL_PLAYER_PASSWORD.
• Diverge from Golf's graceful skip: when running in CI (or a PLAYWRIGHT_BASEBALL_REQUIRED flag is set) and credentials/login fail, throw so the suite fails loudly; locally without creds it may skip.

Task 2: Wire a setup project and role-scoped projects into Playwright config

Make authenticated baseball tests consume persisted storage state through the standard Playwright dependency mechanism.

• Update root playwright.config.ts to add a setup project matching the baseball auth setup file, and add baseball coach/player projects that declare dependencies: ['setup'] and set storageState to the role JSON files.
• Keep the existing chromium project for anonymous/unauthenticated specs unaffected.

Task 3: Add the mandatory authenticated smoke spec

Cover the core daily surfaces and a denied-capability route in a spec that never self-skips.

• Create e2e/baseball-smoke.spec.ts split into coach-context and player-context groups consuming the respective storage states.
• Coach coverage: Command Center (/baseball/dashboard/command-center), Calendar, Roster, Stats Center, Performance/Lift staff surface, Settings — asserting each renders (no redirect to /login, key heading/landmark present).
• Player coverage: Player Today (/baseball/player/today), Calendar (read-only), Roster, My Stats (/baseball/dashboard/my-stats), player Lift surface, Settings.
• Denied-capability assertion: as the player, navigate to a coach-only route (e.g., /baseball/dashboard/command-center or /baseball/dashboard/stats-center) and assert the server redirect lands on the player surface (/baseball/player/today or /baseball/dashboard/my-stats).
• Reuse helpers from e2e/helpers/common.ts for load/visibility waits; do not reintroduce PLAYWRIGHT_BASEBALL_SEEDED skip guards.

Task 4: Add a lightweight onboarding render smoke

Satisfy the onboarding criterion without nondeterministic account creation.

• Add an anonymous smoke (in baseball-smoke.spec.ts or a small companion spec) that loads /baseball/signup and a (onboarding) route, asserting the page renders core form/landmarks.
• Document that full fresh-account onboarding (persistent user creation + teardown) is tracked as a separate follow-up issue.

🤖 Prompt for AI agents

This phase introduces per-role durable auth sessions mirroring the Golf pattern,
wires them into Playwright config, and creates the non-skippable mandatory smoke
spec.

**Task 2.1 — Create `playwright/baseball-auth.setup.ts`:**
- Mirror the structure of `playwright/auth.setup.ts`.
- Read credentials from env vars: `E2E_BASEBALL_COACH_EMAIL`,
`E2E_BASEBALL_COACH_PASSWORD`, `E2E_BASEBALL_PLAYER_EMAIL`,
`E2E_BASEBALL_PLAYER_PASSWORD`.
- For each role (coach, then player), navigate to `/baseball/login`, fill in
credentials, submit, and wait for successful authentication.
- Persist storage state to `playwright/.auth/baseball-coach.json` and
`playwright/.auth/baseball-player.json` respectively.
- **Failure behavior:** If `CI` env var is set or `PLAYWRIGHT_BASEBALL_REQUIRED`
flag is truthy and credentials are missing or login fails, throw an error with a
clear message (e.g., `"Baseball seeded auth missing — set E2E_BASEBALL_* env
vars and run seed:baseball:ci"`). Locally without creds, the setup may skip
gracefully.

**Task 2.2 — Update `playwright.config.ts`:**
- Add a `setup` project pointing to `playwright/baseball-auth.setup.ts`.
- Add a `baseball-coach` project with `dependencies: ['setup']` and
`storageState: 'playwright/.auth/baseball-coach.json'`.
- Add a `baseball-player` project with `dependencies: ['setup']` and
`storageState: 'playwright/.auth/baseball-player.json'`.
- Leave the existing `chromium` project untouched for anonymous/unauthenticated
specs.

**Task 2.3 — Create `e2e/baseball-smoke.spec.ts`:**
- Do NOT include any `PLAYWRIGHT_BASEBALL_SEEDED` skip guards.
- Organize tests into coach-context and player-context `describe` blocks.
- **Coach tests** (assert page renders without redirecting to `/login`, key
heading/landmark present):
  - `/baseball/dashboard/command-center`
  - Calendar route
  - Roster route
  - Stats Center route
  - Performance/Lift staff surface
  - Settings route
- **Player tests** (assert page renders correctly):
  - `/baseball/player/today`
  - Calendar (read-only)
  - Roster
  - `/baseball/dashboard/my-stats`
  - Player Lift surface
  - Settings
- **Denied-capability test** (player context): navigate to
`/baseball/dashboard/command-center` (or `/baseball/dashboard/stats-center`) and
assert the final URL matches the expected player redirect
(`/baseball/player/today` or `/baseball/dashboard/my-stats`).
- Use helpers from `e2e/helpers/common.ts` for load/visibility waits.

**Task 2.4 — Add lightweight onboarding render smoke:**
- Add an anonymous test (no storage state, can live in `baseball-smoke.spec.ts`
or a companion spec) that navigates to `/baseball/signup` and any `(onboarding)`
route.
- Assert that core form elements/landmarks are present on the page.
- Add a code comment documenting that full onboarding (persistent account
creation + teardown) is tracked as a separate follow-up issue.

Phase 3: CI wiring and documentation

Make the smoke suite a blocking, credential-driven part of CI and document the operational details.

Task 1: Inject baseball secrets and run the seed before tests in CI

Ensure CI provisions accounts and has credentials available, failing loudly if missing.

• Update .github/workflows/playwright.yml to inject E2E_BASEBALL_COACH_EMAIL/PASSWORD, E2E_BASEBALL_PLAYER_EMAIL/PASSWORD, and the Supabase service-role key (from GitHub Secrets).
• Add a step before the Playwright run that executes npm run seed:baseball:ci.
• Add a guard step (or rely on the auth-setup throw) so the job fails when baseball credentials/secrets are absent, surfacing a clear "Baseball seeded auth missing" error.

Task 2: Make the baseball smoke run blocking

Green CI must mean these flows actually executed.

• Update .github/workflows/playwright.yml so the baseball smoke run (or a dedicated invocation targeting the baseball projects/spec) is not wrapped in the || echo soft-fail shim and fails the job on test failure.
• Keep the broader exploratory suite's existing soft-fail behavior intact if it must remain non-blocking for now; isolate the mandatory smoke into its own blocking command.

Task 3: Document env vars and seed reset process

Provide operational guidance for maintainers.

• Document in the e2e/testing docs (e.g., e2e/README or the existing testing doc) the new E2E_BASEBALL_* env vars, the seeded account identities/password, and how to add them as GitHub Secrets.
• Document the seed reset/re-run process (npm run seed:baseball:ci), its idempotency, and the storage-state files produced under playwright/.auth/.
• Reference the separate onboarding follow-up issue.

🤖 Prompt for AI agents

This phase wires baseball secrets, seeding, and a blocking smoke run into the CI
workflow, and adds operational documentation.

**Task 3.1 — Update `.github/workflows/playwright.yml` (secrets + seed step):**
- In the `env:` block (or per-step `env:`), inject the following from GitHub
Secrets: `E2E_BASEBALL_COACH_EMAIL`, `E2E_BASEBALL_COACH_PASSWORD`,
`E2E_BASEBALL_PLAYER_EMAIL`, `E2E_BASEBALL_PLAYER_PASSWORD`, and the Supabase
service-role key.
- Add a workflow step **before** the Playwright test run step that executes `npm
run seed:baseball:ci`.
- Add a guard step (or rely on the auth-setup throw in `baseball-auth.setup.ts`)
to fail the job with a clear `"Baseball seeded auth missing"` message if the
secrets are absent.

**Task 3.2 — Make baseball smoke blocking in
`.github/workflows/playwright.yml`:**
- Add a dedicated Playwright invocation step that targets only the baseball
projects or `baseball-smoke.spec.ts` — this step must NOT use the `|| echo`
soft-fail shim that currently wraps the broader E2E run.
- Ensure the broader/exploratory suite's existing soft-fail behavior remains
unchanged.
- The baseball smoke step should fail the CI job on any test failure.

**Task 3.3 — Add documentation:**
- In `e2e/README` (or the existing testing doc), add a section covering:
- All new `E2E_BASEBALL_*` env vars, their purpose, and how to register them as
GitHub Secrets.
- The seeded account identities (`demo-coach@baseballhelmdemo.com`,
`demo-player@baseballhelmdemo.com`) and shared password.
- How to run `npm run seed:baseball:ci` locally, its idempotency guarantees, and
the storage-state files it produces under `playwright/.auth/`.
- A reference/link to the separate follow-up issue tracking full fresh-account
onboarding.

Research

BaseballHelm routes live under src/app/baseball/ with role/capability-gated server redirects (e.g., command-center is coach-only and bounces players to /baseball/player/today; stats-center bounces players to /baseball/dashboard/my-stats). E2E tests live in e2e/, with baseball-phase1.spec.ts self-skipping authenticated tests unless PLAYWRIGHT_BASEBALL_SEEDED is set. Golf already has a durable auth pattern in playwright/auth.setup.ts that logs in per-role and persists storageState JSON files, but the root playwright.config.ts has no setup project wired in and only runs the chromium project. CI runs E2E via .github/workflows/playwright.yml, which currently soft-fails and injects only Golf credentials. A comprehensive, idempotent baseball seed already exists (scripts/seed-baseball-demo.ts) creating deterministic coach (demo-coach@baseballhelmdemo.com) and player (demo-player@baseballhelmdemo.com) accounts, but it is run manually (no npm script, never invoked in CI).

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

This phase establishes a repeatable, CI-invokable seed mechanism for baseball
test accounts and defines canonical env vars for those accounts.

**Task 1.1 — Add `seed:baseball:ci` npm script:**
- In `package.json`, add a new script entry: `"seed:baseball:ci": "tsx
scripts/seed-baseball-demo.ts --confirm"`
- The script must not hardcode any credentials; Supabase URL and service-role
key should be read from environment variables already expected by the seed
script.

**Task 1.2 — Harden `scripts/seed-baseball-demo.ts` for CI:**
- At the top of the script (before any async work), add startup validation that
checks for the required environment variables (Supabase URL and service-role
key).
- If any required env var is missing, log a clear, human-readable error message
(e.g., `"Missing required env var: SUPABASE_SERVICE_ROLE_KEY — cannot seed
baseball CI accounts"`) and call `process.exit(1)`.
- Ensure the seeded coach email (`demo-coach@baseballhelmdemo.com`), player
email (`demo-player@baseballhelmdemo.com`), and shared password are defined as
named constants at the top of the file.
- Verify these constant names align with the env-var names that will be
introduced in Phase 2 (`E2E_BASEBALL_COACH_EMAIL`, `E2E_BASEBALL_PLAYER_EMAIL`,
etc.) so there is a single source of truth for credentials.
===============================================================================

Task: 2

This phase introduces per-role durable auth sessions mirroring the Golf pattern,
wires them into Playwright config, and creates the non-skippable mandatory smoke
spec.

**Task 2.1 — Create `playwright/baseball-auth.setup.ts`:**
- Mirror the structure of `playwright/auth.setup.ts`.
- Read credentials from env vars: `E2E_BASEBALL_COACH_EMAIL`,
`E2E_BASEBALL_COACH_PASSWORD`, `E2E_BASEBALL_PLAYER_EMAIL`,
`E2E_BASEBALL_PLAYER_PASSWORD`.
- For each role (coach, then player), navigate to `/baseball/login`, fill in
credentials, submit, and wait for successful authentication.
- Persist storage state to `playwright/.auth/baseball-coach.json` and
`playwright/.auth/baseball-player.json` respectively.
- **Failure behavior:** If `CI` env var is set or `PLAYWRIGHT_BASEBALL_REQUIRED`
flag is truthy and credentials are missing or login fails, throw an error with a
clear message (e.g., `"Baseball seeded auth missing — set E2E_BASEBALL_* env
vars and run seed:baseball:ci"`). Locally without creds, the setup may skip
gracefully.

**Task 2.2 — Update `playwright.config.ts`:**
- Add a `setup` project pointing to `playwright/baseball-auth.setup.ts`.
- Add a `baseball-coach` project with `dependencies: ['setup']` and
`storageState: 'playwright/.auth/baseball-coach.json'`.
- Add a `baseball-player` project with `dependencies: ['setup']` and
`storageState: 'playwright/.auth/baseball-player.json'`.
- Leave the existing `chromium` project untouched for anonymous/unauthenticated
specs.

**Task 2.3 — Create `e2e/baseball-smoke.spec.ts`:**
- Do NOT include any `PLAYWRIGHT_BASEBALL_SEEDED` skip guards.
- Organize tests into coach-context and player-context `describe` blocks.
- **Coach tests** (assert page renders without redirecting to `/login`, key
heading/landmark present):
  - `/baseball/dashboard/command-center`
  - Calendar route
  - Roster route
  - Stats Center route
  - Performance/Lift staff surface
  - Settings route
- **Player tests** (assert page renders correctly):
  - `/baseball/player/today`
  - Calendar (read-only)
  - Roster
  - `/baseball/dashboard/my-stats`
  - Player Lift surface
  - Settings
- **Denied-capability test** (player context): navigate to
`/baseball/dashboard/command-center` (or `/baseball/dashboard/stats-center`) and
assert the final URL matches the expected player redirect
(`/baseball/player/today` or `/baseball/dashboard/my-stats`).
- Use helpers from `e2e/helpers/common.ts` for load/visibility waits.

**Task 2.4 — Add lightweight onboarding render smoke:**
- Add an anonymous test (no storage state, can live in `baseball-smoke.spec.ts`
or a companion spec) that navigates to `/baseball/signup` and any `(onboarding)`
route.
- Assert that core form elements/landmarks are present on the page.
- Add a code comment documenting that full onboarding (persistent account
creation + teardown) is tracked as a separate follow-up issue.
===============================================================================

Task: 3

This phase wires baseball secrets, seeding, and a blocking smoke run into the CI
workflow, and adds operational documentation.

**Task 3.1 — Update `.github/workflows/playwright.yml` (secrets + seed step):**
- In the `env:` block (or per-step `env:`), inject the following from GitHub
Secrets: `E2E_BASEBALL_COACH_EMAIL`, `E2E_BASEBALL_COACH_PASSWORD`,
`E2E_BASEBALL_PLAYER_EMAIL`, `E2E_BASEBALL_PLAYER_PASSWORD`, and the Supabase
service-role key.
- Add a workflow step **before** the Playwright test run step that executes `npm
run seed:baseball:ci`.
- Add a guard step (or rely on the auth-setup throw in `baseball-auth.setup.ts`)
to fail the job with a clear `"Baseball seeded auth missing"` message if the
secrets are absent.

**Task 3.2 — Make baseball smoke blocking in
`.github/workflows/playwright.yml`:**
- Add a dedicated Playwright invocation step that targets only the baseball
projects or `baseball-smoke.spec.ts` — this step must NOT use the `|| echo`
soft-fail shim that currently wraps the broader E2E run.
- Ensure the broader/exploratory suite's existing soft-fail behavior remains
unchanged.
- The baseball smoke step should fail the CI job on any test failure.

**Task 3.3 — Add documentation:**
- In `e2e/README` (or the existing testing doc), add a section covering:
- All new `E2E_BASEBALL_*` env vars, their purpose, and how to register them as
GitHub Secrets.
- The seeded account identities (`demo-coach@baseballhelmdemo.com`,
`demo-player@baseballhelmdemo.com`) and shared password.
- How to run `npm run seed:baseball:ci` locally, its idempotency guarantees, and
the storage-state files it produces under `playwright/.auth/`.
- A reference/link to the separate follow-up issue tracking full fresh-account
onboarding.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!