H

app/api/onevone.py

@@ -123,8 +123,10 @@ async def _sb_select(table: str, query: str) -> list[dict]:
 
 async def _sb_insert(table: str, row: dict) -> dict:
     url = f"{SUPABASE_URL}/rest/v1/{table}"
+    print(f"[onevone] _sb_insert: table={table}, row={json.dumps(row, default=str)}")
     async with httpx.AsyncClient(timeout=20) as client:
         r = await client.post(url, json=row, headers=_sb_headers(content_type=True, prefer="return=representation"))
+        print(f"[onevone] _sb_insert: status={r.status_code}, body={r.text[:500]}")
         if r.status_code not in (200, 201):
             raise HTTPException(status_code=502, detail=f"Supabase insert error ({table}): {r.text[:200]}")
         rows = r.json()
@@ -342,16 +344,15 @@ class SubmitRequest(BaseModel):
 
 @router.post("/rooms")
 async def create_room(req: CreateRoomRequest, user: dict = Depends(get_current_user)):
-    # IDOR FIX: Use authenticated user's ID
     user_id = user["user_id"]
+    print(f"[onevone] create_room: user_id={user_id}, teamRole={req.teamRole}, mainDurationS={req.mainDurationS}")
     if req.teamRole not in ("red", "blue"):
         raise HTTPException(status_code=400, detail="teamRole يجب أن يكون red أو blue")
     if req.mainDurationS not in MAIN_DURATION_OPTIONS:
-        raise HTTPException(status_code=400, detail="mainDurationS غير صالح")
+        raise HTTPException(status_code=400, detail=f"mainDurationS {req.mainDurationS} غير صالح، الخيارات: {MAIN_DURATION_OPTIONS}")
     if not req.displayName:
         raise HTTPException(status_code=400, detail="بيانات المستخدم ناقصة")
 
-    # generate a unique 6-char code (retry on collision)
     code = _gen_room_code()
     for _ in range(8):
         existing = await _sb_select("onevone_rooms", f"code=eq.{code}&select=id&limit=1")
@@ -359,6 +360,7 @@ async def create_room(req: CreateRoomRequest, user: dict = Depends(get_current_u
             break
         code = _gen_room_code()
 
+    print(f"[onevone] create_room: inserting room with code={code}")
     room = await _sb_insert("onevone_rooms", {
         "code": code,
         "owner_user_id": user_id,
@@ -367,7 +369,7 @@ async def create_room(req: CreateRoomRequest, user: dict = Depends(get_current_u
         "challenge_source": req.challengeSource,
         "main_duration_s": req.mainDurationS,
     })
-    # add the owner as slot 1
+    print(f"[onevone] create_room: room inserted id={room.get('id')}, inserting player slot=1")
     await _sb_insert("onevone_players", {
         "room_id": room["id"],
         "user_id": user_id,
@@ -375,6 +377,7 @@ async def create_room(req: CreateRoomRequest, user: dict = Depends(get_current_u
         "display_name": req.displayName,
         "is_ready": True,
     })
+    print(f"[onevone] create_room: done, returning code={code}")
     return {"room": room, "code": code}
 
 

app/core/auth.py

@@ -87,6 +87,7 @@ async def get_current_user(request: Request) -> dict:
                 import json
                 body = json.loads(body_bytes)
                 user_id = body.get("user_id", "") or body.get("userId", "")
+                print(f"[auth] POST body keys: {list(body.keys())}, found user_id={user_id!r}")
                 if user_id:
                     log.info("[auth] Body authenticated, user_id=%s", user_id)
                     return {"user_id": user_id, "email": "", "role": "authenticated"}