Dev login guide (`/dev/login`)

Dev login guide (/dev/login)

To dogfood or test a workflow against a running web server without walking the
email/OTP flow each time, hit /dev/login — a single dev-only route that
upserts the user, applies any persona state, mints a real session cookie, and
redirects, all in one request. No seeding step, no JSON artifact, no manual
cookie injection. It mints via the same createSessionToken()/resolveSecret()
path handleVerifyOtp uses after a real OTP verify, so there is no bypass path
or test-only auth surface — it just skips the email round-trip, and only for
@brioso.test addresses.

GET /dev/login?persona=agency&redirect=/studio
GET /dev/login?persona=pro-new&redirect=/onboarding
GET /dev/login?email=whatever@brioso.test&redirect=/studio

persona is one of agency, creator, free-new, pro-new,
free-returning, pro-returning — see PERSONAS in
src/routes/dev/login.ts for the exact email/state each maps to. The four
*-new/*-returning personas apply the plan (free/Pro) x completion
(first-time/returning) 2x2 that /onboarding QA needs, including the
Pro-just-subscribed welcome screen (reachable by appending
?session_id=anything to the URL against pro-returning/free-returning —
no persona needed, session_id just flips which component renders).
email still works for any other @brioso.test address; redirect defaults
to /studio and must be a single-leading-slash relative path.

Works identically from a browser, curl, or a Playwright fixture — just
navigate/request the URL, no separate script invocation or cookie plumbing:

await page.goto("http://localhost:3000/dev/login?persona=agency&redirect=/studio/agencies");

curl -i "http://localhost:3000/dev/login?persona=creator" # Set-Cookie in the 302

Dev-only by construction: request-time 404 under NODE_ENV=production, plus
import.meta.env.DEV so the handler is stripped from the production bundle.

To reset every seeded *@brioso.test row (e.g. between scenario runs), use
scripts/dev-reset-users.ts (mise run db:reset-users). For a real
end-to-end login smoke test, still walk /login and read the OTP from the
server log (dev captures it when EMAIL_PROVIDER is unset); do not rely
solely on /dev/login.

For driving the app interactively against a live local stack, use the
qa-studio skill (checking one specific fix/state) or the dogfood skill
(an open-ended sweep across every journey) — both under .agents/skills/.