Merge PRs #14, #15, #16: auth fix, async CPU moves, lobby a11y

CricketGame/backend/api/auth.py

@@ -1,9 +1,11 @@
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Header, status
 from sqlalchemy.orm import Session
 from pydantic import BaseModel
+import secrets
 import json
 
 from ..data.database import get_db
+from ..core.config import ADMIN_SECRET
 from ..core.auth import register_player, login_player, get_player_stats, decode_token, create_token
 from ..data.models import Player, MatchHistory, TournamentHistory, FormatStats
 
@@ -62,7 +64,14 @@ def _merge_format_stats(keeper: FormatStats, src: FormatStats) -> None:
         keeper.best_bowling_runs    = src.best_bowling_runs
 
 @router.get("/migrate-formats")
-def migrate_formats(db: Session = Depends(get_db)):
+def migrate_formats(
+    x_admin_secret: str = Header(..., alias="X-Admin-Secret"),
+    db: Session = Depends(get_db),
+):
+    if not secrets.compare_digest(x_admin_secret, ADMIN_SECRET):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN, detail="Invalid admin secret"
+        )
     stats_merged_2v2 = 0
     stats_deduped = 0
     legacy_rows = db.query(FormatStats).filter(FormatStats.format == "2v2").all()

CricketGame/backend/core/config.py

@@ -11,6 +11,12 @@
         raise ValueError("SECRET_KEY is required in production")
     SECRET_KEY = "cricket-dev-key-2026"
 
+ADMIN_SECRET = os.getenv("ADMIN_SECRET")
+if not ADMIN_SECRET:
+    if APP_ENV in ("production", "prod"):
+        raise ValueError("ADMIN_SECRET is required in production")
+    ADMIN_SECRET = "super-secret-admin-key"
+
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "1440"))
 

CricketGame/backend/realtime/cpu.py

@@ -124,14 +124,16 @@ async def maybe_cpu_move(manager, room, innings) -> None:
     # CPU batter: submit immediately if its slot is empty
     if striker_is_cpu and "bat" not in pending:
         await asyncio.sleep(0.25)
-        pending["bat"] = cpu_pick_move(manager, room, "bat", innings.striker)
+        # Run in thread to prevent blocking event loop with DB queries
+        pending["bat"] = await asyncio.to_thread(cpu_pick_move, manager, room, "bat", innings.striker)
         placed = True
 
     # CPU bowler: submit immediately if its slot is empty
     if bowler_is_cpu and "bowl" not in pending:
         if not placed:
             await asyncio.sleep(0.25)
-        pending["bowl"] = cpu_pick_move(manager, room, "bowl", innings.current_bowler)
+        # Run in thread to prevent blocking event loop with DB queries
+        pending["bowl"] = await asyncio.to_thread(cpu_pick_move, manager, room, "bowl", innings.current_bowler)
         placed = True
 
     # Broadcast state so the frontend immediately sees the CPU's ready indicator
@@ -238,9 +240,11 @@ async def auto_play_cpu_match(manager, room) -> None:
                 return
             pending = room.pending_moves
             if "bat" not in pending:
-                pending["bat"] = cpu_pick_move(manager, room, "bat", innings.striker)
+                # Run in thread to prevent blocking event loop with DB queries
+                pending["bat"] = await asyncio.to_thread(cpu_pick_move, manager, room, "bat", innings.striker)
             if "bowl" not in pending:
-                pending["bowl"] = cpu_pick_move(manager, room, "bowl", innings.current_bowler)
+                # Run in thread to prevent blocking event loop with DB queries
+                pending["bowl"] = await asyncio.to_thread(cpu_pick_move, manager, room, "bowl", innings.current_bowler)
             await asyncio.sleep(0.25)
             resolved = await manager._resolve_pending_ball(room, innings)
             if not resolved:

CricketGame/backend/test_auth.py

@@ -0,0 +1,29 @@
+from fastapi.testclient import TestClient
+from backend.main import app
+from backend.core.config import ADMIN_SECRET
+from backend.data.database import init_db
+
+# Initialize DB for tests
+init_db()
+
+client = TestClient(app)
+
+def test_migrate_formats_no_header():
+    # Expect 422 because the header is required (Header(...))
+    response = client.get("/auth/migrate-formats")
+    assert response.status_code == 422
+
+def test_migrate_formats_wrong_header():
+    # Expect 403 because the secret is invalid
+    response = client.get("/auth/migrate-formats", headers={"X-Admin-Secret": "wrong-secret"})
+    assert response.status_code == 403
+    assert response.json()["detail"] == "Invalid admin secret"
+
+def test_migrate_formats_correct_header():
+    # Expect 200 because the secret matches
+    response = client.get("/auth/migrate-formats", headers={"X-Admin-Secret": ADMIN_SECRET})
+    assert response.status_code == 200
+    data = response.json()
+    assert "format_stats_2v2_merged" in data
+    assert "duplicate_rows_removed" in data
+    assert "match_history_fixed" in data

CricketGame/backend/test_game_engine.py

@@ -94,7 +94,7 @@ def test_cpu_toss_timeout_fallback_triggers():
     room.captains["A"] = "CPU Bot"
     match = Match("M3", "team", ["CPU Bot"], ["Host"], total_overs=1, total_wickets=1)
 
-    def fixed_do_toss():
+    def fixed_do_toss(caller=None):
         match.toss_caller = "CPU Bot"
         return {"caller": "CPU Bot"}
 

CricketGame/frontend/src/components/Lobby.tsx

@@ -367,6 +367,7 @@ export default function Lobby({ lobby, username, sendMsg }: Props) {
                                         </button>
                                         <button
                                             onClick={() => sendMsg({ action: 'REMOVE_CPU' })}
+                                            aria-label="Remove the last added CPU player"
                                             disabled={cpuCount === 0}
                                             className="px-4 py-2 bg-white border border-slate-200 text-slate-400 text-xs font-bold uppercase tracking-wider rounded disabled:opacity-50 disabled:cursor-not-allowed"
                                         >
@@ -579,12 +580,16 @@ function DraggablePlayer({ player, sendMsg }: {
             </div>
             <div className="flex gap-1 flex-shrink-0 ml-2">
                 <button
+                    aria-label={`Assign ${player.username} to Team A`}
+                    title="Assign to Team A"
                     onClick={(e) => { e.stopPropagation(); sendMsg({ action: 'ASSIGN_TEAM', player: player.username, team: 'A' }) }}
-                    className="h-5 px-1.5 text-[9px] font-bold rounded bg-blue-50 hover:bg-blue-100 text-blue-600 border border-blue-200 transition-colors"
+                    className="h-5 px-1.5 text-[9px] font-bold rounded bg-blue-50 hover:bg-blue-100 text-blue-600 border border-blue-200 transition-colors focus-visible:ring-2 focus-visible:ring-blue-500 focus-visible:outline-none"
                 >A</button>
                 <button
+                    aria-label={`Assign ${player.username} to Team B`}
+                    title="Assign to Team B"
                     onClick={(e) => { e.stopPropagation(); sendMsg({ action: 'ASSIGN_TEAM', player: player.username, team: 'B' }) }}
-                    className="h-5 px-1.5 text-[9px] font-bold rounded bg-purple-50 hover:bg-purple-100 text-purple-600 border border-purple-200 transition-colors"
+                    className="h-5 px-1.5 text-[9px] font-bold rounded bg-purple-50 hover:bg-purple-100 text-purple-600 border border-purple-200 transition-colors focus-visible:ring-2 focus-visible:ring-purple-500 focus-visible:outline-none"
                 >B</button>
             </div>
         </div>
@@ -634,8 +639,10 @@ function TeamDropZone({ team, lobby, sendMsg, isHost }: {
                             </div>
                             {isHost && captain !== playerName && (
                                 <button
+                                    aria-label={`Make ${playerName} captain`}
+                                    title="Make Captain"
                                     onClick={() => sendMsg({ action: 'SET_CAPTAIN', team, captain: playerName })}
-                                    className={`h-5 px-1.5 text-[9px] font-bold rounded border transition-colors ${captainBtnColor}`}
+                                    className={`h-5 px-1.5 text-[9px] font-bold rounded border transition-colors ${captainBtnColor} focus-visible:ring-2 focus-visible:ring-yellow-500 focus-visible:outline-none`}
                                 >
                                     👑
                                 </button>