# Discord OAuth Connection Verification & Testing

## Current Status ✅

**Bot Token**: Updated with new token (as of latest deployment)
**Environment Variables**: All configured
**Endpoints**: Live and responding

## What Should Work

### ✅ 1. Login with Discord (New Scenario)

**Scenario**: User clicks "Continue with Discord" on `/login` with Discord email matching existing account

**Steps**:

1. Go to `https://aethex.dev/login`
2. Click **"Continue with Discord"** button
3. Authorize on Discord
4. Should show success and redirect to `/dashboard`

**Expected Result**: User logged in with Discord account linked

---

### ✅ 2. Login with Discord (Email Mismatch)

**Scenario**: Discord email doesn't match any existing AeThex account

**Steps**:

1. Go to `https://aethex.dev/login`
2. Click **"Continue with Discord"** button
3. Authorize with Discord account that has different email
4. Should show error: "Discord email not found"
5. Click back to login and sign in with your email instead

**Expected Result**: User shown helpful error message, redirected to login

---

### ✅ 3. Link Discord from Dashboard

**Scenario**: User already logged in, wants to link Discord

**Steps**:

1. Sign in with email/password on `/login`
2. Go to `/dashboard?tab=connections`
3. Find Discord card
4. Click **"Link Discord"** button
5. Authorize Discord
6. Should see Discord as "Linked" in connections

**Expected Result**: Discord account linked to existing user

---

### ✅ 4. Discord Bot Commands

**Scenario**: User types Discord commands in a server where bot is present

**Commands to Test**:

```
/verify              - Bot sends verification code
/set-realm gameforge - Bot confirms realm change + assigns role
/profile             - Bot shows user profile card
/verify-role         - Bot shows assigned roles
/unlink              - Bot unlinks Discord account
```

**Expected Result**: All commands respond without errors

---

## OAuth Flow Diagram

```
┌─────────────────────────────────────────────────────────┐
│             Discord OAuth Login Flow                    │
└─────────────────────────────────────────────────────────┘

1. User clicks "Continue with Discord"
   ↓
2. Frontend redirects to:
   /api/discord/oauth/start
   ↓
3. Backend redirects to:
   https://discord.com/api/oauth2/authorize?
     client_id=578971245454950421
     &redirect_uri=https://aethex.dev/api/discord/oauth/callback
     &response_type=code
     &scope=identify%20email
     &state=...
   ↓
4. User authorizes on Discord
   ↓
5. Discord redirects to:
   /api/discord/oauth/callback?code=XXX&state=...
   ↓
6. Backend:
   a) Exchanges code for Discord access token
   b) Fetches Discord user profile (email, username, avatar)
   c) Checks if Discord email matches existing account
   d) If YES → Links to existing user
   d) If NO → Shows error "Discord email not found"
   e) Creates session cookies
   f) Redirects to /dashboard
   ↓
7. ✅ User logged in with Discord linked
```

---

## Environment Variables (Current)

```
DISCORD_CLIENT_ID=578971245454950421
DISCORD_CLIENT_SECRET=<from Discord Developer Portal>
DISCORD_BOT_TOKEN=<new token with GmEHDt prefix>
DISCORD_PUBLIC_KEY=d9771dd29e3a6f030cb313e33bb4b51384c7c36829bd551df714681dcf1e1eb0
```

---

## Discord Developer Portal Checklist

Make sure these are configured in Discord Developer Portal:

- [ ] **General Information**:

  - [ ] Application name: "AeThex"
  - [ ] Client ID: `578971245454950421`
  - [ ] Public Key: `d9771dd29e3a6f030cb313e33bb4b51384c7c36829bd551df714681dcf1e1eb0`

- [ ] **OAuth2 > General**:

  - [ ] Client Secret configured
  - [ ] Redirect URIs includes: `https://aethex.dev/api/discord/oauth/callback`

- [ ] **Bot**:

  - [ ] Bot token set (new GmEHDt token)
  - [ ] Intents enabled: `Message Content`, `Guilds`
  - [ ] Permissions: `Administrator` or specific permissions

- [ ] **Interactions Endpoint URL**:
  - [ ] URL: `https://aethex.dev/api/discord/interactions`
  - [ ] ✅ Verified by Discord

---

## Testing Checklist

### Basic Connectivity

- [ ] API endpoint responds: `curl https://aethex.dev/api/discord/oauth/start -I`
- [ ] Discord bot online (shows in server member list)
- [ ] Discord bot can execute commands (`/verify` works)

### OAuth Login Tests

- [ ] **Test 1**: Login with Discord email matching existing account

  - [ ] Click "Continue with Discord"
  - [ ] Authorize
  - [ ] Redirects to dashboard ✅

- [ ] **Test 2**: Login with Discord email NOT in system
  - [ ] Click "Continue with Discord"
  - [ ] Authorize
  - [ ] Shows error message ✅
  - [ ] Can sign in with email instead ✅

### OAuth Linking Tests

- [ ] **Test 3**: Link Discord from Dashboard

  - [ ] Sign in with email
  - [ ] Go to Dashboard → Connections
  - [ ] Click "Link Discord"
  - [ ] Authorize
  - [ ] Discord appears as linked ✅

- [ ] **Test 4**: Unlink and re-link Discord
  - [ ] From connections tab, click "Unlink Discord"
  - [ ] Confirm unlink
  - [ ] Click "Link Discord" again
  - [ ] Authorize
  - [ ] Successfully re-linked ✅

### Bot Command Tests

- [ ] **Test 5**: `/verify` command generates code

  - [ ] Type `/verify` in Discord
  - [ ] Bot sends code with link
  - [ ] Link works: `https://aethex.dev/discord-verify?code=...` ✅

- [ ] **Test 6**: `/set-realm` command works

  - [ ] Type `/set-realm`
  - [ ] Select an arm (gameforge, labs, etc)
  - [ ] Bot confirms change ✅
  - [ ] Logs show role assignment ✅

- [ ] **Test 7**: `/profile` command shows user
  - [ ] Type `/profile`
  - [ ] Bot shows user profile card ✅

---

## Troubleshooting

### "Redirect URI mismatch" error

- Problem: Discord OAuth callback failing
- Solution: Verify `https://aethex.dev/api/discord/oauth/callback` is registered in Discord Developer Portal

### "Invalid token" error

- Problem: Bot token expired or revoked
- Solution: Get new token from Discord Developer Portal

### Bot commands not working

- Problem: Commands not registered with Discord
- Solution: Run `/api/discord/admin-register-commands` endpoint with DISCORD_ADMIN_REGISTER_TOKEN

### Session lost during linking

- Problem: User logged out after Discord OAuth redirect
- Solution: This should NOT happen anymore - we use database sessions instead of cookies

---

## Success Indicators ✅

All flows working when you see:

1. ✅ Discord button visible on login page
2. ✅ Can authorize on Discord and return to aethex.dev
3. ✅ Discord appears in Dashboard connections
4. ✅ Bot commands work in Discord
5. ✅ No session loss during OAuth redirects
6. ✅ Helpful error messages when things go wrong