Upgrade anon accounts - #115
Merged
Merged
Conversation
Guests can turn their profile into a real account from the signup form (reachable from the settings sheet), keeping uuid, name and game history. anonLink now reads the ory session from the ory_kratos_session cookie instead of a request body, and clears the anon_token cookie on success so AuthMiddleware stops preferring it. The .http files follow the same switch from X-Session-Token to cookie auth.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene Coverage  |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Kotlin |  |
Jul 30, 2026 6:05p.m. | Review ↗ |
| Code coverage | |
Jul 30, 2026 6:05p.m. | Review ↗ |
Code Coverage Summary
| Language | Line Coverage (New Code) | Line Coverage (Overall) |
|---|---|---|
| Aggregate | 0% |
69.9% [▲ up 0.3% from master] |
| Kotlin | 0% |
69.9% [▲ up 0.3% from master] |
➟ Additional coverage metrics may have been reported. See full coverage report ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
- Restrict guest names to ascii so they stay valid for the ory identity schema, and let the upgrade form edit the prefilled name - Keep the ory session cookie out of the logs, CanNotLinkAnonAccount now only carries the player uuid and answers 400 instead of 500 - Answer 409 when the ory identity already belongs to another player and tell the user to log in instead - Require the expected origin on anon/link, both credentials are cookies - Reset isAnon on logout
- Drop the origin check on /auth/anon/link, this gets solved globally later - Allow german and french accents in usernames, in our validator and the kratos identity schema (both have to agree or an anon name blocks the upgrade) - Rename guest to anon everywhere except in text exposed to the user
Removes the check itself plus everything that only existed for it: the OryAccountAlreadyLinked error, its 409 mapping and the client side handling. CanNotLinkAnonAccount loses its special 400 and falls through to the generic 500, so a failed link shows up in the error log.
sidneywidmer
force-pushed
the
feature/account-upgrade
branch
from
July 30, 2026 18:05
a96fcde to
d1c2f62
Compare
sidneywidmer
added a commit
that referenced
this pull request
Jul 30, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
If we're logged in with an Anon/Guest account we now have the simple option to upgrade to a "real" account.
This addition was necessary to play the "Tagestrump" in a later feature (#117) where we don't want Anon accoutns.