The app dropped email/password login entirely and switched to Google OAuth as the only sign-in method. On the backend, Passport.js was configured with the Google strategy — users are created or found in the database on first login, and a JWT is issued for the socket handshake. The frontend gained a GoogleCallback handler to translate the OAuth response into local session state, and the old email/password form was removed from AuthChoice.
A protected admin subscription upgrade endpoint (POST /api/admin/upgrade-subscription) was added, gated behind an x-admin-secret header. This let the team manually elevate accounts during early access without touching the database directly. The header was also added to the CORS allowed-headers list so the admin script could reach it from any origin.
SQLite database files (dev.db, world.db) were removed from git tracking and added to .gitignore — a hygiene fix that should have happened earlier.
Why it matters
Removing the password path cut a whole auth surface area and simplified the user experience to a single click. The admin endpoint gave the team a safe, scriptable way to manage early users without direct DB access.