Cfb Expansion + App Testing

[RickArko]

No description provided.

[Copilot]

Pull request overview

This PR updates the league import and web app auth experience, with supporting test updates and expanded deployment/config documentation. In particular, Sleeper imports now load the Sleeper player DB (with caching) so imported rosters resolve to player name/position/team immediately.

Changes:

• Add disk-backed caching for the Sleeper /players/nfl map and use it during Sleeper league import to enrich rosters.
• Update League Manager web app auth flow to support password-based signup/sign-in, password reset, and “set password” for existing users.
• Refresh tests and documentation for new IDs/config workflows and Fly/Supabase deployment guidance.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/test_sleeper_import.py	Adds coverage ensuring Sleeper import loads the player DB and resolves roster fields.
tests/test_league_api.py	Updates test data to validate Sleeper league_id is returned as a string.
src/ffpy/web/league_app/app.js	Adds password-based auth UI/actions (signup/signin/reset/set password) and improves request error messages.
src/ffpy/league_api.py	Loads Sleeper player map during import; normalizes Sleeper league_id to string; wraps import errors with logging.
src/ffpy/draft_strategy.py	Adds disk cache for Sleeper player map (TTL-based) in addition to in-memory caching.
src/ffpy/database.py	Enables SQLite foreign keys and changes league deletion logic.
scripts/bootstrap.sh	Updates bootstrap output instructions and adds Supabase/Fly pointers.
README.md	Documents required .env keys by workflow and secret handling locations.
QUICKSTART.md	Adds explicit setup steps for web auth + Supabase verification + Fly secrets.
fly.toml	Sets VM sizing (512MB, shared CPU) for Fly deployment.
docs/deployment/fly.md	Reworks Fly deployment docs into a clearer “happy path” with required env vars and CI token placement.
.env.example	Reorganizes and clarifies required keys by workflow; adds Supabase/Fly guidance.

Comments suppressed due to low confidence (2)

src/ffpy/database.py:3785

• delete_user_league() deletes from league_matchups/league_teams before deleting from user_leagues. If the provided user_id does not match (or the league row doesn't exist), this will still wipe the league's teams/matchups even though the user_leagues row is not removed. Delete from the parent table first (scoped by user_id) and rely on ON DELETE CASCADE now that foreign_keys is enabled.

    def delete_user_league(self, league_id: str, user_id: str) -> None:
        """Delete a league and its teams/matchups."""
        self.conn.execute("DELETE FROM league_matchups WHERE league_id = ?", (league_id,))
        self.conn.execute("DELETE FROM league_teams WHERE league_id = ?", (league_id,))
        self.conn.execute(
            "DELETE FROM user_leagues WHERE league_id = ? AND user_id = ?",
            (league_id, user_id),
        )

src/ffpy/web/league_app/app.js:610

• signIn() validates trimmed password but sends untrimmed email/password to Supabase. Leading/trailing whitespace (common when copy/pasting) will cause auth failures. Trim both before calling signInWithPassword.

        this._ensureSupabase();
        if (!(this.authForm.password || "").trim()) {
          throw new Error("Enter your password.");
        }
        const { data, error } = await this.supabaseClient.auth.signInWithPassword({
          email: this.authForm.email,
          password: this.authForm.password,
        });

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.