mint-accounts.mjs

Mints throwaway grafted-wars accounts against a running deployment, one real signup-login-session cycle per account.

Operator tooling › mint-accounts.mjs

What it does

Takes a disposable address from tempmail.lol, registers it against a deployment's /api/auth/signup, then signs that account in and reads its session, banking the account only when all three steps complete. Refuses to run against grafted-wars.com or www.grafted-wars.com, so it can only mint against dev or staging. Writes each completed account, including its plaintext password, to a gitignored JSON store.

Usage

The minimal invocation, naming only the deployment to register against:

node tools/mint-accounts.mjs --base-url http://127.0.0.1:8787

Options

tools/mint-accounts.mjs itself defines no flags. It forwards its own process.argv whole to parseMintArgs() in tools/lib/mint-run.mjs, which is what reads --base-url, --count, --throttle-ms and --store — the flags used throughout Usage and Examples below. See Inputs and outputs for what each accepts and defaults to.

Inputs and outputs

parseMintArgs() reads, from process.argv:

• --base-url — the deployment to register accounts against. Refused if it resolves to grafted-wars.com or www.grafted-wars.com; the run refuses to start without it.
• --count — how many accounts to mint, one signup-login-session cycle each. Defaults to 1.
• --throttle-ms — how long to wait before each cycle after the first. Defaults to 3000.
• --store — where minted accounts are appended, as JSON. Defaults to .minted-accounts/accounts.json at the repository root.

Reads tempmail.lol's /v2/inbox/create and /v2/inbox endpoints (no API key) and the deployment's /api/auth/signup, /api/auth/login and /api/auth/session routes.

Writes the store file (--store, default .minted-accounts/accounts.json): one JSON object holding an accounts array. It writes to a .tmp file and renames that into place, so a crash mid-write cannot corrupt a store that already held accounts. Each record holds email, password, accountId, playerId, baseUrl, inboxToken and mintedAt — the password in the clear.

Exit code	Meaning
0	Every requested account minted
1	The run stopped before minting --count accounts — a network failure, a mismatched session, or any other step of a cycle throwing; whatever completed is already in the store
2	The arguments are invalid: --base-url missing, not a URL, or naming production; or a non-numeric --count/--throttle-ms

Examples

Mint one account against a local dev server:

node tools/mint-accounts.mjs --base-url http://127.0.0.1:8787

Mint ten accounts at once, for a test run that needs a larger pool:

node tools/mint-accounts.mjs --base-url http://127.0.0.1:8787 --count 10

Notes

Never runs against production: PRODUCTION_HOSTS in tools/lib/mint-run.mjs refuses grafted-wars.com and www.grafted-wars.com outright, whatever --base-url is given.

A cycle that fails partway — signup succeeds but login fails, for example — is not written to the store at all. Only a cycle that completes signup, login, and a session read naming the same account it registered is banked.

The store is gitignored and holds plaintext passwords; it belongs in no commit and on no ticket.

The browser test suite's drive pool (test/browser/drive/support/mint.mjs) wraps the same mintAccounts() function this script calls rather than reimplementing it, so the two never drift out of step.

Source

tools/mint-accounts.mjs — part of Operator tooling