Add preliminary support for multiple card games

A game-type registry (server/src/tavolo/games.py) is now the single
source of truth for the games the platform can host; only scopone
scientifico is registered so far. GET /api/game-types exposes it for the
lobby's new game dropdown, and POST /api/games accepts a validated
game_type (default scopone_scientifico) which is carried on the live
GameState and onto each finished Match row (new indexed column,
migration 1_20260916235833_update), so statistics can be scoped per
game: /api/me/matches and /api/leaderboard take an optional game_type
filter and every serialized match includes its game_type.

Game states serialized before this change still load with the default
game type.

deploy/k8s/tavolo.yaml

@@ -45,17 +45,6 @@ metadata:
 data:
   # In-cluster Redis deployed by this file.
   REDIS_URL: redis://redis.tavolo.svc.cluster.local:6379/0
-  # Postgres (external, lives in another namespace): everything except the
-  # password, which is the only entry in the tavolo-secrets Secret.
-  # Use its Service DNS name, e.g. postgres.<namespace>.svc.cluster.local.
-  DATABASE_ENGINE: postgres
-  DATABASE_HOST: REPLACE_ME
-  DATABASE_PORT: "5432"
-  DATABASE_NAME: REPLACE_ME
-  DATABASE_USER: REPLACE_ME
-  # Extra DSN query parameters appended to the URL (e.g. ssl=require).
-  # Empty means none.
-  DATABASE_OPTIONS: ""
   # The image bakes STATIC_DIR=/app/web/dist; repeat it here for clarity.
   STATIC_DIR: /app/web/dist
   GAME_TTL_SECONDS: "86400"
@@ -83,9 +72,9 @@ metadata:
     app.kubernetes.io/part-of: tavolo
 type: Opaque
 stringData:
-  # The only Postgres secret: the password for DATABASE_USER at
+  # Postgres lives in another namespace; use its Service DNS name:
-  # DATABASE_HOST (both configured in the tavolo-config ConfigMap).
+  #   postgres://USER:PASS@postgres.<namespace>.svc.cluster.local:5432/<db>
-  DATABASE_PASSWORD: REPLACE_ME
+  DATABASE_URL: REPLACE_ME
   # Client secret for OIDC_CLIENT_ID at the provider.
   OIDC_CLIENT_SECRET: REPLACE_ME
 
@@ -210,9 +199,6 @@ spec:
           command: ["aerich", "upgrade"]
           workingDir: /app
           envFrom:
-            # Migrations need the non-secret DATABASE_* parts too.
-            - configMapRef:
-                name: tavolo-config
             - secretRef:
                 name: tavolo-secrets
           resources:

docker-compose.yml

@@ -4,8 +4,7 @@ services:
     environment:
       POSTGRES_DB: tavolo
       POSTGRES_USER: tavolo
-      # Override via the DATABASE_PASSWORD env var (shell or root .env).
+      POSTGRES_PASSWORD: tavolo
-      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
     ports:
       - "5432:5432"
     volumes:
@@ -72,12 +71,7 @@ services:
     working_dir: /app
     command: ["aerich", "upgrade"]
     environment:
-      DATABASE_ENGINE: postgres
+      DATABASE_URL: postgres://tavolo:tavolo@postgres:5432/tavolo
-      DATABASE_HOST: postgres
-      DATABASE_PORT: "5432"
-      DATABASE_NAME: tavolo
-      DATABASE_USER: tavolo
-      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
     depends_on:
       postgres:
         condition: service_healthy
@@ -96,12 +90,7 @@ services:
       redis:
         condition: service_healthy
     environment:
-      DATABASE_ENGINE: postgres
+      DATABASE_URL: postgres://tavolo:tavolo@postgres:5432/tavolo
-      DATABASE_HOST: postgres
-      DATABASE_PORT: "5432"
-      DATABASE_NAME: tavolo
-      DATABASE_USER: tavolo
-      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
       # By default the app and browsers reach the mock IdP under the same
       # name (see README /etc/hosts note); override OIDC_ISSUER and
       # OIDC_REDIRECT_URI to use a real provider or a different host port.

server/.env.example

@@ -1,17 +1,10 @@
-# Database (match statistics). The app assembles the DSN from these
+# Postgres
-# parts; DATABASE_PORT may be left unset to use the driver default
+POSTGRES_HOST=localhost
-# (5432 for Postgres). DATABASE_OPTIONS is a raw query string appended
+POSTGRES_PORT=5432
-# to the URL (e.g. ssl=require); leave empty for none.
+POSTGRES_DB=tavolo
-DATABASE_ENGINE=postgres
+POSTGRES_USER=tavolo
-DATABASE_HOST=localhost
+POSTGRES_PASSWORD=tavolo
-DATABASE_PORT=5432
+DATABASE_URL=postgres://tavolo:tavolo@localhost:5432/tavolo
-DATABASE_NAME=tavolo
-DATABASE_USER=tavolo
-DATABASE_PASSWORD=password
-DATABASE_OPTIONS=
-# Full-DSN override: when set, the parts above are ignored. Used by the
-# test suite (sqlite://:memory:) and handy for managed-DB URLs.
-#DATABASE_URL=postgres://tavolo:password@localhost:5432/tavolo
 
 # OIDC (mock-oauth2-server in dev; it does not validate clients, so any
 # client id/secret works. For a real IdP like Keycloak, use its values here.)

server/README.md

@@ -44,14 +44,7 @@ All configuration comes from environment variables (see `.env.example`):
 
 | Variable | Default | Description |
 |---|---|---|
-| `DATABASE_ENGINE` | `postgres` | Database DSN scheme/driver |
+| `DATABASE_URL` | `postgres://tavolo:tavolo@localhost:5432/tavolo` | Postgres DSN for match statistics |
-| `DATABASE_HOST` | `localhost` | Postgres host |
-| `DATABASE_PORT` | unset | Postgres port; omitted from the DSN when empty (driver default, 5432 for Postgres) |
-| `DATABASE_NAME` | `tavolo` | Postgres database name |
-| `DATABASE_USER` | `tavolo` | Postgres user |
-| `DATABASE_PASSWORD` | `password` | Postgres password |
-| `DATABASE_OPTIONS` | unset | Extra DSN query parameters, e.g. `ssl=require` |
-| `DATABASE_URL` | unset | Full-DSN override; when set, the `DATABASE_*` parts above are ignored (used for sqlite in tests and for managed-DB URLs) |
 | `REDIS_URL` | unset | Redis DSN for sessions + live games. Unset falls back to in-memory stores |
 | `OIDC_ISSUER` | `http://localhost:8180/tavolo` | OIDC issuer URL |
 | `OIDC_CLIENT_ID` | `tavolo` | OIDC client id |

server/src/tavolo/config.py

@@ -8,7 +8,6 @@ from __future__ import annotations
 import os
 from dataclasses import dataclass
 from typing import Optional
-from urllib.parse import quote
 
 
 def _env(name: str, default: Optional[str] = None) -> str:
@@ -20,34 +19,6 @@ def _env(name: str, default: Optional[str] = None) -> str:
     return value
 
 
-def _database_url_from_parts(engine: str,
-                             user: str,
-                             password: Optional[str],
-                             host: str,
-                             port: str,
-                             name: str,
-                             options: str) -> str:
-    """Assemble a database DSN from individual components.
-
-    ``user`` and ``password`` are percent-encoded so credentials containing
-    URL-reserved characters (``@``, ``:``, ``/``, ...) do not corrupt the
-    DSN. ``port`` and ``options`` are omitted when empty: a missing port
-    lets the driver pick its default (5432 for asyncpg). ``options`` is a
-    raw query string (e.g. ``ssl=require``) appended after a ``?``.
-    """
-    netloc = quote(user, safe="")
-    if password:
-        netloc += ":" + quote(password, safe="")
-    netloc += "@" + host
-    if port:
-        netloc += ":" + port
-    url = f"{engine}://{netloc}/{name}"
-    options = options.lstrip("?")
-    if options:
-        url += "?" + options
-    return url
-
-
 @dataclass(frozen=True)
 class Settings:
     database_url: str
@@ -83,20 +54,7 @@ class Settings:
     @staticmethod
     def from_env() -> "Settings":
         return Settings(
-            # DATABASE_URL, when set, is used verbatim and the DATABASE_*
+            database_url=_env("DATABASE_URL", "postgres://tavolo:tavolo@localhost:5432/tavolo"),
-            # parts below are ignored (sqlite in tests, managed-DB DSNs).
-            database_url=os.environ.get("DATABASE_URL") or _database_url_from_parts(
-                engine=_env("DATABASE_ENGINE", "postgres"),
-                user=_env("DATABASE_USER", "tavolo"),
-                password=_env("DATABASE_PASSWORD", "password"),
-                host=_env("DATABASE_HOST", "localhost"),
-                # Unset: the port segment is omitted and the driver default
-                # (5432 for asyncpg) applies.
-                port=os.environ.get("DATABASE_PORT", ""),
-                name=_env("DATABASE_NAME", "tavolo"),
-                # Raw DSN query string (e.g. "ssl=require"); empty = none.
-                options=os.environ.get("DATABASE_OPTIONS", ""),
-            ),
             oidc_issuer=_env("OIDC_ISSUER", "http://localhost:8180/tavolo"),
             oidc_client_id=_env("OIDC_CLIENT_ID", "tavolo"),
             oidc_client_secret=os.environ.get("OIDC_CLIENT_SECRET"),

server/tests/test_config.py

@@ -1,85 +0,0 @@
-"""Unit tests for the database DSN assembly in :mod:`tavolo.config`.
-
-``Settings.from_env`` is called directly with a fully replaced
-``os.environ`` so no test leaks its ``DATABASE_*`` overrides into the
-suite (``tests/__init__.py`` sets ``DATABASE_URL=sqlite://:memory:``
-globally for the application tests).
-"""
-from __future__ import annotations
-
-import os
-import unittest
-from unittest.mock import patch
-
-from tavolo.config import Settings
-
-
-def _settings(env: dict) -> Settings:
-    with patch.dict(os.environ, env, clear=True):
-        return Settings.from_env()
-
-
-class DatabaseUrlTests(unittest.TestCase):
-    def test_defaults_assemble_from_parts(self):
-        settings = _settings({})
-        self.assertEqual(
-            settings.database_url,
-            "postgres://tavolo:password@localhost/tavolo",
-        )
-
-    def test_components_override_defaults(self):
-        settings = _settings({
-            "DATABASE_ENGINE": "postgres",
-            "DATABASE_HOST": "db.internal",
-            "DATABASE_PORT": "5433",
-            "DATABASE_NAME": "cards",
-            "DATABASE_USER": "scopa",
-            "DATABASE_PASSWORD": "s3cret",
-        })
-        self.assertEqual(
-            settings.database_url,
-            "postgres://scopa:s3cret@db.internal:5433/cards",
-        )
-
-    def test_options_are_appended_as_query_string(self):
-        settings = _settings({"DATABASE_OPTIONS": "ssl=require"})
-        self.assertEqual(
-            settings.database_url,
-            "postgres://tavolo:password@localhost/tavolo?ssl=require",
-        )
-
-    def test_options_leading_question_mark_is_stripped(self):
-        settings = _settings({"DATABASE_OPTIONS": "?ssl=require"})
-        self.assertEqual(
-            settings.database_url,
-            "postgres://tavolo:password@localhost/tavolo?ssl=require",
-        )
-
-    def test_credentials_are_percent_encoded(self):
-        settings = _settings({
-            "DATABASE_USER": "u@x",
-            "DATABASE_PASSWORD": "p@ss/word:1",
-        })
-        self.assertEqual(
-            settings.database_url,
-            "postgres://u%40x:p%40ss%2Fword%3A1@localhost/tavolo",
-        )
-
-    def test_database_url_takes_precedence_over_parts(self):
-        settings = _settings({
-            "DATABASE_URL": "sqlite://:memory:",
-            "DATABASE_HOST": "db.internal",
-            "DATABASE_PASSWORD": "ignored",
-        })
-        self.assertEqual(settings.database_url, "sqlite://:memory:")
-
-    def test_empty_database_url_falls_back_to_parts(self):
-        settings = _settings({"DATABASE_URL": ""})
-        self.assertEqual(
-            settings.database_url,
-            "postgres://tavolo:password@localhost/tavolo",
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()