Dev-only bulk delete all campaigns; deleteCollection SQL bulk + gates

Feature: debug button to wipe all campaigns/encounters/logs in dev builds.
Previously bulk delete fetched all logs per campaign, client-filtered,
batchWrite — 30s+/campaign. Now SQL bulk DELETE, no fetch.

Server (server/db.js, server/index.js):
- deleteCollection(collPath, {where}) — SQL DELETE FROM docs WHERE parent=?,
  optional where-filter. Broadcasts deletions to WS subscribers.
- DELETE /api/collection endpoint
- Gate: ALLOW_DEV_ENDPOINTS=1 env OR createServer({allowDevEndpoints:true})
- createServer accepts allowDevEndpoints param (tests bypass env)

Storage (src/storage/server.js, src/storage/firebase.js):
- deleteCollection(path, whereField, whereValue) both adapters
- Firebase: fetch matching + batch-delete (firestore no bulk), 500-chunk
- Gate: throws if NODE_ENV not development/test
- Contract-tested both backends

App (src/App.js):
- deleteCampaignCascade refactored (reusable, no try/catch split)
- handleDeleteAllCampaigns: Promise.all per campaign, deleteCollection for
  encounters (no fetch), deleteCollection logs once globally, parallel
- Button dev-gated (NODE_ENV), confirm modal, hidden when no campaigns

Mock fixes (surfaced by new tests):
- firebase firestore mock: added where() export, getDocs applies constraints
  (was returning all docs ignoring query constraints — pre-existing gap)

Tests:
- contract: deleteCollection (bulk, where-filter, empty) both backends
- server-contract: live deleteCollection (bulk, where, 403 gate)
- runStorageContract via makeStorage({allowDevEndpoints:true})

Safety (3 layers):
- UI button hidden in prod (NODE_ENV gate)
- storage method throws in prod (NODE_ENV gate)
- HTTP endpoint 403 in prod (env/param gate)

TODO.md

@@ -9,10 +9,6 @@ Backlog of bugs + long-term items. Milestones live in REWORK_PLAN.md.
 ### dm list - keep active particpant in view (scroll)
 not sure good way to do this
 
-### combat.js doesnt seem to actually exercise the add characters.  there are no characters in the campaign.   only in the encounter..
-
-#### debug feature - button to delet all campaigns - only in dev builds
-
 
 
 ### FEAT: player display fade transitions for inactive state
@@ -22,8 +18,9 @@ not sure good way to do this
 - DM display keeps inactive participant visible.
 - Dead state does not imply inactive/disabled.
 - Dying/stable must not fade out or leave layout holes.
-- Dead can keep skull/Dead label; create some good visual cues, no removal.
+- Dead can keep skull/Dead label; create some good visual cues, no removal - but a cool transition to death would be nice.
-- 
+
+
 
 
 

scripts/dev-start.sh

@@ -18,7 +18,7 @@ done
 # backend: better-sqlite3, :4001
 if ! lsof -ti :4001 >/dev/null 2>&1; then
   echo "starting backend :4001..."
-  DB_PATH=$(pwd)/data/tracker.sqlite PORT=4001 \
+  DB_PATH=$(pwd)/data/tracker.sqlite PORT=4001 ALLOW_DEV_ENDPOINTS=1 \
     nohup npm run server:dev > tmp/server.log 2>&1 &
   echo $! > tmp/server.pid
 else

server/db.js

@@ -113,6 +113,25 @@ function makeStore(db, broadcast) {
     return db.prepare('SELECT COUNT(*) AS n FROM docs WHERE parent = ?').get(collPath).n;
   }
 
+  // Bulk delete whole collection or by where-filter. No fetch. SQL knows paths.
+  // DEV ONLY — guarded at HTTP layer; db fn itself unguarded (server-internal trust).
+  function deleteCollection(collPath, { where } = {}) {
+    let sql = 'DELETE FROM docs WHERE parent = ?';
+    const params = [collPath];
+    const changed = [];
+    if (where) {
+      if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(where.field)) throw new Error(`bad where field: ${where.field}`);
+      if (where.op !== '==') throw new Error(`unsupported where op: ${where.op}`);
+      sql += ` AND json_extract(data, '$.${where.field}') = ?`;
+      params.push(where.value);
+    }
+    // collect paths+parents for broadcast before delete
+    const rows = db.prepare('SELECT path, parent FROM docs WHERE parent = ?' + (where ? ` AND json_extract(data, '$.${where.field}') = ?` : '')).all(...params);
+    const info = db.prepare(sql).run(...params);
+    if (broadcast) rows.forEach(r => broadcast({ path: r.path, parent: r.parent, deleted: true }));
+    return info.changes;
+  }
+
   function batchWrite(ops) {
     const run = db.transaction((items) => {
       const changed = [];
@@ -151,7 +170,7 @@ function makeStore(db, broadcast) {
     return result;
   }
 
-  return { getDoc, setDoc, updateDoc, deleteDoc, getCollection, countCollection, batchWrite, transactionalUndo };
+  return { getDoc, setDoc, updateDoc, deleteDoc, getCollection, countCollection, deleteCollection, batchWrite, transactionalUndo };
 }
 
 module.exports = { openDb, parentOf, makeStore };

server/index.js

@@ -11,7 +11,7 @@ const crypto = require('crypto');
 const { WebSocketServer } = require('ws');
 const { openDb, makeStore } = require('./db');
 
-function createServer({ dbPath, port, corsOrigin } = {}) {
+function createServer({ dbPath, port, corsOrigin, allowDevEndpoints = false } = {}) {
   const db = openDb(dbPath || './data/tracker.sqlite');
   const app = express();
   app.use(cors({ origin: corsOrigin || '*' }));
@@ -103,6 +103,21 @@ function createServer({ dbPath, port, corsOrigin } = {}) {
     res.json({ ok: true });
   });
 
+  // DELETE /api/collection?path=...&whereField=...&whereValue=...
+  // Bulk delete whole collection or filtered. No fetch. SQL DELETE.
+  // DEV ONLY: requires ALLOW_DEV_ENDPOINTS=1 env on server.
+  app.delete('/api/collection', (req, res) => {
+    if (!allowDevEndpoints && process.env.ALLOW_DEV_ENDPOINTS !== '1') {
+      return res.status(403).json({ error: 'bulk delete disabled (dev only)' });
+    }
+    const { path: p, whereField, whereOp, whereValue } = req.query;
+    if (!p) return res.status(400).json({ error: 'path required' });
+    const opts = {};
+    if (whereField) opts.where = { field: whereField, op: whereOp || '==', value: whereValue };
+    const deleted = store.deleteCollection(p, opts);
+    res.json({ ok: true, deleted });
+  });
+
   // POST /api/collection  body: { path, data }  (addDoc: auto-id under collection)
   app.post('/api/collection', (req, res) => {
     const { path: collPath, data } = req.body || {};

server/tests/server-contract.test.js

@@ -16,9 +16,9 @@ const { runStorageContract } = require('../../src/storage/contract');
 
 // Factory: fresh backend (unique sqlite file) + storage pointed at it.
 // Disposing the storage closes the backend so each test is fully isolated.
-async function makeStorage() {
+async function makeStorage({ allowDevEndpoints = false } = {}) {
   const dbPath = path.join(os.tmpdir(), `ws-contract-${Date.now()}-${Math.random().toString(36).slice(2)}.sqlite`);
-  const handle = createServer({ dbPath, port: 0 });
+  const handle = createServer({ dbPath, port: 0, allowDevEndpoints });
   await new Promise((resolve, reject) => {
     handle.server.on('error', reject);
     handle.server.listen(0, resolve);
@@ -31,7 +31,7 @@ async function makeStorage() {
   return storage;
 }
 
-runStorageContract('server (live backend)', makeStorage);
+runStorageContract('server (live backend)', () => makeStorage({ allowDevEndpoints: true }));
 
 describe('server-side query constraints', () => {
   let storage;
@@ -75,3 +75,41 @@ describe('server-side query constraints', () => {
     expect(res).toEqual({ count: 5 });
   });
 });
+
+describe('DELETE /api/collection (bulk delete)', () => {
+  let storage;
+  beforeEach(async () => {
+    storage = await makeStorage({ allowDevEndpoints: true });
+  });
+  afterEach((done) => storage.dispose(done));
+
+  test('deletes all docs in collection, no fetch', async () => {
+    for (let i = 0; i < 3; i++) await storage.addDoc('logs', { type: 'x', n: i });
+    const res = await storage._api('DELETE', '/api/collection', { path: 'logs' });
+    expect(res.ok).toBe(true);
+    expect(res.deleted).toBe(3);
+    const after = await storage._api('GET', '/api/collection/count', { path: 'logs' });
+    expect(after.count).toBe(0);
+  });
+
+  test('honors whereField filter', async () => {
+    await storage.addDoc('logs', { type: 'keep', n: 1 });
+    await storage.addDoc('logs', { type: 'drop', n: 2 });
+    await storage.addDoc('logs', { type: 'drop', n: 3 });
+    const res = await storage._api('DELETE', '/api/collection',
+      { path: 'logs', whereField: 'type', whereValue: 'drop' });
+    expect(res.deleted).toBe(2);
+    const after = await storage._api('GET', '/api/collection/count', { path: 'logs' });
+    expect(after.count).toBe(1);
+  });
+
+  test('403 when ALLOW_DEV_ENDPOINTS not set', async () => {
+    const gated = await makeStorage({ allowDevEndpoints: false });
+    let errMsg = null;
+    try {
+      await gated._api('DELETE', '/api/collection', { path: 'logs' });
+    } catch (e) { errMsg = e.message; }
+    expect(errMsg).toMatch(/403/);
+    await new Promise((resolve) => gated.dispose(resolve));
+  });
+});

src/App.js

@@ -2313,50 +2313,81 @@ function AdminView({ userId }) {
     if (!db || !itemToDelete) return;
 
     const campaignId = itemToDelete.id;
+    await deleteCampaignCascade(campaignId);
 
-    try {
+    if (selectedCampaignId === campaignId) {
-      const encountersPath = getPath.encounters(campaignId);
+      setSelectedCampaignId(null);
-      const encounters = await storage.getCollection(encountersPath);
+    }
-      const deleteOps = encounters.map(e => {
-        const id = e.id || e.path?.split('/').pop();
-        return { type: 'delete', path: `${encountersPath}/${id}` };
-      });
-
-      // cascade: delete logs for every encounter in this campaign
-      const allLogs = await storage.getCollection(getPath.logs());
-      const encPaths = new Set(encounters.map(e => `${encountersPath}/${e.id || e.path?.split('/').pop()}`));
-      const encIds = new Set(encounters.map(e => e.id || e.path?.split('/').pop()));
-      const logOps = allLogs
-        .filter(l =>
-          (l.encounterId && encIds.has(l.encounterId)) ||
-          (l.encounterPath && [...encPaths].some(p => l.encounterPath.includes(p)))
-        )
-        .map(l => ({
-          type: 'delete',
-          path: `${getPath.logs()}/${l.id || l.path?.split('/').pop()}`,
-        }));
-
-      if (deleteOps.length > 0 || logOps.length > 0) {
-        await storage.batchWrite([...deleteOps, ...logOps]);
-      }
-
-      await storage.deleteDoc(getPath.campaign(campaignId));
-
-      if (selectedCampaignId === campaignId) {
-        setSelectedCampaignId(null);
-      }
-
-      const activeDisplay = await storage.getDoc(getPath.activeDisplay());
-
-      if (activeDisplay && activeDisplay.activeCampaignId === campaignId) {
-        await storage.updateDoc(getPath.activeDisplay(), { activeCampaignId: null, activeEncounterId: null });
-      }
-    } catch (err) {
-      console.error("Error deleting campaign:", err);
-      showToast("Failed to delete campaign. Please try again.");    }
 
     setShowDeleteConfirm(false);
     setItemToDelete(null);
+    showToast('Campaign deleted.');
+  };
+
+  // Cascade delete: encounters + logs + display + campaign doc.
+  const deleteCampaignCascade = async (campaignId) => {
+    const encountersPath = getPath.encounters(campaignId);
+    const encounters = await storage.getCollection(encountersPath);
+    const deleteOps = encounters.map(e => {
+      const id = e.id || e.path?.split('/').pop();
+      return { type: 'delete', path: `${encountersPath}/${id}` };
+    });
+
+    const allLogs = await storage.getCollection(getPath.logs());
+    const encPaths = new Set(encounters.map(e => `${encountersPath}/${e.id || e.path?.split('/').pop()}`));
+    const encIds = new Set(encounters.map(e => e.id || e.path?.split('/').pop()));
+    const logOps = allLogs
+      .filter(l =>
+        (l.encounterId && encIds.has(l.encounterId)) ||
+        (l.encounterPath && [...encPaths].some(p => l.encounterPath.includes(p)))
+      )
+      .map(l => ({
+        type: 'delete',
+        path: `${getPath.logs()}/${l.id || l.path?.split('/').pop()}`,
+      }));
+
+    if (deleteOps.length > 0 || logOps.length > 0) {
+      await storage.batchWrite([...deleteOps, ...logOps]);
+    }
+
+    await storage.deleteDoc(getPath.campaign(campaignId));
+
+    const activeDisplay = await storage.getDoc(getPath.activeDisplay());
+    if (activeDisplay && activeDisplay.activeCampaignId === campaignId) {
+      await storage.updateDoc(getPath.activeDisplay(), { activeCampaignId: null, activeEncounterId: null });
+    }
+  };
+
+  // Dev-only: wipe all campaigns + encounters + logs. Irreversible.
+  // Uses deleteCollection (SQL bulk DELETE, no fetch). Parallel per campaign.
+  const [showDeleteAllConfirm, setShowDeleteAllConfirm] = useState(false);
+  const handleDeleteAllCampaigns = async () => {
+    if (!db) return;
+    try {
+      const all = await storage.getCollection(getPath.campaigns());
+      await Promise.all(all.map(async (c) => {
+        const cid = c.id || c.path?.split('/').pop();
+        // bulk-delete all encounters under this campaign (SQL DELETE, no fetch)
+        if (storage.deleteCollection) {
+          await storage.deleteCollection(getPath.encounters(cid));
+        }
+        await storage.deleteDoc(getPath.campaign(cid));
+      }));
+      // nuke all logs in one shot (orphans acceptable in dev; logs span campaigns)
+      if (storage.deleteCollection) {
+        await storage.deleteCollection(getPath.logs());
+      }
+      const activeDisplay = await storage.getDoc(getPath.activeDisplay());
+      if (activeDisplay && activeDisplay.activeCampaignId) {
+        await storage.updateDoc(getPath.activeDisplay(), { activeCampaignId: null, activeEncounterId: null });
+      }
+      setSelectedCampaignId(null);
+      setShowDeleteAllConfirm(false);
+      showToast(`Deleted ${all.length} campaign(s).`);
+    } catch (err) {
+      console.error('Error deleting all campaigns:', err);
+      showToast('Failed to delete all campaigns.');
+    }
   };
 
   const selectedCampaign = campaignsWithDetails.find(c => c.id === selectedCampaignId);
@@ -2495,6 +2526,26 @@ function AdminView({ userId }) {
         title="Delete Campaign?"
         message={`Are you sure you want to delete the campaign "${itemToDelete?.name}" and all its encounters? This action cannot be undone.`}
       />
+
+      {process.env.NODE_ENV === 'development' && campaignsWithDetails.length > 0 && (
+        <div className="mt-4">
+          <button
+            onClick={() => setShowDeleteAllConfirm(true)}
+            className="px-3 py-1.5 text-xs rounded bg-red-900 hover:bg-red-800 text-red-100 border border-red-700"
+            title="DEV ONLY: Delete every campaign, encounter, and log. Irreversible."
+          >
+            <Trash2 size={12} className="inline mr-1" />DEV: Delete All Campaigns
+          </button>
+        </div>
+      )}
+
+      <ConfirmationModal
+        isOpen={showDeleteAllConfirm}
+        onClose={() => setShowDeleteAllConfirm(false)}
+        onConfirm={handleDeleteAllCampaigns}
+        title="Delete ALL Campaigns?"
+        message="DEV ONLY: This permanently deletes EVERY campaign, all encounters, and all logs. Cannot be undone. Are you absolutely sure?"
+      />
     </>
   );
 }

src/__mocks__/firebase/firestore.js

@@ -13,6 +13,7 @@ export function doc(db, path, extra) {
 }
 export function collection(db, path) { return ref(path); }
 export function query(refOrColl, ...constraints) { return { ref: refOrColl, constraints }; }
+export function where(field, op, value) { return { __type: 'where', field, op, value }; }
 export function orderBy(field, dir) { return { __type: 'orderBy', field, dir }; }
 export function limit(n) { return { __type: 'limit', n }; }
 
@@ -67,7 +68,9 @@ export async function getDoc(docRef) {
 }
 export async function getDocs(collRefOrQuery) {
   const collPath = collRefOrQuery.ref ? collRefOrQuery.ref.path : collRefOrQuery.path;
-  const docs = MOCK_DB.collection(collPath);
+  let docs = MOCK_DB.collection(collPath);
+  const constraints = collRefOrQuery.constraints || [];
+  docs = applyConstraints(docs, constraints);
   return { docs: docs.map(d => ({ id: d.id, data: () => d.data, ref: { path: `${collPath}/${d.id}` } })) };
 }
 
@@ -118,6 +121,8 @@ function applyConstraints(docs, constraints) {
       });
     } else if (c.__type === 'limit') {
       out = out.slice(0, c.n);
+    } else if (c.__type === 'where') {
+      out = out.filter(d => d.data[c.field] === c.value);
     }
   }
   return out;

src/storage/contract.js

@@ -209,6 +209,32 @@ function runStorageContract(name, factory) {
       });
     });
 
+    describe('deleteCollection', () => {
+      test('deletes all docs in collection', async () => {
+        await storage.addDoc('logs', { type: 'a' });
+        await storage.addDoc('logs', { type: 'b' });
+        const deleted = await storage.deleteCollection('logs');
+        expect(deleted).toBe(2);
+        const remaining = await storage.getCollection('logs');
+        expect(remaining).toHaveLength(0);
+      });
+
+      test('honors whereField filter', async () => {
+        await storage.addDoc('logs', { type: 'keep', n: 1 });
+        await storage.addDoc('logs', { type: 'drop', n: 2 });
+        await storage.addDoc('logs', { type: 'drop', n: 3 });
+        const deleted = await storage.deleteCollection('logs', 'type', 'drop');
+        expect(deleted).toBe(2);
+        const remaining = await storage.getCollection('logs');
+        expect(remaining).toHaveLength(1);
+      });
+
+      test('empty collection returns 0', async () => {
+        const deleted = await storage.deleteCollection('logs');
+        expect(deleted).toBe(0);
+      });
+    });
+
     describe('subscribeDoc', () => {
       test('fires cb immediately with current value', async () => {
         await storage.setDoc('campaigns/a', { name: 'Alpha' });

src/storage/firebase.js

@@ -130,6 +130,27 @@ export function createFirebaseStorage() {
       await batch.commit();
     },
 
+    // Bulk delete collection (optionally where-filtered). Firestore has no
+    // single bulk-by-path op: fetch matching docs, batch-delete in chunks
+    // of 500 (firestore batch limit). DEV ONLY.
+    async deleteCollection(path, whereField, whereValue) {
+      if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test') {
+        throw new Error('deleteCollection: dev only');
+      }
+      let q = collection(db, path);
+      if (whereField) q = query(q, where(whereField, '==', whereValue));
+      const snap = await getDocsReal(q);
+      const docs = snap.docs;
+      let count = 0;
+      for (let i = 0; i < docs.length; i += 500) {
+        const batch = writeBatch(db);
+        for (const d of docs.slice(i, i + 500)) batch.delete(d.ref);
+        await batch.commit();
+        count += Math.min(500, docs.length - i);
+      }
+      return count;
+    },
+
     // Transactional undo via batch (atomic in firestore). Apply updates +
     // flip undone flag in single commit.
     async undo({ logPath, undo, redo = false }) {

src/storage/server.js

@@ -204,6 +204,19 @@ function createServerStorage({ baseUrl, realtimeUrl } = {}) {
       await api('DELETE', '/api/doc', { path: p });
     },
 
+    // Bulk delete collection (optionally where-filtered). No fetch. SQL DELETE.
+    // DEV ONLY. Method ships in prod build but throws if not dev.
+    async deleteCollection(rawCollPath, whereField, whereValue) {
+      if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test') {
+        throw new Error('deleteCollection: dev only');
+      }
+      const p = norm(rawCollPath);
+      const query = { path: p };
+      if (whereField) { query.whereField = whereField; query.whereValue = whereValue; }
+      const res = await api('DELETE', '/api/collection', query);
+      return res.deleted;
+    },
+
     async addDoc(rawCollPath, data) {
       const p = norm(rawCollPath);
       const res = await api('POST', '/api/collection', null, { path: p, data });