# Render Postgres Live Registration Check

> Status: operational note from the 2026-07-20 live-app verification. This is a dev/testing runbook, not a production security policy.

## Goal

Verify that a registration created through the live kk-web app is persisted in the Render Postgres database used by kk-api.

Live surfaces used:

- kk-web dev app: `https://kk-app.korpusakurdi-dev.workers.dev/`
- kk-api Render service: `https://kk-api-oddl.onrender.com`
- Render database: `kk-api-postgres`

## Result

The check succeeded.

A user registered in the live app could be read back through:

```bash
curl -i \
  -H "Authorization: Bearer $KK_TOKEN" \
  https://kk-api-oddl.onrender.com/v1/users/me
```

The same user then appeared in the Render Postgres `users` table. That confirms the registration flow went through kk-web -> kk-api -> Render Postgres.

## Step 1: Capture the Live Token

After registering in the live app, inspect the browser response/storage and copy the returned `kkd_...` device token.

Store it locally without echoing it:

```bash
read -s KK_TOKEN
```

Paste the token and press Enter.

## Step 2: Verify Through kk-api

Query the authenticated profile endpoint:

```bash
curl -i \
  -H "Authorization: Bearer $KK_TOKEN" \
  https://kk-api-oddl.onrender.com/v1/users/me
```

Expected:

- HTTP status is `200`.
- Response contains the registered user's `id`, `name`, `surname`, `country`, `city`, `dialects`, `created_at`, and `updated_at`.

This is already strong evidence that the data was persisted, because kk-api reads the authenticated user from its database-backed device token flow.

## Step 3: Get Render Database Access

Render does not provide the same built-in table browser experience as Neon/Supabase. Use the database connection details instead.

In Render:

1. Open database `kk-api-postgres`.
2. Open the **Connect** area.
3. Copy either **External Database URL** or **PSQL Command**.

Use the external URL from a local machine. Internal/private URLs are for Render services inside Render's private network.

Set the URL locally:

```bash
export KK_API_DATABASE_URL='postgresql://...'
```

If Render shows `postgresql+psycopg://...`, change it to `postgresql://...` for `psql`.

## Step 4: Install psql if Needed

On macOS with Homebrew:

```bash
brew install libpq
brew link --force libpq
```

Check:

```bash
psql --version
```

If `psql` is still not in `PATH`, use:

```bash
/opt/homebrew/opt/libpq/bin/psql "$KK_API_DATABASE_URL" -c '\dt'
```

## Step 5: Query the Registration Data

List tables:

```bash
psql "$KK_API_DATABASE_URL" -c '\dt'
```

View recent users:

```bash
psql "$KK_API_DATABASE_URL" -c "
select id, name, surname, email, phone, country_id, city_id, created_at
from users
order by created_at desc
limit 10;
"
```

Check a specific user from `/v1/users/me`:

```bash
psql "$KK_API_DATABASE_URL" -c "
select id, name, surname, email, phone, country_id, city_id, created_at
from users
where id = '<USER_ID_FROM_API>';
"
```

Check the user's dialects:

```bash
psql "$KK_API_DATABASE_URL" -c "
select d.code, d.name
from user_dialects ud
join dialects d on d.id = ud.dialect_id
where ud.user_id = '<USER_ID_FROM_API>';
"
```

Check the user's device record:

```bash
psql "$KK_API_DATABASE_URL" -c "
select id, user_id, label, platform, last_seen_at, revoked_at, created_at
from devices
where user_id = '<USER_ID_FROM_API>';
"
```

If `psql` opens a pager and shows `(END)`, press `q` to exit.

## Cleanup

When finished:

```bash
unset KK_TOKEN KK_API_DATABASE_URL
```

For dev/testing, temporary shared credentials are acceptable when the team knows the environment is disposable. Before collecting real contributor data, rotate exposed credentials, move to a durable managed database plan, and confirm backup/restore ownership.