app/schemas/models/level.js (1)

436-436: Make allowAnonymous default explicit for schema clarity.

Line [436] currently relies on implicit falsy handling downstream; adding an explicit default makes intent clearer and avoids ambiguous editor behavior.

🧹 Suggested tweak

-  allowAnonymous: { title: 'Allow Anonymous Play', description: 'Whether this level is available to anonymous user', type: 'boolean', inEditor: 'codecombat' },
+  allowAnonymous: { title: 'Allow Anonymous Play', description: 'Whether this level is available to anonymous users', type: 'boolean', default: false, inEditor: 'codecombat' },

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/schemas/models/level.js` at line 436, The allowAnonymous property in the
Level schema should have an explicit default to avoid implicit falsy
assumptions; update the schema definition for allowAnonymous (the property
currently titled 'Allow Anonymous Play' in the exported Level model) to include
default: false so the editor and validators receive an explicit value and
downstream code behaves predictably.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

app/views/play/CampaignView.js (1)

1931-1936: ⚠️ Potential issue | 🟠 Major

Avoid hard-return when signup prompt is suppressed.

On Line 1935, returning this.promptForSignup(...) can block level start when promptForSignup no-ops (HoC/noAuth paths) and returns nothing.

Proposed fix

     if (!level.allowAnonymous && me.isAnonymous()) {
       const CAMPAIGN = this.campaign?.get('name')?.toLowerCase() || this.terrain
       const requireSignup = me.getOrStartRequireSignupExperimentValue?.(CAMPAIGN)
       if (requireSignup === 'beta') {
-        return this.promptForSignup({ accountRequiredMessage: $.i18n.t('account.unlock_next_level_with_sign_up') })
+        const promptResult = this.promptForSignup({ accountRequiredMessage: $.i18n.t('account.unlock_next_level_with_sign_up') })
+        if (promptResult) {
+          return promptResult
+        }
       }
     }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/views/play/CampaignView.js` around lines 1931 - 1936, The current code
returns the result of this.promptForSignup(...) inside the block guarding
level.allowAnonymous/me.isAnonymous(), which can unintentionally short-circuit
level start when promptForSignup is a no-op and returns nothing; instead call
this.promptForSignup(...) (await if it is async) without returning its value so
execution continues normally — update the conditional that uses
level.allowAnonymous, me.isAnonymous(), CAMPAIGN, requireSignup and replace
"return this.promptForSignup(...)" with a non-returning invocation (e.g.,
this.promptForSignup(...); and then continue/return undefined explicitly if
needed) to avoid blocking level start.

app/models/User.js (1)

1485-1495: Missing validation for invalid CAMPAIGN parameter.

Unlike getOrStartRequireSignupExperimentValue, this method doesn't validate that CAMPAIGN is a key in REQUIRE_SIGN_UP_EXPERIMENT. If called directly with an invalid campaign, REQUIRE_SIGN_UP_EXPERIMENT[CAMPAIGN] will be undefined, which gets passed to getExperimentValueFromQuery and getExperimentValue potentially causing unexpected behavior.

Consider adding validation or documenting that callers should use getOrStartRequireSignupExperimentValue instead.

Proposed defensive check

 getRequireSignupExperimentValue (CAMPAIGN) {
+  if (!REQUIRE_SIGN_UP_EXPERIMENT[CAMPAIGN]) {
+    return null
+  }
   if (!me.isAnonymous()) {
     return 'control'
   }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/models/User.js` around lines 1485 - 1495, The method
getRequireSignupExperimentValue lacks validation of the CAMPAIGN argument
against the REQUIRE_SIGN_UP_EXPERIMENT map; add a defensive check at the start
of getRequireSignupExperimentValue to verify
REQUIRE_SIGN_UP_EXPERIMENT.hasOwnProperty(CAMPAIGN) (or CAMPAIGN in
REQUIRE_SIGN_UP_EXPERIMENT) and return null or 'control' (match existing
behavior) when invalid, so you don't pass undefined into
utils.getExperimentValueFromQuery or me.getExperimentValue; ensure the change
references getRequireSignupExperimentValue and REQUIRE_SIGN_UP_EXPERIMENT and
keeps existing anonymous-user early-return logic.