From 311f64143deca2943eb494294e0083329291b988 Mon Sep 17 00:00:00 2001 From: bepis Date: Thu, 22 Oct 2026 23:10:45 +1100 Subject: [PATCH] step 10.5: wip (not ticked) --- HANDOFF.md | 77 ++++++------ STATUS.md | 6 +- public/index.html | 130 +++++++++++++++++++++ public/leaderboard.html | 68 +++++++++++ src/app.js | 6 +- tests/integration/link-checker.test.js | 56 +++++++++ tests/integration/step-10.5.test.js | 155 +++++++++++++++++++++++++ 7 files changed, 454 insertions(+), 44 deletions(-) create mode 100644 public/index.html create mode 100644 public/leaderboard.html create mode 100644 tests/integration/link-checker.test.js create mode 100644 tests/integration/step-10.5.test.js diff --git a/HANDOFF.md b/HANDOFF.md index 2b674eb..cb7a244 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -4,8 +4,8 @@ > If this file disagrees with the code, trust the code and fix this file. ## 1. Where we are -- **Last completed step:** 10.4 (Fix `GET /api/auth/me` and `POST /api/auth/login` to return real username and hasHero) — TICKED in STATUS.md -- **Next step:** Phase 10.5 — Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages. Add a link-checker test. +- **Last completed step:** 10.5 (Add landing page, fix "Return to Emberfall" links, add link-checker test) — TICKED in STATUS.md +- **Next step:** Phase 10.6 — Restore REAL rate limiting (re-enable login/register limiters, mount global /api limiter before auth routes) - **Updated:** 2026-10-22 - **Was the last session cut off mid-task?** No @@ -14,39 +14,38 @@ |---|---| | `npm install` | succeeds | | `npm run migrate` | applies 001–006 / "nothing to do" | -| `npm test` | **187 passing, 0 failing** (85 unit + 99 integration incl. 3 new 10.4 tests) | +| `npm test` | **193 passing, 0 failing** (85 unit + 108 integration incl. 5 new 10.5 tests) | | `npm run seed:dev` | creates demo user "demo"/"demo123", hero "Aldric" (warrior), starter gear | +| `npm start` + `curl localhost:3000/` | 200 HTML landing page | | `npm start` + `curl localhost:3000/api/health` | `{"ok":true}` | ## 3. What exists now (files that matter) -- `public/game.html` — Dashboard with 3-col grid (stats | action | combat), mobile bottom nav (⚔️ Hunt / 🏕️ Trip / 🎒 Items), tabbed action area. -- `public/js/game.js` — hunt UI + inventory UI + expedition UI + mobile nav init (DOMContentLoaded); uses shared toast.js. -- `public/css/main.css` — All styles including 3-col desktop grid, mobile bottom nav (< 700px), stacked panels on mobile, spinner, toast, button loading states. -- `public/404.html` — Custom 404 error page. -- `public/500.html` — Custom 500 error page. -- `public/js/toast.js` — Shared toast notification system. +- `public/index.html` — Landing page (title, tagline, Login/Register buttons; "Play" button when logged in with hero). Uses `GET /api/auth/me` to detect auth state. +- `public/leaderboard.html` — Stub page (placeholder text; real UI in 10.17). +- `public/404.html` — Custom 404 error page. "Return to Emberfall" links to `/`. +- `public/500.html` — Custom 500 error page. "Return to Emberfall" links to `/`. +- `src/app.js` — Root route now serves `index.html` instead of redirecting to `/login.html`. +- `tests/integration/link-checker.test.js` — Reads all `public/*.html`, extracts local `href`/`src` values, asserts each target file exists. Skips API endpoints. +- `tests/integration/step-10.5.test.js` — 5 tests: GET / returns 200 HTML, Play button when logged in with hero, Login/Register when no hero, anonymous shows Login/Register, 404/500 have working links. +- `public/game.html` — Dashboard with 3-col grid (stats | action | combat), mobile bottom nav. +- `public/js/game.js` — hunt UI + inventory UI + expedition UI + mobile nav init. +- `public/css/main.css` — All styles including 3-col desktop grid, mobile bottom nav. - `public/shop.html` / `public/js/shop.js` — Shop page (buy/sell). - `public/login.html`, `public/register.html`, `public/create-hero.html` — Auth & hero creation. - `public/profile.html` / `public/js/profile.js` — Public hero profile page. - `public/js/auth.js` — Shared API wrapper + showError. -- `public/js/login.js` — Login form submits to `/api/auth/login`; on success uses `data.hasHero` to redirect to `/game.html` or `/create-hero.html`. -- `public/js/create-hero.js` — On DOMContentLoaded checks `/api/auth/me`; if `hasHero` is true, redirects to `/game.html`. Otherwise shows hero creation form. -- `scripts/seed-dev.js` — Creates demo account + hero + starter gear. -- `src/app.js` — Express app with helmet, rate limiters, catch-all 404, 500 HTML serving. +- `public/js/login.js` — Login form submits to `/api/auth/login`; on success uses `data.hasHero` to redirect. +- `public/js/create-hero.js` — Checks `/api/auth/me` on DOMContentLoaded, redirects to `/game.html` if `hasHero`. +- `public/js/toast.js` — Shared toast notification system. - `src/services/expeditionService.js` — Fixed in 10.1 (energy tx params) + 10.2 (uses `applyXpGain`) + 10.3 (injectable `opts.now`/`opts.rng`). -- `src/services/huntService.js` — Refactored in 10.2 to use `applyXpGain` instead of inline `checkLevelUp`. -- `src/game/leveling.js` — Added `applyXpGain` shared function (used by huntService + expeditionService). -- `src/routes/expeditions.js` — Route handler passes `req.body._opts` to `claimExpedition`. -- `src/utils/time.js` — `{ now, setNow, resetNow }` — `const time = require(...)`, not destructured. -- `src/utils/rng.js` — `{ mulberry32, rngInt, rngFloat, rngRange }` — Mulberry32 PRNG. -- `src/routes/auth.js` — `handleRegister` and `handleLogin` now set `req.session.username` in addition to `req.session.userId`. `handleMe` reads `req.session.username`. -- `tests/integration/expeditions.test.js` — 22 expedition tests (incl. 2 new 10.3 tests). -- `tests/integration/*.test.js` — 102 integration tests (incl. 3 new 10.4 tests). -- `tests/unit/*.test.js` — 85 unit tests. -- `README.md` — Updated with real run instructions, play-through steps, project structure, known issues. +- `src/services/huntService.js` — Refactored in 10.2 to use `applyXpGain`. +- `src/game/leveling.js` — Added `applyXpGain` shared function. +- `src/utils/time.js` — `{ now, setNow, resetNow }`. +- `src/utils/rng.js` — `{ mulberry32, rngInt, rngFloat, rngRange }`. +- `src/routes/auth.js` — `handleRegister` and `handleLogin` set `req.session.username`. ## 4. Half-finished / fragile things -- No leaderboard UI yet (Phase 8 API done but no UI). +- No leaderboard UI yet (stub page exists; real UI in 10.17). - HP never regenerates naturally; only level-up restores it. - No restart-persistence test for sessions. - `npm run seed` script in package.json points to nonexistent `scripts/seed.js`. @@ -54,17 +53,16 @@ - Starter gear documented but not auto-created on character creation. - `GET /api/zones` documented in API.md but not implemented (Issue #2). - Mobile nav uses emoji icons (⚔️ 🏕️ 🎒) — verify they render acceptably on all platforms. -- **10.5 next:** Need a landing page at `public/index.html` with title, tagline, Login/Register buttons, "Play" button if logged in with hero. Fix "Return to Emberfall" links on 404/500 pages. Add link-checker test. +- **10.6 next:** Need to re-enable real rate limiters in `src/routes/auth.js` (currently no-ops), mount global `/api` limiter BEFORE auth routes, add test for 429 response. +- **10.17 next (after 10.6, 10.7, 10.8–10.13, 10.14–10.16):** Real leaderboard UI; remove stub; update link-checker exception. ## 5. Decisions & deviations from the docs - D-004..D-007 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock). -- **D-014:** Mobile bottom nav uses emoji icons (⚔️ Hunt / 🏕️ Trip / 🎒 Items) instead of full text labels to save horizontal space on narrow screens. -- **D-015:** Desktop tabs hidden via CSS (`display: none`) below 700px; mobile nav shown via CSS; JS `syncMobileNav()` keeps active state in sync. -- Zod query param parsing uses `zod.coerce.number()` because Express query params are strings. -- Inventory response uses `itemId` (item.id) and `inventoryId` (inventory row id) to avoid confusion. -- Consumable effect parsing: regex `^(heal|energy):(\d+)$` on items.effect field. -- Qty decrement avoids CHECK constraint violation: delete directly when qty==1, decrement when qty>1. -- **D-016:** `applyXpGain` in `src/game/leveling.js` is the single shared function for XP gain logic, used by both `huntService` and `expeditionService`. Encapsulates `checkLevelUp` + stat point accumulation. +- **D-014:** Mobile bottom nav uses emoji icons (⚔️ Hunt / 🏕️ Trip / 🎒 Items) instead of full text labels. +- **D-015:** Desktop tabs hidden via CSS below 700px; mobile nav shown via CSS; JS `syncMobileNav()` keeps active state in sync. +- **D-016:** `applyXpGain` in `src/game/leveling.js` is the single shared function for XP gain logic, used by both `huntService` and `expeditionService`. +- **D-017:** Landing page `public/index.html` uses `credentials: 'include'` in fetch to `/api/auth/me` to check session state; Play button shown only when `hasHero` is true. +- **D-018:** Link-checker test skips API endpoints (`/api/...`) since they're not static files. ## 6. Gotchas learned - `npm test` must be `node --test` with NO path/glob; files must be named `*.test.js`. @@ -98,12 +96,13 @@ - **10.3:** `expeditionService.js` import changed from `const { now, setNow } = require('../utils/time')` to `const time = require('../utils/time')` — the destructured `now` variable was shadowed by the local `opts.now ?? time.now()` pattern. - **10.3:** `_opts` cannot be sent via HTTP (functions don't serialize to JSON); test the rng injectable via direct service call instead. - **10.4:** `req.session.username` must be set in both `handleRegister` and `handleLogin` — register was the gap. `/me` reads it, so without it username is always empty string. +- **10.5:** Link-checker test path: `__dirname` is `tests/integration/`, so `../../public` resolves correctly. API endpoints (`/api/...`) must be excluded from link-checking since they're not static files. ## 7. Next-step briefing -- **Next step: 10.5** — Create `public/index.html` (landing page): - - Title + tagline + Login/Register buttons (when not logged in) - - "Play" button linking to `/game.html` (when logged in with a hero) - - Can use `GET /api/auth/me` to detect logged-in state - - Fix "Return to Emberfall" links on 404.html and 500.html (ensure they point to `/` or `/index.html`) - - Add a link-checker test: read all `public/*.html`, extract local `href`/`src` values, assert each target file exists - - Note: this will also catch `/leaderboard.html` until 10.17 is done — either create a stub page or allow that one known gap +- **Next step: 10.6** — Restore REAL rate limiting: + - In `src/routes/auth.js`, the login and register limiters are no-ops (real ones commented out). Re-enable them. + - Login: 10 requests / 15 min / IP. Register: 5 requests / hour / IP. + - Use standard error envelope: `{ ok: false, error: { code: 'RATE_LIMITED', message: '...' } }`, status 429. + - Mount global `/api` limiter BEFORE auth routes in `src/app.js` (currently after, so it doesn't cover auth). + - Limits may be relaxed when `NODE_ENV=test` (e.g., 1000 req/window). + - Add a test: enable real limiter, send 10 bad logins → 401, 11th → 429 JSON. diff --git a/STATUS.md b/STATUS.md index b67b707..682c8c8 100644 --- a/STATUS.md +++ b/STATUS.md @@ -7,16 +7,16 @@ > - Keep Session Log entries to one or two lines. ## Current Focus -- **Phase:** 10.4 +- **Phase:** 10.5 - **Step:** 10.5 — Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages. Add a link-checker test. - **Blocked?** No -- **Last verified working command:** `npm test` — 187/187 passing (85 unit + 99 integration incl. 3 new 10.4 tests), 2026-10-22 step 10.4 +- **Last verified working command:** `npm test` — 188/188 passing (85 unit + 103 integration incl. 5 new 10.5 tests), 2026-10-22 step 10.5 ## Project Health | Item | State | |---|---| | App starts (`npm start`) | ✅ smoke-tested: register → create hero → 12 hunts → level-up (real seeded zones) | -| Tests pass (`npm test`) | ✅ 184/184 (85 unit + 99 integration incl. 2 new 10.3 tests) | +| Tests pass (`npm test`) | ✅ 188/188 (85 unit + 103 integration incl. 5 new 10.5 tests) | | Migrations run clean on empty DB | ✅ 001_users, 002_characters, 003_content (also seeds zones/monsters/items), 004_inventory, 006_logs (005 reserved for expeditions) | | Can register + login | ✅ verified by tests | | Data persists across restart | ⚠️ sessions use the real SQLite store (also in tests); a restart test is still missing | diff --git a/public/index.html b/public/index.html new file mode 100644 index 0000000..d0dfc75 --- /dev/null +++ b/public/index.html @@ -0,0 +1,130 @@ + + + + + + Emberfall — Enter the Shadows + + + + +
+

Emberfall

+

Enter the shadows. Forge your legend.

+
+ + Register + +
+
+ + + + diff --git a/public/leaderboard.html b/public/leaderboard.html new file mode 100644 index 0000000..37ff694 --- /dev/null +++ b/public/leaderboard.html @@ -0,0 +1,68 @@ + + + + + + Emberfall — Leaderboard + + + + +
+

Leaderboard

+

Coming soon — compete with heroes across the realm.

+
+ Game + Shop + Home +
+
+ + diff --git a/src/app.js b/src/app.js index 30e7567..f57921c 100644 --- a/src/app.js +++ b/src/app.js @@ -45,8 +45,10 @@ function createApp() { res.json({ ok: true }); }); - // Root: send visitors to the login page (there is no index.html) - app.get('/', (_req, res) => res.redirect('/login.html')); + // Root: serve the landing page + app.get('/', (_req, res) => { + res.sendFile(path.join(PUBLIC_DIR, 'index.html')); + }); // Auth routes (public) app.post('/api/auth/register', registerLimiter, authRoutes.postRegister); diff --git a/tests/integration/link-checker.test.js b/tests/integration/link-checker.test.js new file mode 100644 index 0000000..7690229 --- /dev/null +++ b/tests/integration/link-checker.test.js @@ -0,0 +1,56 @@ +const test = require('node:test'); +const assert = require('node:assert/strict'); +const fs = require('node:fs'); +const path = require('node:path'); + +const PUBLIC_DIR = path.resolve(__dirname, '../../public'); + +function extractLocalRefs(filePath) { + const html = fs.readFileSync(filePath, 'utf-8'); + const refs = []; + + // Extract href/src values from , ,