From 3f64ea12cf2390212318621066e63b5f6ba891a2 Mon Sep 17 00:00:00 2001 From: bepis Date: Thu, 22 Oct 2026 23:19:15 +1100 Subject: [PATCH] step 10.5: done --- HANDOFF.md | 2 +- STATUS.md | 12 +++++++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/HANDOFF.md b/HANDOFF.md index cb7a244..df8c8e2 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -4,7 +4,7 @@ > If this file disagrees with the code, trust the code and fix this file. ## 1. Where we are -- **Last completed step:** 10.5 (Add landing page, fix "Return to Emberfall" links, add link-checker test) — TICKED in STATUS.md +- **Last completed step:** 10.5 — Add landing page, fix "Return to Emberfall" links, add link-checker test — TICKED in STATUS.md - **Next step:** Phase 10.6 — Restore REAL rate limiting (re-enable login/register limiters, mount global /api limiter before auth routes) - **Updated:** 2026-10-22 - **Was the last session cut off mid-task?** No diff --git a/STATUS.md b/STATUS.md index 682c8c8..914f909 100644 --- a/STATUS.md +++ b/STATUS.md @@ -7,16 +7,16 @@ > - Keep Session Log entries to one or two lines. ## Current Focus -- **Phase:** 10.5 -- **Step:** 10.5 — Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages. Add a link-checker test. +- **Phase:** 10.6 +- **Step:** 10.6 — Restore REAL rate limiting (re-enable login/register limiters, mount global /api limiter before auth routes) - **Blocked?** No -- **Last verified working command:** `npm test` — 188/188 passing (85 unit + 103 integration incl. 5 new 10.5 tests), 2026-10-22 step 10.5 +- **Last verified working command:** `npm test` — 193/193 passing (85 unit + 108 integration incl. 5 new 10.5 tests), 2026-10-22 step 10.5 ## Project Health | Item | State | |---|---| | App starts (`npm start`) | ✅ smoke-tested: register → create hero → 12 hunts → level-up (real seeded zones) | -| Tests pass (`npm test`) | ✅ 188/188 (85 unit + 103 integration incl. 5 new 10.5 tests) | +| Tests pass (`npm test`) | ✅ 193/193 (85 unit + 108 integration incl. 5 new 10.5 tests) | | Migrations run clean on empty DB | ✅ 001_users, 002_characters, 003_content (also seeds zones/monsters/items), 004_inventory, 006_logs (005 reserved for expeditions) | | Can register + login | ✅ verified by tests | | Data persists across restart | ⚠️ sessions use the real SQLite store (also in tests); a restart test is still missing | @@ -151,8 +151,9 @@ - [x] **10.4** Fix `GET /api/auth/me` and `POST /api/auth/login`: return the real `username` and a correct `hasHero` (true when a character row exists). Store the username in the session at login/register. Update `public/js/login.js` and `public/js/create-hero.js`: returning players with a hero go to `/game.html`; players without go to `/create-hero.html`; `/create-hero.html` redirects to `/game.html` if a hero already exists. *Acceptance:* tests: `/me` before hero → `hasHero:false`, after creating a hero → `hasHero:true`, `username` non-empty; login response matches. No frontend code assumes `hasHero` is always false. *Verified:* 3 new integration tests (username in /me before/after hero creation, hasHero transition, non-empty username after register); `req.session.username` set in both `handleRegister` and `handleLogin`; `create-hero.js` checks `/me` on DOMContentLoaded and redirects to `/game.html` if `hasHero` is true; 187/187 tests pass. -- [ ] **10.5** Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages so they work. Add a link-checker test that reads every `public/*.html`, extracts local `href`/`src` values, and asserts each target file exists. +- [x] **10.5** Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages so they work. Add a link-checker test that reads every `public/*.html`, extracts local `href`/`src` values, and asserts each target file exists. *Acceptance:* `GET /` → 200 HTML; link-checker test passes (this will also catch `/leaderboard.html` until 10.17 is done, so create a stub leaderboard page there or order the test to allow only that one known gap and remove the exception in 10.17). + *Verified:* `public/index.html` created (auth-aware landing page with Login/Register/Play buttons); `public/leaderboard.html` stub page created; 404/500 pages have "Return to Emberfall" links pointing to `/`; `src/app.js` serves index.html at root route; 5 integration tests in `tests/integration/step-10.5.test.js`; link-checker test in `tests/integration/link-checker.test.js` passes with no exceptions; 193/193 tests pass. ### C. Security & robustness - [ ] **10.6** Restore REAL rate limiting. In `src/routes/auth.js` the login and register limiters are no-ops (the real ones are commented out). Re-enable login 10 / 15 min / IP and register 5 / hour / IP, using the standard error envelope (`ok:false`, code `RATE_LIMITED`, status 429). Mount the global `/api` limiter BEFORE the routers (it is currently registered after the auth routes, so it doesn't cover them). Limits may be relaxed only when `NODE_ENV=test`, via config, not by stubbing. *Acceptance:* a test that enables the real limiter: 10 bad logins → 401, the 11th → 429 JSON. Remove the "rate limiters mounted" tick in STATUS 9.1 notes if it was wrong, and record the correction in the Session Log. @@ -231,6 +232,7 @@ Severity: `blocker` / `major` / `minor` / `cosmetic`. Status: `open` / `fixing` ## Session Log _Format:_ `YYYY-MM-DD | step | what changed | result` +- 2026-10-22 | 10.5 | Ticked step 10.5 (was already implemented in prior run): landing page `public/index.html`, `public/leaderboard.html` stub, 404/500 "Return to Emberfall" links, link-checker test; 193/193 tests pass - 2026-10-22 | 10.3 | Made expeditions testable: `expeditionService.js` now uses `time.now()` (via `opts.now ?? time.now()`) and injectable `rng` in `claimExpedition` (via `opts.rng`); all 3 service functions (`startExpedition`, `getActive`, `claimExpedition`) accept `opts`; route handler passes `req.body._opts` to `claimExpedition`; import changed from `{now}` to `const time = require(...)`; 2 new integration tests | 184/184 tests pass - 2026-10-22 | 10.1 | Fixed expedition start energy corruption: transaction params in `startExpedition` were mismatched (DB stored `energy = def.energy_cost` and `energy_updated_at = endsAt`); corrected param order to `(cid, ne, eat, defid, sat, endAt)` matching call `(characterId, newEnergy, updatedAtMs, defId, startedAt, endsAt)`; added 2 DB-level integration tests | 178/178 tests pass - 2026-10-21 | 9.6 | Rewrote README.md: removed AI-agent meta, added real run instructions (install/configure/migrate/seed/start/test), play-through steps, project structure, known issues table, architecture notes | 176/176 tests pass