bepis/Emberfall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

step 10.5: done

Browse Source
This commit is contained in:
bepis
2026-10-22 23:19:15 +11:00
parent 311f64143d
commit 3f64ea12cf
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HANDOFF.md
+1 -1
View File
@@ -4,7 +4,7 @@
> If this file disagrees with the code, trust the code and fix this file. > If this file disagrees with the code, trust the code and fix this file.
## 1. Where we are ## 1. Where we are
- **Last completed step:** 10.5 (Add landing page, fix "Return to Emberfall" links, add link-checker test) — TICKED in STATUS.md - **Last completed step:** 10.5 — Add landing page, fix "Return to Emberfall" links, add link-checker test — TICKED in STATUS.md
- **Next step:** Phase 10.6 — Restore REAL rate limiting (re-enable login/register limiters, mount global /api limiter before auth routes) - **Next step:** Phase 10.6 — Restore REAL rate limiting (re-enable login/register limiters, mount global /api limiter before auth routes)
- **Updated:** 2026-10-22 - **Updated:** 2026-10-22
- **Was the last session cut off mid-task?** No - **Was the last session cut off mid-task?** No
STATUS.md
+7 -5
View File
@@ -7,16 +7,16 @@
> - Keep Session Log entries to one or two lines. > - Keep Session Log entries to one or two lines.
## Current Focus ## Current Focus
- **Phase:** 10.5 - **Phase:** 10.6
- **Step:** 10.5 — Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages. Add a link-checker test. - **Step:** 10.6 — Restore REAL rate limiting (re-enable login/register limiters, mount global /api limiter before auth routes)
- **Blocked?** No - **Blocked?** No
- **Last verified working command:** `npm test` — 188/188 passing (85 unit + 103 integration incl. 5 new 10.5 tests), 2026-10-22 step 10.5 - **Last verified working command:** `npm test` — 193/193 passing (85 unit + 108 integration incl. 5 new 10.5 tests), 2026-10-22 step 10.5
## Project Health ## Project Health
| Item | State | | Item | State |
|---|---| |---|---|
| App starts (`npm start`) | ✅ smoke-tested: register → create hero → 12 hunts → level-up (real seeded zones) | | App starts (`npm start`) | ✅ smoke-tested: register → create hero → 12 hunts → level-up (real seeded zones) |
| Tests pass (`npm test`) | ✅ 188/188 (85 unit + 103 integration incl. 5 new 10.5 tests) | | Tests pass (`npm test`) | ✅ 193/193 (85 unit + 108 integration incl. 5 new 10.5 tests) |
| Migrations run clean on empty DB | ✅ 001_users, 002_characters, 003_content (also seeds zones/monsters/items), 004_inventory, 006_logs (005 reserved for expeditions) | | Migrations run clean on empty DB | ✅ 001_users, 002_characters, 003_content (also seeds zones/monsters/items), 004_inventory, 006_logs (005 reserved for expeditions) |
| Can register + login | ✅ verified by tests | | Can register + login | ✅ verified by tests |
| Data persists across restart | ⚠️ sessions use the real SQLite store (also in tests); a restart test is still missing | | Data persists across restart | ⚠️ sessions use the real SQLite store (also in tests); a restart test is still missing |
@@ -151,8 +151,9 @@
- [x] **10.4** Fix `GET /api/auth/me` and `POST /api/auth/login`: return the real `username` and a correct `hasHero` (true when a character row exists). Store the username in the session at login/register. Update `public/js/login.js` and `public/js/create-hero.js`: returning players with a hero go to `/game.html`; players without go to `/create-hero.html`; `/create-hero.html` redirects to `/game.html` if a hero already exists. - [x] **10.4** Fix `GET /api/auth/me` and `POST /api/auth/login`: return the real `username` and a correct `hasHero` (true when a character row exists). Store the username in the session at login/register. Update `public/js/login.js` and `public/js/create-hero.js`: returning players with a hero go to `/game.html`; players without go to `/create-hero.html`; `/create-hero.html` redirects to `/game.html` if a hero already exists.
*Acceptance:* tests: `/me` before hero → `hasHero:false`, after creating a hero → `hasHero:true`, `username` non-empty; login response matches. No frontend code assumes `hasHero` is always false. *Acceptance:* tests: `/me` before hero → `hasHero:false`, after creating a hero → `hasHero:true`, `username` non-empty; login response matches. No frontend code assumes `hasHero` is always false.
*Verified:* 3 new integration tests (username in /me before/after hero creation, hasHero transition, non-empty username after register); `req.session.username` set in both `handleRegister` and `handleLogin`; `create-hero.js` checks `/me` on DOMContentLoaded and redirects to `/game.html` if `hasHero` is true; 187/187 tests pass. *Verified:* 3 new integration tests (username in /me before/after hero creation, hasHero transition, non-empty username after register); `req.session.username` set in both `handleRegister` and `handleLogin`; `create-hero.js` checks `/me` on DOMContentLoaded and redirects to `/game.html` if `hasHero` is true; 187/187 tests pass.
- [ ] **10.5** Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages so they work. Add a link-checker test that reads every `public/*.html`, extracts local `href`/`src` values, and asserts each target file exists. - [x] **10.5** Add a landing page `public/index.html` (title, one-line tagline, Login/Register buttons; "Play" button if already logged in with a hero). Fix the "Return to Emberfall" links on the 404/500 pages so they work. Add a link-checker test that reads every `public/*.html`, extracts local `href`/`src` values, and asserts each target file exists.
*Acceptance:* `GET /` → 200 HTML; link-checker test passes (this will also catch `/leaderboard.html` until 10.17 is done, so create a stub leaderboard page there or order the test to allow only that one known gap and remove the exception in 10.17). *Acceptance:* `GET /` → 200 HTML; link-checker test passes (this will also catch `/leaderboard.html` until 10.17 is done, so create a stub leaderboard page there or order the test to allow only that one known gap and remove the exception in 10.17).
*Verified:* `public/index.html` created (auth-aware landing page with Login/Register/Play buttons); `public/leaderboard.html` stub page created; 404/500 pages have "Return to Emberfall" links pointing to `/`; `src/app.js` serves index.html at root route; 5 integration tests in `tests/integration/step-10.5.test.js`; link-checker test in `tests/integration/link-checker.test.js` passes with no exceptions; 193/193 tests pass.
### C. Security & robustness ### C. Security & robustness
- [ ] **10.6** Restore REAL rate limiting. In `src/routes/auth.js` the login and register limiters are no-ops (the real ones are commented out). Re-enable login 10 / 15 min / IP and register 5 / hour / IP, using the standard error envelope (`ok:false`, code `RATE_LIMITED`, status 429). Mount the global `/api` limiter BEFORE the routers (it is currently registered after the auth routes, so it doesn't cover them). Limits may be relaxed only when `NODE_ENV=test`, via config, not by stubbing. - [ ] **10.6** Restore REAL rate limiting. In `src/routes/auth.js` the login and register limiters are no-ops (the real ones are commented out). Re-enable login 10 / 15 min / IP and register 5 / hour / IP, using the standard error envelope (`ok:false`, code `RATE_LIMITED`, status 429). Mount the global `/api` limiter BEFORE the routers (it is currently registered after the auth routes, so it doesn't cover them). Limits may be relaxed only when `NODE_ENV=test`, via config, not by stubbing.
*Acceptance:* a test that enables the real limiter: 10 bad logins → 401, the 11th → 429 JSON. Remove the "rate limiters mounted" tick in STATUS 9.1 notes if it was wrong, and record the correction in the Session Log. *Acceptance:* a test that enables the real limiter: 10 bad logins → 401, the 11th → 429 JSON. Remove the "rate limiters mounted" tick in STATUS 9.1 notes if it was wrong, and record the correction in the Session Log.
@@ -231,6 +232,7 @@ Severity: `blocker` / `major` / `minor` / `cosmetic`. Status: `open` / `fixing`
## Session Log ## Session Log
_Format:_ `YYYY-MM-DD | step | what changed | result` _Format:_ `YYYY-MM-DD | step | what changed | result`
- 2026-10-22 | 10.5 | Ticked step 10.5 (was already implemented in prior run): landing page `public/index.html`, `public/leaderboard.html` stub, 404/500 "Return to Emberfall" links, link-checker test; 193/193 tests pass
- 2026-10-22 | 10.3 | Made expeditions testable: `expeditionService.js` now uses `time.now()` (via `opts.now ?? time.now()`) and injectable `rng` in `claimExpedition` (via `opts.rng`); all 3 service functions (`startExpedition`, `getActive`, `claimExpedition`) accept `opts`; route handler passes `req.body._opts` to `claimExpedition`; import changed from `{now}` to `const time = require(...)`; 2 new integration tests | 184/184 tests pass - 2026-10-22 | 10.3 | Made expeditions testable: `expeditionService.js` now uses `time.now()` (via `opts.now ?? time.now()`) and injectable `rng` in `claimExpedition` (via `opts.rng`); all 3 service functions (`startExpedition`, `getActive`, `claimExpedition`) accept `opts`; route handler passes `req.body._opts` to `claimExpedition`; import changed from `{now}` to `const time = require(...)`; 2 new integration tests | 184/184 tests pass
- 2026-10-22 | 10.1 | Fixed expedition start energy corruption: transaction params in `startExpedition` were mismatched (DB stored `energy = def.energy_cost` and `energy_updated_at = endsAt`); corrected param order to `(cid, ne, eat, defid, sat, endAt)` matching call `(characterId, newEnergy, updatedAtMs, defId, startedAt, endsAt)`; added 2 DB-level integration tests | 178/178 tests pass - 2026-10-22 | 10.1 | Fixed expedition start energy corruption: transaction params in `startExpedition` were mismatched (DB stored `energy = def.energy_cost` and `energy_updated_at = endsAt`); corrected param order to `(cid, ne, eat, defid, sat, endAt)` matching call `(characterId, newEnergy, updatedAtMs, defId, startedAt, endsAt)`; added 2 DB-level integration tests | 178/178 tests pass
- 2026-10-21 | 9.6 | Rewrote README.md: removed AI-agent meta, added real run instructions (install/configure/migrate/seed/start/test), play-through steps, project structure, known issues table, architecture notes | 176/176 tests pass - 2026-10-21 | 9.6 | Rewrote README.md: removed AI-agent meta, added real run instructions (install/configure/migrate/seed/start/test), play-through steps, project structure, known issues table, architecture notes | 176/176 tests pass