First commit, phased 1 and 2 created but untested

src/routes/auth.js

@@ -0,0 +1,90 @@
+const rateLimit = require('express-rate-limit');
+const zod = require('zod');
+const { AppError } = require('../utils/errors');
+const { register, verifyLogin } = require('../services/authService');
+
+// Validation schemas
+const registerSchema = zod.strictObject({
+  username: zod.string().min(3).max(20).regex(/^[A-Za-z0-9_]+$/),
+  password: zod.string().min(8).max(72),
+});
+
+const loginSchema = zod.strictObject({
+  username: zod.string().min(1).max(20),
+  password: zod.string().min(1).max(72),
+});
+
+// Rate limiters
+const registerLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000, // 1 hour
+  max: process.env.NODE_ENV === 'test' ? 1000 : 5,
+  message: { error: { code: 'RATE_LIMITED', message: 'Too many registration attempts. Try again later.' } },
+});
+
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: process.env.NODE_ENV === 'test' ? 1000 : 10,
+  message: { error: { code: 'RATE_LIMITED', message: 'Too many login attempts. Try again later.' } },
+});
+
+function wrap(fn) {
+  return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
+}
+
+async function handleRegister(req, res) {
+  const parsed = registerSchema.safeParse(req.body);
+  if (!parsed.success) {
+    throw new AppError('VALIDATION_ERROR', 'Request validation failed.', 400);
+  }
+
+  const { username, password } = parsed.data;
+  const user = await register(username, password);
+
+  // Regenerate session to prevent fixation
+  req.session.regenerate((err) => {
+    if (err) throw new AppError('INTERNAL_ERROR', 'Session regeneration failed.', 500);
+    req.session.userId = user.id;
+    res.status(201).json({ ok: true, data: { user: { id: user.id, username: user.username } } });
+  });
+}
+
+async function handleLogin(req, res) {
+  const parsed = loginSchema.safeParse(req.body);
+  if (!parsed.success) {
+    throw new AppError('VALIDATION_ERROR', 'Request validation failed.', 400);
+  }
+
+  const { username, password } = parsed.data;
+  const user = await verifyLogin(username, password);
+
+  // Regenerate session to prevent fixation
+  req.session.regenerate((err) => {
+    if (err) throw new AppError('INTERNAL_ERROR', 'Session regeneration failed.', 500);
+    req.session.userId = user.id;
+    res.json({ ok: true, data: { user: { id: user.id, username: user.username }, hasHero: false } });
+  });
+}
+
+async function handleLogout(req, res) {
+  req.session.destroy((err) => {
+    if (err) throw new AppError('INTERNAL_ERROR', 'Logout failed.', 500);
+    res.clearCookie('emberfall_session');
+    res.json({ ok: true, data: {} });
+  });
+}
+
+async function handleMe(req, res) {
+  const userId = req.session.userId;
+  res.json({ ok: true, data: { user: { id: userId, username: req.session.username || '' }, hasHero: false } });
+}
+
+module.exports = {
+  registerLimiter,
+  loginLimiter,
+  routes: {
+    postRegister: wrap(handleRegister),
+    postLogin: wrap(handleLogin),
+    postLogout: wrap(handleLogout),
+    getMe: wrap(handleMe),
+  },
+};