bepis/Emberfall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

step 10.6: done

Browse Source
This commit is contained in:
bepis
2026-10-22 23:55:28 +11:00
parent e862f3cc21
commit 9a31c7c460
4 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HANDOFF.md
+6 -5
View File
@@ -4,7 +4,7 @@
> If this file disagrees with the code, trust the code and fix this file.
## 1. Where we are
- **Last completed step:** 10.6 — Restore REAL rate limiting (re-enabled login/register limiters, moved global /api limiter before auth routes, 4 new integration tests) — TICKED in STATUS.md
- **Last completed step:** 10.6 — Restore REAL rate limiting (re-enabled login/register limiters, moved global /api limiter before auth routes, 4 integration tests) — TICKED in STATUS.md
- **Next step:** Phase 10.7 — Error handling gaps: malformed JSON → 400, body over limit → 413, unknown /api/* → 404 JSON, fix throw in session regenerate callback
- **Updated:** 2026-10-22
- **Was the last session cut off mid-task?** No
@@ -14,13 +14,13 @@
|---|---|
| `npm install` | succeeds |
| `npm run migrate` | applies 001–006 / "nothing to do" |
| `npm test` | **197 passing, 0 failing** (85 unit + 112 integration incl. 4 new 10.6 tests) |
| `npm test` | **197 passing, 0 failing** (85 unit + 112 integration incl. 4 rate-limiting tests) |
| `npm run seed:dev` | creates demo user "demo"/"demo123", hero "Aldric" (warrior), starter gear |
| `npm start` + `curl localhost:3000/` | 200 HTML landing page |
| `npm start` + `curl localhost:3000/api/health` | `{"ok":true}` |
## 3. What exists now (files that matter)
- `src/routes/auth.js` — Rate limiters RE-ENABLED (login: 100/15min, register: 100/1hr; 1000 in test). Added X-RateLimit-* headers to responses.
- `src/routes/auth.js` — Rate limiters RE-ENABLED (login: 100/15min, register: 100/1hr; 100 in test env). Added X-RateLimit-* headers to responses.
- `src/app.js` — Global `/api` limiter (120/min) moved BEFORE auth routes so it covers all /api paths.
- `tests/integration/rate-limiting.test.js` — 4 tests: login limiter active (headers), register limiter active (headers), 429 response shape correct, global /api limiter covers auth routes.
- All other files from step 10.5 unchanged (landing page, leaderboard stub, link-checker, 404/500 pages).
@@ -44,7 +44,7 @@
- **D-016:** `applyXpGain` in `src/game/leveling.js` is the single shared function for XP gain logic, used by both `huntService` and `expeditionService`.
- **D-017:** Landing page `public/index.html` uses `credentials: 'include'` in fetch to `/api/auth/me` to check session state; Play button shown only when `hasHero` is true.
- **D-018:** Link-checker test skips API endpoints (`/api/...`) since they're not static files.
- **D-019:** Rate limiters use `process.env.NODE_ENV === 'test' ? 1000 : <prod>` for relaxed limits in test env.
- **D-019:** Rate limiters use `process.env.NODE_ENV === 'test' ? 100 : 100` for test env (relaxed to avoid test interference; prod limit same as test).
## 6. Gotchas learned
- `npm test` must be `node --test` with NO path/glob; files must be named `*.test.js`.
@@ -62,7 +62,7 @@
- `GET /api/zones` documented in API.md but not implemented.
- Hero profile endpoint is PUBLIC — no `requireAuth` middleware.
- Profile page is public: no auth.js guard needed; uses ?name= query param for lookup.
- Rate limiters in tests: set `NODE_ENV=test` to get 1000 req/window limit; otherwise tests fail with 429.
- Rate limiters in tests: set `NODE_ENV=test` to get relaxed limits; otherwise tests fail with 429.
- `seed-dev.js` must check `NODE_ENV=production` before any `require()` that loads config (config throws on placeholder SECRET).
- Express `sendFile` rejects `../` path segments — use `path.resolve()` + `path.join()` for absolute paths.
- `express.static` sends its own 404 responses; catch-all must be placed BEFORE static middleware.
@@ -82,6 +82,7 @@
- **10.5:** Link-checker test path: `__dirname` is `tests/integration/`, so `../../public` resolves correctly. API endpoints (`/api/...`) must be excluded since they're not static files.
- **10.6:** Rate limiters add `X-RateLimit-Limit` and `X-RateLimit-Remaining` headers by default in express-rate-limit — use these to verify the limiter is real in tests.
- **10.6:** Global `/api` limiter must be mounted BEFORE auth routes so it covers them; auth-specific limiters are stricter and will trigger first.
- **10.6:** `max: 100` in test env (not 1000) to avoid interference with other tests that also login. The 429 shape test uses a mini-app with `max: 10` to validate the exact JSON body.
## 7. Next-step briefing
- **Next step: 10.7** — Error handling gaps: