step 10.16: done

STATUS.md

@@ -8,15 +8,15 @@
 
 ## Current Focus
 - **Phase:** 10
-- **Step:** 10.16 — (next)
+- **Step:** 10.17 — (next)
 - **Blocked?** No
-- **Last verified working command:** `npm test` — 264/264 passing (97 unit + 167 integration incl. 4 non-stackable buy tests), 2026-10-23 step 10.15
+- **Last verified working command:** `npm test` — 273/273 passing (97 unit + 176 integration incl. 9 public leaderboard/profile tests), 2026-10-23 step 10.16
 
 ## Project Health
 | Item | State |
 |---|---|
 | App starts (`npm start`) | ✅ smoke-tested: register → create hero → 12 hunts → level-up (real seeded zones) |
-| Tests pass (`npm test`) | ✅ 260/260 (97 unit + 163 integration incl. 7 material sell price tests) |
+| Tests pass (`npm test`) | ✅ 273/273 (97 unit + 176 integration incl. 9 public leaderboard/profile tests) |
 | Migrations run clean on empty DB | ✅ 001_users, 002_characters, 003_content (also seeds zones/monsters/items), 004_inventory, 006_logs (005 reserved for expeditions) |
 | Can register + login | ✅ verified by tests |
 | Data persists across restart | ⚠️ sessions use the real SQLite store (also in tests); a restart test is still missing |
@@ -188,7 +188,9 @@
   *Acceptance:* tests: buy 3 swords → 3 rows, quantity 1 each; equip one, sell one → remaining state correct; buy 5 potions → one row, quantity 5.
   *Verified:* extracted shared `grantItem()` to `src/game/inventory.js` (used by both `huntService` and `shopService`); added matching statement names (`stackRow`, `addToStack`, `insertInv`) to shopService stmtCache; 4 new integration tests (3 swords → 4 rows with starter, 2+2 swords → 5 rows, stackable potions merge, 2 armor → 2 rows); 264/264 tests pass.
 ### F. Public pages
-- [ ] **10.16** Make `GET /api/leaderboard` and `GET /api/heroes/:name` public (no login), as in API.md, and keep returning only public fields. Keep the `type` allowlist; reject bad `page` values (non-integer, < 1, absurdly large) with 400.
+- [x] **10.16** Make `GET /api/leaderboard` and `GET /api/heroes/:name` public (no login), as in API.md, and keep returning only public fields. Keep the `type` allowlist; reject bad `page` values (non-integer, < 1, absurdly large) with 400.
+  *Acceptance:* anonymous request → 200; response contains no user id/username/password; SQL injection in `type` → 400; `page=-1` and `page=abc` → 400.
+  *Verified:* `requireAuth` removed from leaderboard route in `src/app.js`; hero profile was already public; 9 new integration tests (3 leaderboard anonymous access, 1 no-private-fields, 3 validation: SQL injection/page=-1/page=abc, 2 hero profile anonymous access); updated existing leaderboard test "rejects request without authentication" → "is accessible without authentication" (expects 200); 273/273 tests pass.
   *Acceptance:* tests: anonymous request → 200; response contains no user id / username / password fields; `type=gold;DROP TABLE users` → 400; `page=-1` and `page=abc` → 400.
 - [ ] **10.17** Build `public/leaderboard.html` + `public/js/leaderboard.js`: tabs Level / Gold / Kills, rank, hero name (linking to `profile.html?name=...`), class, value; `textContent` only. Add nav links (Game, Shop, Leaderboard, Logout) to the header of every logged-in page. Remove any temporary link-checker exception from 10.5.
   *Acceptance:* link-checker test passes with no exceptions; the leaderboard page works logged-out and logged-in.
@@ -237,12 +239,12 @@ Severity: `blocker` / `major` / `minor` / `cosmetic`. Status: `open` / `fixing`
 ## Test Summary
 | Suite | Passing | Failing | Last run |
 |---|---|---|---|
-| unit | 97 | 0 | 2026-10-23 step 10.15 |
-| integration | 167 | 0 | 2026-10-23 step 10.15 (4 non-stackable buy tests) |
+| unit | 97 | 0 | 2026-10-23 step 10.16 |
+| integration | 176 | 0 | 2026-10-23 step 10.16 (9 public leaderboard/profile tests) |
 
 ## Session Log
 _Format:_ `YYYY-MM-DD | step | what changed | result`
-- 2026-10-23 | 10.15 | Extracted shared `grantItem()` to `src/game/inventory.js` (used by huntService + shopService); updated shopService buyItem to use grantItem instead of inline stack logic; added matching statement names to shopService stmtCache; 4 new integration tests for non-stackable buy | 264/264 tests pass
+- 2026-10-23 | 10.16 | Removed `requireAuth` from `GET /api/leaderboard` in `src/app.js` (now public); hero profile was already public; updated existing "rejects request without authentication" → "is accessible without authentication" in leaderboard.test.js; 9 new integration tests (anonymous access, no-private-fields, validation: SQL injection/page=-1/page=abc, hero profile anonymous) | 273/273 tests pass
 - 2026-10-23 | 10.14 | Material sell prices now use item-level formula: `materialSellPrice(rarity, itemMinLevel)` in `shopService.js` replaces old `defaultRate * heroLevel / itemMinLevel`; BALANCE.md table corrected (Drake Scale 90g→112g, Wolf Pelt 5g→4g, Spider Silk 12g→20g, Imp Horn 30g→40g); fix for sell exhausting row (CHECK constraint `quantity >= 1` prevented decrement to 0 — now deletes row when sale qty equals row qty); 7 new integration tests; existing shop tests updated to item-level prices | 260/260 tests pass
 - 2026-10-23 | 10.8 | Added `POST /api/character/allocate` endpoint: zod `.strictObject` with optional stat fields + `.refine` requiring at least one; service in `characterService.js` validates input, uses `allocatePoints` from `leveling.js`, computes `remainingPoints = character.unspent_points - total`, updates in transaction; 12 new integration tests (6 HTTP + 6 direct service) | 214/214 tests pass
 - 2026-10-22 | 10.6 | Re-enabled real rate limiters in `src/routes/auth.js` (login: 100/15min, register: 100/1hr in prod; 1000 in test); moved global `/api` limiter (120/min) BEFORE auth routes in `src/app.js`; added 4 integration tests verifying limiter headers and 429 response shape | 197/197 tests pass