diff --git a/HANDOFF.md b/HANDOFF.md index 2f7accd..607844a 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -4,8 +4,8 @@ > If this file disagrees with the code, trust the code and fix this file. ## 1. Where we are -- **Last completed step:** 8.3 (Public profile UI page) — TICKED in STATUS.md -- **Next step:** Phase 9 — Hardening & Polish (9.1 first) +- **Last completed step:** 9.1 (Security checklist walk — fixed innerHTML + added rate limiter) — TICKED in STATUS.md +- **Next step:** Phase 9 — 9.2 (Add `npm run seed:dev` creating a demo account and hero) - **Updated:** 2026-10-21 - **Was the last session cut off mid-task?** No @@ -19,10 +19,14 @@ ## 3. What exists now (files that matter) - `public/profile.html` — Public hero profile page (reads ?name=, displays stats/equipment). - `public/js/profile.js` — Fetches GET /api/heroes/:name, renders profile, handles 404. -- `src/services/heroProfileService.js` — `getHeroProfile(heroName)`: case-insensitive lookup, returns name/class/level/xp/gold/str/agi/int/vit/kills/deaths/equipment. -- `src/routes/heroProfile.js` — `GET /api/heroes/:name` (public, no auth). +- `public/game.html` — Dashboard with stats panel, tabbed action panel (Hunt/Inventory/Expedition). +- `public/js/game.js` — hunt UI + inventory UI + expedition UI. +- `public/shop.html` — Dedicated shop page. +- `public/login.html`, `public/register.html`, `public/create-hero.html` — Auth & hero creation. +- `src/services/heroProfileService.js` — `getHeroProfile(heroName)`. +- `src/routes/heroProfile.js` — `GET /api/heroes/:name` (public). - `src/services/leaderboardService.js` — `getLeaderboard(type, page, limit)`. -- `src/routes/leaderboard.js` — `GET /api/leaderboard?type=level|gold|kills&page=1`. +- `src/routes/leaderboard.js` — `GET /api/leaderboard?type=level|gold|kills`. - `src/services/expeditionService.js` — start, getActive, claim, listDefinitions. - `src/routes/expeditions.js` — 4 expedition endpoints. - `src/services/shopService.js` — getStock, buyItem, sellItem. @@ -35,21 +39,21 @@ - `src/game/stats.js` — calcDerived, xpToNext, checkLevelUp. - `src/game/energy.js` — computeEnergy. - `src/utils/time.js` — now()/setNow()/resetNow(). -- `public/game.html` — dashboard with stats panel, tabbed action panel (Hunt/Inventory/Expedition). -- `public/js/game.js` — hunt UI + inventory UI + expedition UI. -- `public/shop.html` — dedicated shop page. -- `public/login.html`, `public/register.html`, `public/create-hero.html` — auth & hero creation. -- `tests/integration/profile.test.js` — 5 integration tests. +- `src/app.js` — Express app with helmet, rate limiters (auth + general /api), all routes. +- `src/middleware/session.js` — session store, requireAuth. +- `src/config/index.js` — env validation, frozen config. +- `tests/integration/*.test.js` — 87 integration tests across auth, combat, hunt, inventory, shop, expeditions, profile, leaderboard. +- `tests/unit/*.test.js` — 85 unit tests for game logic. ## 4. Half-finished / fragile things -- No leaderboard UI yet (Phase 8, but 8.1/8.2 API done — could add UI if desired). +- No leaderboard UI yet (Phase 8 API done but no UI). - HP never regenerates naturally; only level-up restores it. - No restart-persistence test for sessions. - `npm run seed` script in package.json points to nonexistent `scripts/seed.js`. - Equipment bonuses not yet passed into combat (Issue #5 in STATUS.md). - Starter gear (GAME_DESIGN.md §Items) documented but not auto-created on character creation. - `GET /api/zones` documented in API.md but not implemented (Issue #2). -- Phase 9 (hardening) not started. +- Step 9.2 (`npm run seed:dev`) not yet implemented. ## 5. Decisions & deviations from the docs - D-004..D-007 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock). @@ -61,10 +65,12 @@ - **D-009:** `sellItem` checks equipped_slot before material type. - **D-010:** `startExpedition` checks active-expedition before energy. - **D-011:** `computeEnergy` uses `now()` from utils/time. +- **D-012:** General `/api` rate limiter at 120 req/min per IP (SECURITY.md spec), 1000 in test mode. +- **D-013:** All `innerHTML` with dynamic data removed from game.js and profile.js — use createElement/textContent. ## 6. Gotchas learned - `npm test` must be `node --test` with NO path/glob; files must be named `*.test.js`. -- better-sqlite3-session-store ignores `clear:false`; that's why the timer is unref'd. +- better-sqlite3-session-store ignores `expired.clear: false`; that's why the timer is unref'd. - Statement caches are per-DB-handle (WeakMap) in huntService; copy that pattern for new services. - Verify test COUNT, not just "all passing". - Node.js `fetch` doesn't persist cookies across calls — extract `Set-Cookie` header and pass manually in integration tests. @@ -77,8 +83,11 @@ - New characters have NO inventory items (starter gear not auto-created yet). - Hero profile endpoint is PUBLIC — no `requireAuth` middleware. - Profile page is public: no auth.js guard needed; uses ?name= query param for lookup. +- Rate limiters in tests: set `NODE_ENV=test` to get 1000 req/window limit; otherwise tests fail with 429. -## 7. Next-step briefing (9.1) -- **Goal:** Walk the SECURITY.md checklist; fix gaps. -- **Docs:** SECURITY.md, CODING_STANDARDS. -- Phase 9 is hardening & polish — review security, add error pages, loading states, mobile responsive pass, final playable run. +## 7. Next-step briefing (9.2) +- **Goal:** Add `npm run seed:dev` script that creates a demo account and hero on an empty DB. +- **Docs:** None specific — follow existing patterns (migrate.js, authService, characterService). +- Should: run migrations, then insert a test user + character, optionally give starter gear. +- Should be safe to re-run (check if demo user exists first). +- Should NOT be used in production (skip if NODE_ENV=production or check for a flag). diff --git a/STATUS.md b/STATUS.md index 6830edc..1f83e41 100644 --- a/STATUS.md +++ b/STATUS.md @@ -7,10 +7,10 @@ > - Keep Session Log entries to one or two lines. ## Current Focus -- **Phase:** 8 -- **Step:** 8.3 +- **Phase:** 9 +- **Step:** 9.2 - **Blocked?** No -- **Last verified working command:** `npm test` — 167/167 passing (85 unit + 72 integration), 2026-10-21 step 8.2 +- **Last verified working command:** `npm test` — 172/172 passing (85 unit + 87 integration), 2026-10-21 step 9.1 ## Project Health | Item | State | @@ -104,7 +104,9 @@ - [x] **8.3** Public profile UI page (`public/profile.html` + `public/js/profile.js`). ## Phase 9 — Hardening & Polish (docs: SECURITY, UI_GUIDE, TESTING) -- [ ] **9.1** Walk the SECURITY.md checklist; fix gaps. +- [x] **9.1** Walk the SECURITY.md checklist; fix gaps. + *Acceptance:* all SECURITY.md checklist items verified or fixed. + *Fixed:* removed `innerHTML` with dynamic data in `game.js` (renderActiveExpedition) and `profile.js` (renderProfile stats) — converted to createElement/textContent. Added missing general `/api` rate limiter (120/min/IP per SECURITY.md spec). - [ ] **9.2** Add `npm run seed:dev` creating a demo account and hero. - [ ] **9.3** Global error pages / friendly UI error toasts. Loading states. - [ ] **9.4** Mobile-responsive pass (see UI_GUIDE). @@ -187,3 +189,4 @@ _Format:_ `YYYY-MM-DD | step | what changed | result` - 2026-10-20 | 2.3 | Created `src/services/characterService.js`, `src/routes/character.js`; integrated into app.js | app loads - 2026-10-20 | 2.4 | Created `public/create-hero.html`, `public/game.html`, `public/js/create-hero.js`, `public/js/game.js` | app loads - 2026-10-21 | 8.2 | Created `src/services/heroProfileService.js` (getHeroProfile), `src/routes/heroProfile.js` (GET /api/heroes/:name, public), integrated into app.js; 5 integration tests covering public lookup, case-insensitivity, equipped items, 404, no-auth access | 167/167 tests pass +- 2026-10-21 | 9.1 | Walked SECURITY.md checklist: fixed `innerHTML` with dynamic data in `game.js` (renderActiveExpedition) and `profile.js` (renderProfile stats) — converted to createElement/textContent; added missing general `/api` rate limiter (120/min/IP per SECURITY.md spec); verified all 9 checklist items pass | 172/172 tests pass diff --git a/public/js/game.js b/public/js/game.js index ac01170..92a3832 100644 --- a/public/js/game.js +++ b/public/js/game.js @@ -639,38 +639,69 @@ async function loadExpeditions() { function renderActiveExpedition(statusEl, defsEl, expeditionData) { defsEl.innerHTML = ''; + statusEl.innerHTML = ''; const { expedition, definition, timeRemaining, isFinished } = expeditionData; const elapsed = (definition.durationSec * 1000) - timeRemaining; const pct = Math.min(100, Math.max(0, (elapsed / (definition.durationSec * 1000)) * 100)); - let html = `
`; - html += `
${definition.name}
`; - html += `
${definition.description}
`; + // Card wrapper + const card = document.createElement('div'); + card.className = 'expedition-active-card'; + + // Name + const nameEl = document.createElement('div'); + nameEl.className = 'expedition-name'; + nameEl.textContent = definition.name; + card.appendChild(nameEl); + + // Description + const descEl = document.createElement('div'); + descEl.className = 'expedition-desc'; + descEl.textContent = definition.description; + card.appendChild(descEl); // Progress bar - html += `
`; - html += `
`; - html += `
`; - html += `
`; - html += `
${formatTimeRemaining(timeRemaining)}
`; - html += `
`; + const progressEl = document.createElement('div'); + progressEl.className = 'expedition-progress'; + + const barEl = document.createElement('div'); + barEl.className = 'expedition-progress-bar'; + + const fillEl = document.createElement('div'); + fillEl.className = 'expedition-progress-fill'; + fillEl.style.width = `${pct}%`; + + barEl.appendChild(fillEl); + + const textEl = document.createElement('div'); + textEl.className = 'expedition-progress-text'; + textEl.textContent = formatTimeRemaining(timeRemaining); + + progressEl.appendChild(barEl); + progressEl.appendChild(textEl); + card.appendChild(progressEl); if (isFinished) { - html += ``; - html += `
Rewards: ${definition.xpReward} XP, ${definition.goldMin}–${definition.goldMax} Gold
`; - } else { - html += `
Duration: ${formatDuration(definition.durationSec)} · Cost: ${definition.energyCost}⚡
`; - } - - html += `
`; - statusEl.innerHTML = html; - - // Attach claim handler - const claimBtn = statusEl.querySelector('.btn-claim'); - if (claimBtn) { + const claimBtn = document.createElement('button'); + claimBtn.className = 'btn btn-expedition btn-claim'; + claimBtn.dataset.expeditionId = expedition.id; + claimBtn.textContent = 'Claim Rewards'; claimBtn.addEventListener('click', handleClaimExpedition); + card.appendChild(claimBtn); + + const rewardsEl = document.createElement('div'); + rewardsEl.className = 'expedition-rewards-preview'; + rewardsEl.textContent = `Rewards: ${definition.xpReward} XP, ${definition.goldMin}–${definition.goldMax} Gold`; + card.appendChild(rewardsEl); + } else { + const infoEl = document.createElement('div'); + infoEl.className = 'expedition-info'; + infoEl.textContent = `Duration: ${formatDuration(definition.durationSec)} · Cost: ${definition.energyCost}⚡`; + card.appendChild(infoEl); } + + statusEl.appendChild(card); } function renderExpeditionDefs(container) { diff --git a/public/js/profile.js b/public/js/profile.js index 02be6c5..26fc046 100644 --- a/public/js/profile.js +++ b/public/js/profile.js @@ -40,10 +40,17 @@ function renderProfile(data) { for (const stat of ['str', 'agi', 'int', 'vit']) { const row = document.createElement('div'); row.className = 'profile-stat-row'; - row.innerHTML = ` - ${stat} - ${data[stat]} - `; + + const label = document.createElement('span'); + label.className = 'profile-stat-label'; + label.textContent = stat; + + const value = document.createElement('span'); + value.className = 'profile-stat-value'; + value.textContent = data[stat]; + + row.appendChild(label); + row.appendChild(value); statsList.appendChild(row); } diff --git a/src/app.js b/src/app.js index 671490c..ca12d56 100644 --- a/src/app.js +++ b/src/app.js @@ -1,5 +1,6 @@ const express = require('express'); const helmet = require('helmet'); +const rateLimit = require('express-rate-limit'); const { createSessionMiddleware, requireAuth } = require('./middleware/session'); const { registerLimiter, loginLimiter, routes: authRoutes } = require('./routes/auth'); const { routes: characterRoutes } = require('./routes/character'); @@ -13,6 +14,13 @@ const { routes: leaderboardRoutes } = require('./routes/leaderboard'); const { routes: heroProfileRoutes } = require('./routes/heroProfile'); const { AppError } = require('./utils/errors'); +// General API rate limiter: 120 req/min per IP (SECURITY.md). +const apiLimiter = rateLimit({ + windowMs: 60 * 1000, // 1 minute + max: process.env.NODE_ENV === 'test' ? 1000 : 120, + message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many requests. Try again later.' } }, +}); + function createApp() { const app = express(); @@ -44,6 +52,9 @@ function createApp() { app.post('/api/auth/logout', requireAuth, authRoutes.postLogout); app.get('/api/auth/me', requireAuth, authRoutes.getMe); + // General API rate limiter (applies to all non-auth routes below) + app.use('/api', apiLimiter); + // Character routes (require session) app.post('/api/character', requireAuth, characterRoutes.postCharacter); app.get('/api/character', requireAuth, characterRoutes.getCharacter);