bepis/Emberfall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

step 9.1: done

Browse Source
This commit is contained in:
bepis
2026-10-21 09:51:00 +11:00
parent 11f7829946
commit aeea0b9aaf
5 changed files with 107 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HANDOFF.md
+26 -17
View File
@@ -4,8 +4,8 @@
> If this file disagrees with the code, trust the code and fix this file.
## 1. Where we are
- **Last completed step:** 8.3 (Public profile UI page) — TICKED in STATUS.md
- **Next step:** Phase 9 — Hardening & Polish (9.1 first)
- **Last completed step:** 9.1 (Security checklist walk — fixed innerHTML + added rate limiter) — TICKED in STATUS.md
- **Next step:** Phase 9 — 9.2 (Add `npm run seed:dev` creating a demo account and hero)
- **Updated:** 2026-10-21
- **Was the last session cut off mid-task?** No
@@ -19,10 +19,14 @@
## 3. What exists now (files that matter)
- `public/profile.html` — Public hero profile page (reads ?name=, displays stats/equipment).
- `public/js/profile.js` — Fetches GET /api/heroes/:name, renders profile, handles 404.
- `src/services/heroProfileService.js` — `getHeroProfile(heroName)`: case-insensitive lookup, returns name/class/level/xp/gold/str/agi/int/vit/kills/deaths/equipment.
- `src/routes/heroProfile.js` — `GET /api/heroes/:name` (public, no auth).
- `public/game.html` — Dashboard with stats panel, tabbed action panel (Hunt/Inventory/Expedition).
- `public/js/game.js` — hunt UI + inventory UI + expedition UI.
- `public/shop.html` — Dedicated shop page.
- `public/login.html`, `public/register.html`, `public/create-hero.html` — Auth & hero creation.
- `src/services/heroProfileService.js` — `getHeroProfile(heroName)`.
- `src/routes/heroProfile.js` — `GET /api/heroes/:name` (public).
- `src/services/leaderboardService.js` — `getLeaderboard(type, page, limit)`.
- `src/routes/leaderboard.js` — `GET /api/leaderboard?type=level|gold|kills&page=1`.
- `src/routes/leaderboard.js` — `GET /api/leaderboard?type=level|gold|kills`.
- `src/services/expeditionService.js` — start, getActive, claim, listDefinitions.
- `src/routes/expeditions.js` — 4 expedition endpoints.
- `src/services/shopService.js` — getStock, buyItem, sellItem.
@@ -35,21 +39,21 @@
- `src/game/stats.js` — calcDerived, xpToNext, checkLevelUp.
- `src/game/energy.js` — computeEnergy.
- `src/utils/time.js` — now()/setNow()/resetNow().
- `public/game.html` — dashboard with stats panel, tabbed action panel (Hunt/Inventory/Expedition).
- `public/js/game.js` — hunt UI + inventory UI + expedition UI.
- `public/shop.html` — dedicated shop page.
- `public/login.html`, `public/register.html`, `public/create-hero.html` — auth & hero creation.
- `tests/integration/profile.test.js` — 5 integration tests.
- `src/app.js` — Express app with helmet, rate limiters (auth + general /api), all routes.
- `src/middleware/session.js` — session store, requireAuth.
- `src/config/index.js` — env validation, frozen config.
- `tests/integration/*.test.js` — 87 integration tests across auth, combat, hunt, inventory, shop, expeditions, profile, leaderboard.
- `tests/unit/*.test.js` — 85 unit tests for game logic.
## 4. Half-finished / fragile things
- No leaderboard UI yet (Phase 8, but 8.1/8.2 API done — could add UI if desired).
- No leaderboard UI yet (Phase 8 API done but no UI).
- HP never regenerates naturally; only level-up restores it.
- No restart-persistence test for sessions.
- `npm run seed` script in package.json points to nonexistent `scripts/seed.js`.
- Equipment bonuses not yet passed into combat (Issue #5 in STATUS.md).
- Starter gear (GAME_DESIGN.md §Items) documented but not auto-created on character creation.
- `GET /api/zones` documented in API.md but not implemented (Issue #2).
- Phase 9 (hardening) not started.
- Step 9.2 (`npm run seed:dev`) not yet implemented.
## 5. Decisions & deviations from the docs
- D-004..D-007 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock).
@@ -61,10 +65,12 @@
- **D-009:** `sellItem` checks equipped_slot before material type.
- **D-010:** `startExpedition` checks active-expedition before energy.
- **D-011:** `computeEnergy` uses `now()` from utils/time.
- **D-012:** General `/api` rate limiter at 120 req/min per IP (SECURITY.md spec), 1000 in test mode.
- **D-013:** All `innerHTML` with dynamic data removed from game.js and profile.js — use createElement/textContent.
## 6. Gotchas learned
- `npm test` must be `node --test` with NO path/glob; files must be named `*.test.js`.
- better-sqlite3-session-store ignores `clear:false`; that's why the timer is unref'd.
- better-sqlite3-session-store ignores `expired.clear: false`; that's why the timer is unref'd.
- Statement caches are per-DB-handle (WeakMap) in huntService; copy that pattern for new services.
- Verify test COUNT, not just "all passing".
- Node.js `fetch` doesn't persist cookies across calls — extract `Set-Cookie` header and pass manually in integration tests.
@@ -77,8 +83,11 @@
- New characters have NO inventory items (starter gear not auto-created yet).
- Hero profile endpoint is PUBLIC — no `requireAuth` middleware.
- Profile page is public: no auth.js guard needed; uses ?name= query param for lookup.
- Rate limiters in tests: set `NODE_ENV=test` to get 1000 req/window limit; otherwise tests fail with 429.
## 7. Next-step briefing (9.1)
- **Goal:** Walk the SECURITY.md checklist; fix gaps.
- **Docs:** SECURITY.md, CODING_STANDARDS.
- Phase 9 is hardening & polish — review security, add error pages, loading states, mobile responsive pass, final playable run.
## 7. Next-step briefing (9.2)
- **Goal:** Add `npm run seed:dev` script that creates a demo account and hero on an empty DB.
- **Docs:** None specific — follow existing patterns (migrate.js, authService, characterService).
- Should: run migrations, then insert a test user + character, optionally give starter gear.
- Should be safe to re-run (check if demo user exists first).
- Should NOT be used in production (skip if NODE_ENV=production or check for a flag).