bepis/Emberfall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

step 9.1: done

Browse Source
This commit is contained in:
bepis
2026-10-21 09:51:00 +11:00
parent 11f7829946
commit aeea0b9aaf
5 changed files with 107 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+7 -4
View File
@@ -7,10 +7,10 @@
> - Keep Session Log entries to one or two lines.
## Current Focus
- **Phase:** 8
- **Step:** 8.3
- **Phase:** 9
- **Step:** 9.2
- **Blocked?** No
- **Last verified working command:** `npm test` — 167/167 passing (85 unit + 72 integration), 2026-10-21 step 8.2
- **Last verified working command:** `npm test` — 172/172 passing (85 unit + 87 integration), 2026-10-21 step 9.1
## Project Health
| Item | State |
@@ -104,7 +104,9 @@
- [x] **8.3** Public profile UI page (`public/profile.html` + `public/js/profile.js`).
## Phase 9 — Hardening & Polish (docs: SECURITY, UI_GUIDE, TESTING)
- [ ] **9.1** Walk the SECURITY.md checklist; fix gaps.
- [x] **9.1** Walk the SECURITY.md checklist; fix gaps.
*Acceptance:* all SECURITY.md checklist items verified or fixed.
*Fixed:* removed `innerHTML` with dynamic data in `game.js` (renderActiveExpedition) and `profile.js` (renderProfile stats) — converted to createElement/textContent. Added missing general `/api` rate limiter (120/min/IP per SECURITY.md spec).
- [ ] **9.2** Add `npm run seed:dev` creating a demo account and hero.
- [ ] **9.3** Global error pages / friendly UI error toasts. Loading states.
- [ ] **9.4** Mobile-responsive pass (see UI_GUIDE).
@@ -187,3 +189,4 @@ _Format:_ `YYYY-MM-DD | step | what changed | result`
- 2026-10-20 | 2.3 | Created `src/services/characterService.js`, `src/routes/character.js`; integrated into app.js | app loads
- 2026-10-20 | 2.4 | Created `public/create-hero.html`, `public/game.html`, `public/js/create-hero.js`, `public/js/game.js` | app loads
- 2026-10-21 | 8.2 | Created `src/services/heroProfileService.js` (getHeroProfile), `src/routes/heroProfile.js` (GET /api/heroes/:name, public), integrated into app.js; 5 integration tests covering public lookup, case-insensitivity, equipped items, 404, no-auth access | 167/167 tests pass
- 2026-10-21 | 9.1 | Walked SECURITY.md checklist: fixed `innerHTML` with dynamic data in `game.js` (renderActiveExpedition) and `profile.js` (renderProfile stats) — converted to createElement/textContent; added missing general `/api` rate limiter (120/min/IP per SECURITY.md spec); verified all 9 checklist items pass | 172/172 tests pass