step 9.1: done

HANDOFF.md

@@ -4,8 +4,8 @@
 > If this file disagrees with the code, trust the code and fix this file.
 
 ## 1. Where we are
-- **Last completed step:** 8.3 (Public profile UI page) — TICKED in STATUS.md
+- **Last completed step:** 9.1 (Security checklist walk — fixed innerHTML + added rate limiter) — TICKED in STATUS.md
-- **Next step:** Phase 9 — Hardening & Polish (9.1 first)
+- **Next step:** Phase 9 — 9.2 (Add `npm run seed:dev` creating a demo account and hero)
 - **Updated:** 2026-10-21
 - **Was the last session cut off mid-task?** No
 
@@ -19,10 +19,14 @@
 ## 3. What exists now (files that matter)
 - `public/profile.html` — Public hero profile page (reads ?name=, displays stats/equipment).
 - `public/js/profile.js` — Fetches GET /api/heroes/:name, renders profile, handles 404.
-- `src/services/heroProfileService.js` — `getHeroProfile(heroName)`: case-insensitive lookup, returns name/class/level/xp/gold/str/agi/int/vit/kills/deaths/equipment.
+- `public/game.html` — Dashboard with stats panel, tabbed action panel (Hunt/Inventory/Expedition).
-- `src/routes/heroProfile.js` — `GET /api/heroes/:name` (public, no auth).
+- `public/js/game.js` — hunt UI + inventory UI + expedition UI.
+- `public/shop.html` — Dedicated shop page.
+- `public/login.html`, `public/register.html`, `public/create-hero.html` — Auth & hero creation.
+- `src/services/heroProfileService.js` — `getHeroProfile(heroName)`.
+- `src/routes/heroProfile.js` — `GET /api/heroes/:name` (public).
 - `src/services/leaderboardService.js` — `getLeaderboard(type, page, limit)`.
-- `src/routes/leaderboard.js` — `GET /api/leaderboard?type=level|gold|kills&page=1`.
+- `src/routes/leaderboard.js` — `GET /api/leaderboard?type=level|gold|kills`.
 - `src/services/expeditionService.js` — start, getActive, claim, listDefinitions.
 - `src/routes/expeditions.js` — 4 expedition endpoints.
 - `src/services/shopService.js` — getStock, buyItem, sellItem.
@@ -35,21 +39,21 @@
 - `src/game/stats.js` — calcDerived, xpToNext, checkLevelUp.
 - `src/game/energy.js` — computeEnergy.
 - `src/utils/time.js` — now()/setNow()/resetNow().
-- `public/game.html` — dashboard with stats panel, tabbed action panel (Hunt/Inventory/Expedition).
+- `src/app.js` — Express app with helmet, rate limiters (auth + general /api), all routes.
-- `public/js/game.js` — hunt UI + inventory UI + expedition UI.
+- `src/middleware/session.js` — session store, requireAuth.
-- `public/shop.html` — dedicated shop page.
+- `src/config/index.js` — env validation, frozen config.
-- `public/login.html`, `public/register.html`, `public/create-hero.html` — auth & hero creation.
+- `tests/integration/*.test.js` — 87 integration tests across auth, combat, hunt, inventory, shop, expeditions, profile, leaderboard.
-- `tests/integration/profile.test.js` — 5 integration tests.
+- `tests/unit/*.test.js` — 85 unit tests for game logic.
 
 ## 4. Half-finished / fragile things
-- No leaderboard UI yet (Phase 8, but 8.1/8.2 API done — could add UI if desired).
+- No leaderboard UI yet (Phase 8 API done but no UI).
 - HP never regenerates naturally; only level-up restores it.
 - No restart-persistence test for sessions.
 - `npm run seed` script in package.json points to nonexistent `scripts/seed.js`.
 - Equipment bonuses not yet passed into combat (Issue #5 in STATUS.md).
 - Starter gear (GAME_DESIGN.md §Items) documented but not auto-created on character creation.
 - `GET /api/zones` documented in API.md but not implemented (Issue #2).
-- Phase 9 (hardening) not started.
+- Step 9.2 (`npm run seed:dev`) not yet implemented.
 
 ## 5. Decisions & deviations from the docs
 - D-004..D-007 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock).
@@ -61,10 +65,12 @@
 - **D-009:** `sellItem` checks equipped_slot before material type.
 - **D-010:** `startExpedition` checks active-expedition before energy.
 - **D-011:** `computeEnergy` uses `now()` from utils/time.
+- **D-012:** General `/api` rate limiter at 120 req/min per IP (SECURITY.md spec), 1000 in test mode.
+- **D-013:** All `innerHTML` with dynamic data removed from game.js and profile.js — use createElement/textContent.
 
 ## 6. Gotchas learned
 - `npm test` must be `node --test` with NO path/glob; files must be named `*.test.js`.
-- better-sqlite3-session-store ignores `clear:false`; that's why the timer is unref'd.
+- better-sqlite3-session-store ignores `expired.clear: false`; that's why the timer is unref'd.
 - Statement caches are per-DB-handle (WeakMap) in huntService; copy that pattern for new services.
 - Verify test COUNT, not just "all passing".
 - Node.js `fetch` doesn't persist cookies across calls — extract `Set-Cookie` header and pass manually in integration tests.
@@ -77,8 +83,11 @@
 - New characters have NO inventory items (starter gear not auto-created yet).
 - Hero profile endpoint is PUBLIC — no `requireAuth` middleware.
 - Profile page is public: no auth.js guard needed; uses ?name= query param for lookup.
+- Rate limiters in tests: set `NODE_ENV=test` to get 1000 req/window limit; otherwise tests fail with 429.
 
-## 7. Next-step briefing (9.1)
+## 7. Next-step briefing (9.2)
-- **Goal:** Walk the SECURITY.md checklist; fix gaps.
+- **Goal:** Add `npm run seed:dev` script that creates a demo account and hero on an empty DB.
-- **Docs:** SECURITY.md, CODING_STANDARDS.
+- **Docs:** None specific — follow existing patterns (migrate.js, authService, characterService).
-- Phase 9 is hardening & polish — review security, add error pages, loading states, mobile responsive pass, final playable run.
+- Should: run migrations, then insert a test user + character, optionally give starter gear.
+- Should be safe to re-run (check if demo user exists first).
+- Should NOT be used in production (skip if NODE_ENV=production or check for a flag).

STATUS.md

@@ -7,10 +7,10 @@
 > - Keep Session Log entries to one or two lines.
 
 ## Current Focus
-- **Phase:** 8
+- **Phase:** 9
-- **Step:** 8.3
+- **Step:** 9.2
 - **Blocked?** No
-- **Last verified working command:** `npm test` — 167/167 passing (85 unit + 72 integration), 2026-10-21 step 8.2
+- **Last verified working command:** `npm test` — 172/172 passing (85 unit + 87 integration), 2026-10-21 step 9.1
 
 ## Project Health
 | Item | State |
@@ -104,7 +104,9 @@
 - [x] **8.3** Public profile UI page (`public/profile.html` + `public/js/profile.js`).
 
 ## Phase 9 — Hardening & Polish  (docs: SECURITY, UI_GUIDE, TESTING)
-- [ ] **9.1** Walk the SECURITY.md checklist; fix gaps.
+- [x] **9.1** Walk the SECURITY.md checklist; fix gaps.
+  *Acceptance:* all SECURITY.md checklist items verified or fixed.
+  *Fixed:* removed `innerHTML` with dynamic data in `game.js` (renderActiveExpedition) and `profile.js` (renderProfile stats) — converted to createElement/textContent. Added missing general `/api` rate limiter (120/min/IP per SECURITY.md spec).
 - [ ] **9.2** Add `npm run seed:dev` creating a demo account and hero.
 - [ ] **9.3** Global error pages / friendly UI error toasts. Loading states.
 - [ ] **9.4** Mobile-responsive pass (see UI_GUIDE).
@@ -187,3 +189,4 @@ _Format:_ `YYYY-MM-DD | step | what changed | result`
 - 2026-10-20 | 2.3 | Created `src/services/characterService.js`, `src/routes/character.js`; integrated into app.js | app loads
 - 2026-10-20 | 2.4 | Created `public/create-hero.html`, `public/game.html`, `public/js/create-hero.js`, `public/js/game.js` | app loads
 - 2026-10-21 | 8.2 | Created `src/services/heroProfileService.js` (getHeroProfile), `src/routes/heroProfile.js` (GET /api/heroes/:name, public), integrated into app.js; 5 integration tests covering public lookup, case-insensitivity, equipped items, 404, no-auth access | 167/167 tests pass
+- 2026-10-21 | 9.1 | Walked SECURITY.md checklist: fixed `innerHTML` with dynamic data in `game.js` (renderActiveExpedition) and `profile.js` (renderProfile stats) — converted to createElement/textContent; added missing general `/api` rate limiter (120/min/IP per SECURITY.md spec); verified all 9 checklist items pass | 172/172 tests pass

public/js/game.js

@@ -639,38 +639,69 @@ async function loadExpeditions() {
 
 function renderActiveExpedition(statusEl, defsEl, expeditionData) {
   defsEl.innerHTML = '';
+  statusEl.innerHTML = '';
 
   const { expedition, definition, timeRemaining, isFinished } = expeditionData;
   const elapsed = (definition.durationSec * 1000) - timeRemaining;
   const pct = Math.min(100, Math.max(0, (elapsed / (definition.durationSec * 1000)) * 100));
 
-  let html = `<div class="expedition-active-card">`;
+  // Card wrapper
-  html += `<div class="expedition-name">${definition.name}</div>`;
+  const card = document.createElement('div');
-  html += `<div class="expedition-desc">${definition.description}</div>`;
+  card.className = 'expedition-active-card';
+
+  // Name
+  const nameEl = document.createElement('div');
+  nameEl.className = 'expedition-name';
+  nameEl.textContent = definition.name;
+  card.appendChild(nameEl);
+
+  // Description
+  const descEl = document.createElement('div');
+  descEl.className = 'expedition-desc';
+  descEl.textContent = definition.description;
+  card.appendChild(descEl);
 
   // Progress bar
-  html += `<div class="expedition-progress">`;
+  const progressEl = document.createElement('div');
-  html += `<div class="expedition-progress-bar">`;
+  progressEl.className = 'expedition-progress';
-  html += `<div class="expedition-progress-fill" style="width:${pct}%"></div>`;
+
-  html += `</div>`;
+  const barEl = document.createElement('div');
-  html += `<div class="expedition-progress-text">${formatTimeRemaining(timeRemaining)}</div>`;
+  barEl.className = 'expedition-progress-bar';
-  html += `</div>`;
+
+  const fillEl = document.createElement('div');
+  fillEl.className = 'expedition-progress-fill';
+  fillEl.style.width = `${pct}%`;
+
+  barEl.appendChild(fillEl);
+
+  const textEl = document.createElement('div');
+  textEl.className = 'expedition-progress-text';
+  textEl.textContent = formatTimeRemaining(timeRemaining);
+
+  progressEl.appendChild(barEl);
+  progressEl.appendChild(textEl);
+  card.appendChild(progressEl);
 
   if (isFinished) {
-    html += `<button class="btn btn-expedition btn-claim" data-expedition-id="${expedition.id}">Claim Rewards</button>`;
+    const claimBtn = document.createElement('button');
-    html += `<div class="expedition-rewards-preview">Rewards: ${definition.xpReward} XP, ${definition.goldMin}–${definition.goldMax} Gold</div>`;
+    claimBtn.className = 'btn btn-expedition btn-claim';
-  } else {
+    claimBtn.dataset.expeditionId = expedition.id;
-    html += `<div class="expedition-info">Duration: ${formatDuration(definition.durationSec)} · Cost: ${definition.energyCost}⚡</div>`;
+    claimBtn.textContent = 'Claim Rewards';
-  }
-
-  html += `</div>`;
-  statusEl.innerHTML = html;
-
-  // Attach claim handler
-  const claimBtn = statusEl.querySelector('.btn-claim');
-  if (claimBtn) {
     claimBtn.addEventListener('click', handleClaimExpedition);
+    card.appendChild(claimBtn);
+
+    const rewardsEl = document.createElement('div');
+    rewardsEl.className = 'expedition-rewards-preview';
+    rewardsEl.textContent = `Rewards: ${definition.xpReward} XP, ${definition.goldMin}–${definition.goldMax} Gold`;
+    card.appendChild(rewardsEl);
+  } else {
+    const infoEl = document.createElement('div');
+    infoEl.className = 'expedition-info';
+    infoEl.textContent = `Duration: ${formatDuration(definition.durationSec)} · Cost: ${definition.energyCost}⚡`;
+    card.appendChild(infoEl);
   }
+
+  statusEl.appendChild(card);
 }
 
 function renderExpeditionDefs(container) {

public/js/profile.js

@@ -40,10 +40,17 @@ function renderProfile(data) {
   for (const stat of ['str', 'agi', 'int', 'vit']) {
     const row = document.createElement('div');
     row.className = 'profile-stat-row';
-    row.innerHTML = `
+
-      <span class="profile-stat-label">${stat}</span>
+    const label = document.createElement('span');
-      <span class="profile-stat-value">${data[stat]}</span>
+    label.className = 'profile-stat-label';
-    `;
+    label.textContent = stat;
+
+    const value = document.createElement('span');
+    value.className = 'profile-stat-value';
+    value.textContent = data[stat];
+
+    row.appendChild(label);
+    row.appendChild(value);
     statsList.appendChild(row);
   }
 

src/app.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const helmet = require('helmet');
+const rateLimit = require('express-rate-limit');
 const { createSessionMiddleware, requireAuth } = require('./middleware/session');
 const { registerLimiter, loginLimiter, routes: authRoutes } = require('./routes/auth');
 const { routes: characterRoutes } = require('./routes/character');
@@ -13,6 +14,13 @@ const { routes: leaderboardRoutes } = require('./routes/leaderboard');
 const { routes: heroProfileRoutes } = require('./routes/heroProfile');
 const { AppError } = require('./utils/errors');
 
+// General API rate limiter: 120 req/min per IP (SECURITY.md).
+const apiLimiter = rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: process.env.NODE_ENV === 'test' ? 1000 : 120,
+  message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many requests. Try again later.' } },
+});
+
 function createApp() {
   const app = express();
 
@@ -44,6 +52,9 @@ function createApp() {
   app.post('/api/auth/logout', requireAuth, authRoutes.postLogout);
   app.get('/api/auth/me', requireAuth, authRoutes.getMe);
 
+  // General API rate limiter (applies to all non-auth routes below)
+  app.use('/api', apiLimiter);
+
   // Character routes (require session)
   app.post('/api/character', requireAuth, characterRoutes.postCharacter);
   app.get('/api/character', requireAuth, characterRoutes.getCharacter);