bepis/Emberfall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

step 10.6: wip (not ticked)

Browse Source
This commit is contained in:
bepis
2026-10-22 23:31:36 +11:00
parent 3f64ea12cf
commit e862f3cc21
5 changed files with 222 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+5 -4
View File
@@ -7,16 +7,16 @@
> - Keep Session Log entries to one or two lines.
## Current Focus
- **Phase:** 10.6
- **Step:** 10.6 — Restore REAL rate limiting (re-enable login/register limiters, mount global /api limiter before auth routes)
- **Phase:** 10.7
- **Step:** 10.7 — Error handling gaps: malformed JSON → 400, body over limit → 413, unknown /api/* → 404 JSON, fix throw in session regenerate callback
- **Blocked?** No
- **Last verified working command:** `npm test` — 193/193 passing (85 unit + 108 integration incl. 5 new 10.5 tests), 2026-10-22 step 10.5
- **Last verified working command:** `npm test` — 197/197 passing (85 unit + 112 integration incl. 4 new 10.6 tests), 2026-10-22 step 10.6
## Project Health
| Item | State |
|---|---|
| App starts (`npm start`) | ✅ smoke-tested: register → create hero → 12 hunts → level-up (real seeded zones) |
| Tests pass (`npm test`) | ✅ 193/193 (85 unit + 108 integration incl. 5 new 10.5 tests) |
| Tests pass (`npm test`) | ✅ 197/197 (85 unit + 112 integration incl. 4 new 10.6 tests) |
| Migrations run clean on empty DB | ✅ 001_users, 002_characters, 003_content (also seeds zones/monsters/items), 004_inventory, 006_logs (005 reserved for expeditions) |
| Can register + login | ✅ verified by tests |
| Data persists across restart | ⚠️ sessions use the real SQLite store (also in tests); a restart test is still missing |
@@ -232,6 +232,7 @@ Severity: `blocker` / `major` / `minor` / `cosmetic`. Status: `open` / `fixing`
## Session Log
_Format:_ `YYYY-MM-DD | step | what changed | result`
- 2026-10-22 | 10.6 | Re-enabled real rate limiters in `src/routes/auth.js` (login: 100/15min, register: 100/1hr in prod; 1000 in test); moved global `/api` limiter (120/min) BEFORE auth routes in `src/app.js`; added 4 integration tests verifying limiter headers and 429 response shape | 197/197 tests pass
- 2026-10-22 | 10.5 | Ticked step 10.5 (was already implemented in prior run): landing page `public/index.html`, `public/leaderboard.html` stub, 404/500 "Return to Emberfall" links, link-checker test; 193/193 tests pass
- 2026-10-22 | 10.3 | Made expeditions testable: `expeditionService.js` now uses `time.now()` (via `opts.now ?? time.now()`) and injectable `rng` in `claimExpedition` (via `opts.rng`); all 3 service functions (`startExpedition`, `getActive`, `claimExpedition`) accept `opts`; route handler passes `req.body._opts` to `claimExpedition`; import changed from `{now}` to `const time = require(...)`; 2 new integration tests | 184/184 tests pass
- 2026-10-22 | 10.1 | Fixed expedition start energy corruption: transaction params in `startExpedition` were mismatched (DB stored `energy = def.energy_cost` and `energy_updated_at = endsAt`); corrected param order to `(cid, ne, eat, defid, sat, endAt)` matching call `(characterId, newEnergy, updatedAtMs, defId, startedAt, endsAt)`; added 2 DB-level integration tests | 178/178 tests pass