github-such-software/wownerogue
1
0
Fork 0
mirror of https://github.com/Such-Software/wownerogue.git synced 2026-11-14 02:53:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: resolve security/correctness review + AAA graphics pass

Browse Source 
Backend (Tier 0/1/3): single-payout double-pay -> needs_review; admin-retry tx_hash guard; UNIQUE index on games.payment_id (migration 023) + atomic claim; reconnect no longer resets block-timeout; completeGame keys on user_id+dungeon_seed (not socket_id); token-gated /api/user/:socketId/* endpoints; payout min/max enforcement; orphaned-active-game boot recovery; sessionManager cleanup FK fix; XFF rightmost-hop; global uncaughtException/unhandledRejection guard; server binds 127.0.0.1; provably-fair client-seed (HMAC) + RNG [0,1) bound; difficulty preset ranges reach the digger; chat no longer leaks full socket.id; removed dangerous-keyword SQL theater.

Match mode (Tier 2, still MATCH_ENABLED-gated): fixed match_queue/match_move crash paths + scheduler dead-code + leaked ceiling timer; pot collected before start with abort+refund; BigInt/basis-point fee math, capped payout; no-address winner claimable; winnerId==placement[0]; finalize schema + payout-first isolation; reconnect re-key with ownership; refunds on all cancel paths; real countdown; map/timer cleanup. +16 tests.

Graphics: new overlay FX layer (torch light, vignette, embers, sparkle/burst/flash/shake, self-suspending rAF); gameplay juice; atmospheric screens; CSS design-token chrome with framed modals; richer Kenney tile renderer; imported Kenney dungeon/interior sheets + fx particles.

Verification: 45 suites / 312 tests pass; 40 changed JS files parse; 20 server modules load clean; no regressions.
This commit is contained in:
jwinterm
2026-07-09 17:46:58 -04:00
parent 0f68eec26b
commit a62eefb47b
48 changed files with 3964 additions and 623 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/chatProvider.test.js
+4 -2
View File
@@ -18,7 +18,8 @@ describe('SocketChatProvider', () => {
const broadcast = [];
const history = { saveMessage: (m) => { saved.push(m); return Promise.resolve(); } };
const broadcastManager = {
broadcastChatMessage: (username, text, ts, socketId) => broadcast.push({ username, text, ts, socketId })
// The 4th arg is the sanitized public id (never the raw socket.id — S1 defense in depth).
broadcastChatMessage: (username, text, ts, publicId) => broadcast.push({ username, text, ts, publicId })
};
const provider = new SocketChatProvider({ io, broadcastManager, historyManager: history });
@@ -27,7 +28,8 @@ describe('SocketChatProvider', () => {
expect(saved).toHaveLength(1);
expect(saved[0]).toMatchObject({ socketId: 'sock', username: 'abc123', message: 'hi', userId: 7 });
expect(broadcast).toHaveLength(1);
expect(broadcast[0]).toEqual({ username: 'abc123', text: 'hi', ts: 42, socketId: 'sock' });
// userId is present, so the broadcast is attributed by the public user id ('7'), not the socket id.
expect(broadcast[0]).toEqual({ username: 'abc123', text: 'hi', ts: 42, publicId: '7' });
});
test('global publish falls back to io.emit when no broadcastManager is given', async () => {