github-such-software/wownerogue
1
0
Fork 0
mirror of https://github.com/Such-Software/wownerogue.git synced 2026-10-26 01:28:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: resolve security/correctness review + AAA graphics pass

Browse Source 
Backend (Tier 0/1/3): single-payout double-pay -> needs_review; admin-retry tx_hash guard; UNIQUE index on games.payment_id (migration 023) + atomic claim; reconnect no longer resets block-timeout; completeGame keys on user_id+dungeon_seed (not socket_id); token-gated /api/user/:socketId/* endpoints; payout min/max enforcement; orphaned-active-game boot recovery; sessionManager cleanup FK fix; XFF rightmost-hop; global uncaughtException/unhandledRejection guard; server binds 127.0.0.1; provably-fair client-seed (HMAC) + RNG [0,1) bound; difficulty preset ranges reach the digger; chat no longer leaks full socket.id; removed dangerous-keyword SQL theater.

Match mode (Tier 2, still MATCH_ENABLED-gated): fixed match_queue/match_move crash paths + scheduler dead-code + leaked ceiling timer; pot collected before start with abort+refund; BigInt/basis-point fee math, capped payout; no-address winner claimable; winnerId==placement[0]; finalize schema + payout-first isolation; reconnect re-key with ownership; refunds on all cancel paths; real countdown; map/timer cleanup. +16 tests.

Graphics: new overlay FX layer (torch light, vignette, embers, sparkle/burst/flash/shake, self-suspending rAF); gameplay juice; atmospheric screens; CSS design-token chrome with framed modals; richer Kenney tile renderer; imported Kenney dungeon/interior sheets + fx particles.

Verification: 45 suites / 312 tests pass; 40 changed JS files parse; 20 server modules load clean; no regressions.
This commit is contained in:
jwinterm
2026-07-09 17:46:58 -04:00
parent 0f68eec26b
commit a62eefb47b
48 changed files with 3964 additions and 623 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/security.test.js
+18 -8
View File
@@ -134,12 +134,20 @@ describe('SQL Injection Prevention', () => {
let dbAvailable = false;
beforeAll(async () => {
// Try to connect to real DB for DatabaseManager tests
realDb = new DatabaseManager();
await realDb.initialize();
// Check if connection was successful (initialize doesn't throw, it returns silently)
dbAvailable = realDb.connected === true;
// Only attempt a real DB connection when a usable password is configured. Without one,
// node-postgres throws inside the SASL handshake *after* opening the TCP socket and
// orphans that socket (it survives pool.end()), which would keep Jest from exiting. A
// missing password simply means "DB not available" here — and these tests already fall
// back to mocks in that case.
const hasDbPassword = typeof process.env.DB_PASSWORD === 'string' && process.env.DB_PASSWORD.length > 0;
if (hasDbPassword) {
// Try to connect to real DB for DatabaseManager tests
realDb = new DatabaseManager();
await realDb.initialize();
// Check if connection was successful (initialize doesn't throw, it returns silently)
dbAvailable = realDb.connected === true;
}
if (!dbAvailable) {
console.log('⚠️ Database not available, DatabaseManager tests will use mocks');
}
@@ -164,8 +172,10 @@ describe('SQL Injection Prevention', () => {
if (sessionManager) {
sessionManager.dispose();
}
if (realDb && dbAvailable) {
await realDb.close();
// Always close the pool: initialize() creates it even when the connection fails, so
// gating on dbAvailable would leak the pg pool handle and keep Jest from exiting.
if (realDb) {
try { await realDb.close(); } catch (_) {}
}
});