jwinterm
a62eefb47b
fix: resolve security/correctness review + AAA graphics pass
...
Backend (Tier 0/1/3): single-payout double-pay -> needs_review; admin-retry tx_hash guard; UNIQUE index on games.payment_id (migration 023) + atomic claim; reconnect no longer resets block-timeout; completeGame keys on user_id+dungeon_seed (not socket_id); token-gated /api/user/:socketId/* endpoints; payout min/max enforcement; orphaned-active-game boot recovery; sessionManager cleanup FK fix; XFF rightmost-hop; global uncaughtException/unhandledRejection guard; server binds 127.0.0.1; provably-fair client-seed (HMAC) + RNG [0,1) bound; difficulty preset ranges reach the digger; chat no longer leaks full socket.id; removed dangerous-keyword SQL theater.
Match mode (Tier 2, still MATCH_ENABLED-gated): fixed match_queue/match_move crash paths + scheduler dead-code + leaked ceiling timer; pot collected before start with abort+refund; BigInt/basis-point fee math, capped payout; no-address winner claimable; winnerId==placement[0]; finalize schema + payout-first isolation; reconnect re-key with ownership; refunds on all cancel paths; real countdown; map/timer cleanup. +16 tests.
Graphics: new overlay FX layer (torch light, vignette, embers, sparkle/burst/flash/shake, self-suspending rAF); gameplay juice; atmospheric screens; CSS design-token chrome with framed modals; richer Kenney tile renderer; imported Kenney dungeon/interior sheets + fx particles.
Verification: 45 suites / 312 tests pass; 40 changed JS files parse; 20 server modules load clean; no regressions.
2026-07-09 17:46:58 -04:00
jwinterm
4ee03f24a6
fix: char customizer flakiness + wire real render-mode entitlement gating
...
- Equipment option tiles register for async redraw (were stuck on '...')
- Render mode switching no longer silently mutates avatar identity
- Dungeon renderer falls back to @ tile when overlay draw fails
- Main-game customizer locked to topdown (no confusing render-mode picker)
- equipRedrawers prevents unbounded redraw array growth
- RENDER_MODE_TEST_UNLOCKS flipped to false; ASCII made free (accessible fallback)
- Documented COSMETIC_PRODUCTS in .env.example
- 5 new tests (239 total, 36 suites, all passing)
2026-07-09 06:15:00 -04:00
jwinterm
83020f6c08
polish character customizer render choices
2026-07-06 04:26:00 -04:00
jwinterm
3195386ba1
refactor: resolve avatar visuals through render kit
2026-07-06 03:41:11 -04:00
jwinterm
be780c17e6
feat: use character identity in single player
2026-07-06 03:16:26 -04:00
jwinterm
a664a8bbce
security: escape XSS sinks client-side and add CSP + security headers
...
The client trusted the server to pre-escape chat content and rendered
user-supplied fields via .html()/innerHTML — one server regression away from
stored XSS, and the admin panel injected user-controlled payout addresses
into its authenticated DOM.
- Add a single shared escapeHtml helper (escapes all five HTML-significant
chars including both quotes); leaderboard now delegates to it.
- Escape chat username + message in onChatBroadcast/onChatHistory.
- Escape user-controlled fields in the admin panel (payout address, socket
id, player name, status) and make its local escapeHtml quote-safe so values
in title="..." can't break out.
- Add CSP plus X-Content-Type-Options, X-Frame-Options and Referrer-Policy
headers via middleware. connect-src 'self' keeps Socket.IO working;
removing 'unsafe-inline' (nonces) is tracked as a later cleanup.
Full suite: 13 suites / 119 tests.
2026-05-31 09:40:34 -04:00
jwinterm
a91aed84a5
fix single game payment flow and tests
2026-01-08 15:57:47 -05:00
jwinterm
f18fdf3802
fix awaiting next block before payment addy or payment
2026-01-07 17:07:10 -05:00
jwinterm
aec1c71a8c
add early entry and help screens for new users
2025-12-26 10:21:25 -05:00
jwinterm
24f46fa35e
fix chat and payments and add spectator mode
2025-12-22 10:36:46 -05:00
jwinterm
e3915dcde2
Begin payment logic and tests
2025-09-27 08:45:22 -04:00
jwinterm
4ad063f735
Get back into it
2025-09-24 14:06:42 -04:00
jwinterm
f02e16272e
refactor frontend and fix debug mode
2025-05-29 13:40:44 -04:00
jwinterm