Adds FREE_PLAY_ENABLED to .env.example with the two deployment patterns:
real-money/mainnet = free-to-play + sell credits/entry but NO payouts (paid =
prestige Hall of Champions, not gambling); test/stagenet = full pay-to-play
with payouts. No live config changed.
Random block timing is the core mechanic and is intentionally NOT softened —
early entry is a knowingly-risky bet. The only change is a small configurable
grace (GAME_START_GRACE_MS, default 2000ms, 0 to disable) so a block landing
in the same instant a game starts can't kill the player before the dungeon
even renders or before their first move is possible (100ms move cooldown).
(Replaces an earlier over-reaching "uniform time budget" idea that would have
defeated the random-timing mechanic.)
Socket-event rate limits keyed on socket.id (new on every reconnect) and
passed NO ip argument, so the "IP-limited" prefixes never actually applied —
reconnecting reset every limit, and chat had no IP limit at all.
- New rateLimitContext helper resolves a STABLE identity (anon_token -> id,
falling back to socket id) and the real client IP (X-Forwarded-For honoured
only when TRUST_PROXY=true, else handshake address — no spoofing on direct
exposure).
- game:start, address:set and chat:message now pass (stableId, action, ip);
connection:new uses the real IP. 'chat:' added to IP-limited prefixes.
- Express 'trust proxy' enabled when TRUST_PROXY=true; documented in
.env.example. Aligned the contradictory default limit values with the
production override.
Adds rateLimit.test.js (reconnect can't bypass, IP backstop for fresh
identities, XFF gating). Full suite: 18 suites / 143 tests.
Payout retry system:
- Add migration 007 with retry_count, last_error, last_retry_at columns
- Payouts now retry up to PAYOUT_MAX_RETRIES times before permanent failure
- Each failure logs the attempt number and error message
- Console shows ⚠️ for retryable failures, 💀 for permanent failures
- Added SQL examples in .env.example for querying/resetting failed payouts
HOSTED_BY feature:
- Add HOSTED_BY and HOSTED_BY_NAME env vars
- /api/game-modes endpoint returns hostedBy info
- Footer displays 'Hosted by: <link>' when configured
Also improved .env.example:
- Better documentation for credit packages with reasonable defaults
- Clearer explanation of retry behavior
jwinterm