jwinterm 448cb2f528 fix: reconnect-proof rate limiting (stable id + real client IP) ...

Socket-event rate limits keyed on socket.id (new on every reconnect) and
passed NO ip argument, so the "IP-limited" prefixes never actually applied —
reconnecting reset every limit, and chat had no IP limit at all.

- New rateLimitContext helper resolves a STABLE identity (anon_token -> id,
  falling back to socket id) and the real client IP (X-Forwarded-For honoured
  only when TRUST_PROXY=true, else handshake address — no spoofing on direct
  exposure).
- game:start, address:set and chat:message now pass (stableId, action, ip);
  connection:new uses the real IP. 'chat:' added to IP-limited prefixes.
- Express 'trust proxy' enabled when TRUST_PROXY=true; documented in
  .env.example. Aligned the contradictory default limit values with the
  production override.

Adds rateLimit.test.js (reconnect can't bypass, IP backstop for fresh
identities, XFF gating). Full suite: 18 suites / 143 tests.

2026-05-31 10:21:28 -04:00

..

DEPLOY.md

feat: initial batch payout logic and output splitting script added

2026-02-18 07:30:46 -05:00

INTEGRATION.md

fix stale smirk and amount bug

2026-03-01 13:56:35 -05:00

LOGS_AND_BACKUP.md

feat: admin dashboard, alert service, and docs reorganization

2026-01-31 20:21:28 -05:00

REMEDIATION_PLAN.md

fix: reconnect-proof rate limiting (stable id + real client IP)

2026-05-31 10:21:28 -04:00

TODO.md

add smirk payments and leaderboard and diff tuning

2026-02-20 13:54:36 -05:00