jwinterm 448cb2f528 fix: reconnect-proof rate limiting (stable id + real client IP) ...

Socket-event rate limits keyed on socket.id (new on every reconnect) and
passed NO ip argument, so the "IP-limited" prefixes never actually applied —
reconnecting reset every limit, and chat had no IP limit at all.

- New rateLimitContext helper resolves a STABLE identity (anon_token -> id,
  falling back to socket id) and the real client IP (X-Forwarded-For honoured
  only when TRUST_PROXY=true, else handshake address — no spoofing on direct
  exposure).
- game:start, address:set and chat:message now pass (stableId, action, ip);
  connection:new uses the real IP. 'chat:' added to IP-limited prefixes.
- Express 'trust proxy' enabled when TRUST_PROXY=true; documented in
  .env.example. Aligned the contradictory default limit values with the
  production override.

Adds rateLimit.test.js (reconnect can't bypass, IP backstop for fresh
identities, XFF gating). Full suite: 18 suites / 143 tests.

2026-05-31 10:21:28 -04:00

..

addressManager.test.js

add address modal and try to fix payout

2025-09-29 17:40:59 -04:00

batchPayout.test.js

security: fix batch-payout tx_hash collision and double-pay risk

2026-05-31 09:26:14 -04:00

debug_client_lighting.html

lighting works!

2025-05-26 13:45:46 -04:00

debug_game_updates.html

lighting works!

2025-05-26 13:45:46 -04:00

debug_lighting.html

lighting works!

2025-05-26 13:45:46 -04:00

dungeon.js

ok game is working-ish

2025-05-25 19:03:29 -04:00

earlyEntry.test.js

add early entry and help screens for new users

2025-12-26 10:21:25 -05:00

game.js

ok game is working-ish

2025-05-25 19:03:29 -04:00

gameModeManager.test.js

fix edge cases and tests

2026-02-19 06:15:45 -05:00

identityResolution.test.js

refactor: unify identity resolution on stable user_id (anon_token)

2026-05-31 10:15:08 -04:00

moneyAtomic.test.js

refactor: exact BigInt money math via src/money/atomic.js

2026-05-31 09:45:58 -04:00

monster.js

refactor frontend and fix debug mode

2025-05-29 13:40:44 -04:00

monsterChase.test.js

Begin payment logic and tests

2025-09-27 08:45:22 -04:00

movementManager.test.js

Begin payment logic and tests

2025-09-27 08:45:22 -04:00

payment_flow.integration.test.js

security: fix underpayment exploit and make provably-fair real

2026-05-31 09:14:21 -04:00

payment_payout_comprehensive.test.js

fix credits package bug and improve stale payment logic

2026-02-19 07:05:15 -05:00

paymentHandlers.test.js

add error handling and more tests

2025-09-29 11:20:11 -04:00

payoutRetry.test.js

fix: retry payout stat-counting and atomic tx_hash write

2026-05-31 10:00:51 -04:00

payoutSnapshot.test.js

fix: snapshot payout terms at game start (what-you-saw-is-what-you-get)

2026-05-31 09:55:45 -04:00

player.js

ok game is working-ish

2025-05-25 19:03:29 -04:00

provablyFair.test.js

security: fix underpayment exploit and make provably-fair real

2026-05-31 09:14:21 -04:00

rateLimit.test.js

fix: reconnect-proof rate limiting (stable id + real client IP)

2026-05-31 10:21:28 -04:00

security.test.js

security: move session token to handshake auth and rotate on resume

2026-05-31 09:29:20 -04:00

singleGameRecovery.test.js

fix: recover unconsumed single-game payments; make game preservation deterministic

2026-05-31 09:36:09 -04:00

test_address_detection.js

First (untested) payment and db setup

2025-06-01 14:17:29 -04:00

test_fixes.html

ok game is working-ish

2025-05-25 19:03:29 -04:00

test_lighting_verification.html

lighting works!

2025-05-26 13:45:46 -04:00

test_lighting.html

lighting works!

2025-05-26 13:45:46 -04:00

test_movement.html

ok game is working-ish

2025-05-25 19:03:29 -04:00

test_movement.js

ok game is working-ish

2025-05-25 19:03:29 -04:00

test_tile_system.js

Start implementing torches and light and add some new tiles

2025-05-26 07:55:03 -04:00

walletRPCService.test.js

fix edge cases and tests

2026-02-19 06:15:45 -05:00