Security hardening pass, SysOp API added to CF Worker, worker entry decomposed, and warp animation implemented

476 files · 19,668+ · 74,787-

3 files changed

Removed hardcoded admin password and added JSON protocol auth harden behavioral
2 files
- login.py
- session.py
Required admin auth on maintenance-tick and maintenance-status endpoints harden internal
1 file
- app.py
Added timing-safe auth comparisons, invite token expiry, and atomic seed transactions harden internal
2 files
- auth.py
- do_store.py
Atomic seed transaction, password strip, player delete guard, and prompt cap harden behavioral
2 files
- do_store.py
- _login_creation.py
Fixed metrics routing, invite code timing, animation default, and DELETE routing remediate behavioral
1 file
- config.py
Four correctness/security issues resolved from code review remediate internal
1 file
- service.py
Three security/correctness issues resolved from code review remediate internal
1 file
- session.py

2 files changed

Added SysOp REST API to CF Worker Durable Object (/api/v1/*) interface behavioral
2 files
- fetch_router.py
- command.py
Added teleport and reset-password action endpoints to sysop API interface behavioral
1 file
- config.py
Added worker sysop CLI commands for DO management instantiate behavioral
2 files
- worker_sysop.py
- worker.py
Served sysop UI, persisted auth tokens, renamed galaxy.html decouple behavioral
1 file
- sysop.html

4 files changed

Extracted worker entry.py into focused modules (-1456 lines) decouple internal
4 files
- entry.py
- adapter.py
- persistence.py
- wrapper.py
Split all files over 500 LOC into focused sub-modules decouple internal
4 files
- _display_player.py
- _display_sector.py
- _trading_display.py
- _trading_rob.py
Moved sysop_metrics.py to sysop/metrics.py decouple internal
1 file
- metrics.py
Split sysop_router and session_bridge into per-resource modules decouple internal
3 files
- session_bridge.py
- menu_handler.py
- prompt_handler.py
Resolved worker dev server startup failures after entry.py refactor remediate internal
1 file
- entry.py

1 file changed

Added warp progress-bar animation instantiate behavioral
1 file
- _warp_animation.py
Warp animation now fires — send_fn carried through prompt reply chain remediate internal
2 files
- game_loop.py
- prompt_handler.py
Captured start_sector before autopilot loop in cmd_move remediate internal
1 file
- movement.py

3 files changed

Fixed auth bypass, encounter gaps, flee logic, and combat persistence remediate internal
2 files
- combat.py
- alien_encounter.py
Resolved double turn deduction, missing player fields, and security gaps remediate internal
2 files
- context.py
- engine.py
Wired JSON protocol persistence, config-driven player creation, and unified autopilot remediate internal
2 files
- session.py
- _login_creation.py
Persisted respawn/transwarp-lock, fixed disconnect in menus, added config defaults remediate internal
2 files
- login.py
- _login_settings.py
Fixed dual-import fallbacks, game password strip, and trade price proration remediate internal
1 file
- trading.py
Removed dead seed_universe, fixed sector upsert, added password guards deprecate internal
1 file
- _seed_universe.py
Fixed metrics None guard, constant-time auth, 204 body, autopilot delay, seed transaction, and player patch allowlist remediate internal
1 file
- service.py
Corrected token cache TTL, trade direction guard, and stats capacity remediate internal
2 files
- auth.py
- trading.py
Removed bundled universe_data.py; seed exclusively from R2 deprecate internal
1 file
- _seed_defaults.py
Added send_raw to MockSession stubs qualify internal
1 file
- server_fixtures.py
Applied linter formatting across codebase baseline errata
1 file
- __init__.py