TRXTD

Tronax/TRXTD

Fork 0

Commit graph

Author	SHA1	Message	Date
Tronax	f7ab56e475	fix(ui+game): responsive profile bar, auto-wave toggle, and stats on early exit Profile bar on phones: - With the new Statistik/Admin chips the bar overflowed the viewport on small screens. It now wraps (flex-wrap + max-width) and compacts its paddings, fonts and chip sizes below 560px Auto-wave (🔁 button in the HUD controls): - New persistent toggle (localStorage) that starts the next wave on its own ~0.4s after intermission begins, collecting the full early-call bonus without pressing the wave button every round - Toggling it on during an active intermission starts the wave immediately; works in solo and multiplayer (uses the same action path as the manual button); active state shows green Stats are now saved when leaving via the menu: - Previously only victory/defeat recorded a result — exiting a running game via "🚪 Zurück zum Hauptmenü" or the pause menu discarded the whole run, which is why endless-mode progress beyond wave 20 never showed up in the stats - engine.abandon() records best score, stats and crystals (counted as a defeat) whenever a solo game is left mid-run; no-ops when no game is running or the result was already reported, so no double counting Verified in the browser (390x844, admin account): profile bar wraps compactly; 🔁 auto-started wave 1 during intermission without manual click; exiting mid-wave recorded the run (💎 2, 1 Runde, beste Welle 1). Build clean, 54/54 tests green.	2026-08-17 15:51:23 +02:00
Tronax	572f82a954	feat(ui): player stats modal and admin button for ADMIN_USERS accounts The admin dashboard exposed account stats, but players had no way to see their own. Both gaps are closed: Player stats modal (src/components/PlayerStats.vue): - New "📊 Statistik" chip in the profile bar, available to logged-in players AND guests (guest progress lives in the same profile shape) - Shows crystals, rounds played, wins incl. win rate, kills, total score, best wave, and a research progress bar (owned vs. total upgrade levels) - Guests get a hint that their progress is local-only and transfers into an account on first login Admin shortcut: - Logged-in users whose account is listed in ADMIN_USERS (server already sets publicUser.admin) now get a "🛡️ Admin" chip in the profile bar that links to /admin with the existing session - UserMetaProfile type gains the optional admin flag Verified in the browser: guest sees the stats button but no admin chip; after logging in as an ADMIN_USERS account the admin chip appears and navigates to the dashboard (data loads, 1 account). Build clean, 54/54 tests green.	2026-08-17 15:18:43 +02:00
Tronax	1a9ac5bf45	feat: account system, OIDC, meta-progression research tree, and automated tests Account & Persistence Layer (server/db.mjs) - SQLite via node:sqlite DatabaseSync with WAL mode, foreign keys, and synchronous=NORMAL for microsecond response times - Users table: UUID primary key, unique lowercase username, scrypt-hashed password, optional OIDC sub/issuer, crystal balance, timestamps - Sessions table: 64-byte random hex token, FK to users, configurable TTL with automatic expiry cleanup every 10 minutes - User upgrades table: composite PK (user_id, upgrade_id), level tracking, ON CONFLICT DO UPDATE for idempotent merges - User stats table: games played/won, total kills/score, highest wave - Password hashing: crypto.scrypt with 16-byte salt and 64-byte derived key, constant-time comparison via crypto.timingSafeEqual - Guest merge: caps crystals at 100,000, caps levels to defined maxLevels, uses MAX(level, new) to preserve higher account levels, ignores unknown upgrade IDs, transactional with BEGIN IMMEDIATE/COMMIT/ROLLBACK - Atomic crystal purchasing: subtracts cost only if balance sufficient, upgrades level within transaction, returns full user object on success Meta-Progression Definitions (shared/meta-upgrades.mjs) - Single source of truth shared between server (authoritative validation) and client (talent tree UI) - 3 branches: Economy (start_gold, wave_bonus, obstacle_discount), Defense (bonus_lives, shockwave, fortress_shield), Towers (tower_range, tower_speed, dot_potency) - 9 upgrades with 1–5 levels each, progressive cost curves - calcCrystalsEarned(wave, score, win): base 2.5 per wave, +40 for victory, +floor(score/250), minimum 1 crystal per game REST API (server/server.mjs) - /api/auth/register: username 3–16 chars a-z0-9_-; password min 8 chars; case-insensitive uniqueness; auto-creates user_stats row; returns session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS) - /api/auth/login: constant-time username lookup via scrypt verify; rate-limited 20 auth attempts/IP/minute - /api/auth/logout: deletes session server-side, clears cookie - /api/auth/me: returns publicUser (id, username, crystals, upgrades, stats, oidc flag) or null - /api/auth/oidc/login: PKCE Authorization Code flow with SHA-256 S256 challenge/verifier; discovers .well-known/openid-configuration; verifies RS256 id_token signature via JWKS public key; validates issuer, audience, and expiry; finds or creates user by OIDC sub/issuer - /api/auth/oidc/callback: exchanges code for tokens, verifies id_token, issues session cookie, redirects to /?auth=ok or /?auth=error - /api/upgrades/buy: validates upgrade ID against META_UPGRADES, checks current level < maxLevel, deducts cost from crystals - /api/game/finish: server-authoritative crystal calculation; bounds-checks inputs (wave ≤ 9999, score ≤ 10M, kills ≤ 1M); updates user_stats (games_played, games_won, total_kills, total_score, highest_wave via MAX) - /api/auth/merge-guest: one-time guest-to-account crystal and upgrade migration with level caps - /api/config: public endpoint exposing OIDC enabled state and button label - Security: CSP header on all responses, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, cache-control no-store on API responses, path-traversal protection on static serving Multiplayer Fairness - Meta-upgrades (start_gold, bonus_lives, tower_range, tower_speed, dot_potency, wave_bonus, obstacle_discount, shockwave, fortress_shield) applied only in solo campaign mode - Co-op and Duel multiplayer sessions reset all meta buffs to zero, preserving lockstep determinism and competitive balance - Multiplayer results set crystalsEarned: 0 to prevent duplicate rewards Frontend (Vue 3 + TypeScript) - AuthModal.vue: username/password login and registration form with validation, OIDC single sign-on button (shown when configured), guest-to-account upgrade on first login - UserProfileBar.vue: top-bar indicator showing crystal count (💎), user display name, research and login/logout buttons, reactive auth state via auth controller - ResearchTree.vue: interactive talent tree modal with 3 branches, per-upgrade cost/level display, purchase confirmation, disabled state for unaffordable/maxed upgrades, branch icons and descriptions - auth.ts: reactive controller managing login, registration, OIDC redirect detection (?auth=ok/?auth=error), guest profile migration on first login, upgrade purchasing, and game result reporting - meta.ts: frontend helpers for branch definitions, upgrade costs, and guest profile persistence in localStorage - engine.ts: solo meta bonus application (start_gold, bonus_lives, tower_range, tower_speed, dot_potency, wave_bonus, obstacle_discount, shockwave, fortress_shield); crystal rewards in finish() path - mpgame.ts: meta buff reset in multiplayer sessions; crystalsEarned: 0 - sound.ts: shield sound synthesis for fortress_shield absorption - store.ts: auth state, research tree toggle, upgrade snapshot - types.ts: SfxName extended with "shield" sound Docker Configuration - Multi-stage build: node:22-alpine build → node:22-alpine runtime (production deps only: ws) - VOLUME /app/data for persistent SQLite database - HEALTHCHECK on /health endpoint - docker-compose.yml: port 3001, persistent ./data volume, commented OIDC environment variables (OIDC_ENABLED, OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI, OIDC_BUTTON_LABEL) - .gitignore: data/, .db, .db-journal, .db-wal, .db-shm Automated Tests (npm test) - scripts/test-db.mjs (17 unit tests): isolated SQLite persistence – scrypt hash/verify roundtrip, timing-safe constant-time comparison, user creation with lowercase enforcement, UNIQUE constraint, session create/get/delete lifecycle, expired session invalidation, crystal addition, 5-level upgrade cost progression with max-level guard, guest merge (crystal cap 100k, level cap, MAX() semantics, unknown upgrade rejection), game result stats accumulation, calcCrystalsEarned formula verification - scripts/test-auth.mjs (31 integration tests): spawns real server with isolated DATA_DIR, exercises full REST flow – register validation (username too short, password too short, duplicate, case-insensitive), login (wrong password, correct), session cookie attributes (HttpOnly, SameSite=Lax, Path=/), /me endpoint, upgrade purchase (insufficient crystals, unknown ID, successful purchase), game finish rewards (victory, defeat, negative values clamped to 1 crystal minimum), guest merge (crystals, level caps, unknown upgrades), logout, OIDC-disabled endpoints (400), unauthenticated guards (401), 404 routing, CSP header on static files, rate limiting (429 after 20+ auth attempts per minute), and persistence across server restart (kill + respawn with same DATA_DIR preserves all state)	2026-08-16 16:22:38 +02:00

Author

SHA1

Message

Date

Tronax

f7ab56e475

fix(ui+game): responsive profile bar, auto-wave toggle, and stats on early exit

Profile bar on phones:
- With the new Statistik/Admin chips the bar overflowed the viewport on
  small screens. It now wraps (flex-wrap + max-width) and compacts its
  paddings, fonts and chip sizes below 560px

Auto-wave (🔁 button in the HUD controls):
- New persistent toggle (localStorage) that starts the next wave on its
  own ~0.4s after intermission begins, collecting the full early-call
  bonus without pressing the wave button every round
- Toggling it on during an active intermission starts the wave
  immediately; works in solo and multiplayer (uses the same action path
  as the manual button); active state shows green

Stats are now saved when leaving via the menu:
- Previously only victory/defeat recorded a result — exiting a running
  game via "🚪 Zurück zum Hauptmenü" or the pause menu discarded the
  whole run, which is why endless-mode progress beyond wave 20 never
  showed up in the stats
- engine.abandon() records best score, stats and crystals (counted as a
  defeat) whenever a solo game is left mid-run; no-ops when no game is
  running or the result was already reported, so no double counting

Verified in the browser (390x844, admin account): profile bar wraps
compactly; 🔁 auto-started wave 1 during intermission without manual
click; exiting mid-wave recorded the run (💎 2, 1 Runde, beste Welle 1).
Build clean, 54/54 tests green.

2026-08-17 15:51:23 +02:00

Tronax

572f82a954

feat(ui): player stats modal and admin button for ADMIN_USERS accounts

The admin dashboard exposed account stats, but players had no way to see
their own. Both gaps are closed:

Player stats modal (src/components/PlayerStats.vue):
- New "📊 Statistik" chip in the profile bar, available to logged-in
  players AND guests (guest progress lives in the same profile shape)
- Shows crystals, rounds played, wins incl. win rate, kills, total score,
  best wave, and a research progress bar (owned vs. total upgrade levels)
- Guests get a hint that their progress is local-only and transfers into
  an account on first login

Admin shortcut:
- Logged-in users whose account is listed in ADMIN_USERS (server already
  sets publicUser.admin) now get a "🛡️ Admin" chip in the profile bar
  that links to /admin with the existing session
- UserMetaProfile type gains the optional admin flag

Verified in the browser: guest sees the stats button but no admin chip;
after logging in as an ADMIN_USERS account the admin chip appears and
navigates to the dashboard (data loads, 1 account). Build clean, 54/54
tests green.

2026-08-17 15:18:43 +02:00

Tronax

1a9ac5bf45

feat: account system, OIDC, meta-progression research tree, and automated tests

Account & Persistence Layer (server/db.mjs)
- SQLite via node:sqlite DatabaseSync with WAL mode, foreign keys, and
  synchronous=NORMAL for microsecond response times
- Users table: UUID primary key, unique lowercase username, scrypt-hashed
  password, optional OIDC sub/issuer, crystal balance, timestamps
- Sessions table: 64-byte random hex token, FK to users, configurable TTL
  with automatic expiry cleanup every 10 minutes
- User upgrades table: composite PK (user_id, upgrade_id), level tracking,
  ON CONFLICT DO UPDATE for idempotent merges
- User stats table: games played/won, total kills/score, highest wave
- Password hashing: crypto.scrypt with 16-byte salt and 64-byte derived
  key, constant-time comparison via crypto.timingSafeEqual
- Guest merge: caps crystals at 100,000, caps levels to defined maxLevels,
  uses MAX(level, new) to preserve higher account levels, ignores unknown
  upgrade IDs, transactional with BEGIN IMMEDIATE/COMMIT/ROLLBACK
- Atomic crystal purchasing: subtracts cost only if balance sufficient,
  upgrades level within transaction, returns full user object on success

Meta-Progression Definitions (shared/meta-upgrades.mjs)
- Single source of truth shared between server (authoritative validation)
  and client (talent tree UI)
- 3 branches: Economy (start_gold, wave_bonus, obstacle_discount),
  Defense (bonus_lives, shockwave, fortress_shield),
  Towers (tower_range, tower_speed, dot_potency)
- 9 upgrades with 1–5 levels each, progressive cost curves
- calcCrystalsEarned(wave, score, win): base 2.5 per wave, +40 for victory,
  +floor(score/250), minimum 1 crystal per game

REST API (server/server.mjs)
- /api/auth/register: username 3–16 chars a-z0-9_-; password min 8 chars;
  case-insensitive uniqueness; auto-creates user_stats row; returns
  session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS)
- /api/auth/login: constant-time username lookup via scrypt verify;
  rate-limited 20 auth attempts/IP/minute
- /api/auth/logout: deletes session server-side, clears cookie
- /api/auth/me: returns publicUser (id, username, crystals, upgrades,
  stats, oidc flag) or null
- /api/auth/oidc/login: PKCE Authorization Code flow with SHA-256 S256
  challenge/verifier; discovers .well-known/openid-configuration;
  verifies RS256 id_token signature via JWKS public key; validates
  issuer, audience, and expiry; finds or creates user by OIDC sub/issuer
- /api/auth/oidc/callback: exchanges code for tokens, verifies id_token,
  issues session cookie, redirects to /?auth=ok or /?auth=error
- /api/upgrades/buy: validates upgrade ID against META_UPGRADES,
  checks current level < maxLevel, deducts cost from crystals
- /api/game/finish: server-authoritative crystal calculation;
  bounds-checks inputs (wave ≤ 9999, score ≤ 10M, kills ≤ 1M);
  updates user_stats (games_played, games_won, total_kills, total_score,
  highest_wave via MAX)
- /api/auth/merge-guest: one-time guest-to-account crystal and upgrade
  migration with level caps
- /api/config: public endpoint exposing OIDC enabled state and button label
- Security: CSP header on all responses, X-Content-Type-Options: nosniff,
  X-Frame-Options: DENY, Referrer-Policy: no-referrer, cache-control
  no-store on API responses, path-traversal protection on static serving

Multiplayer Fairness
- Meta-upgrades (start_gold, bonus_lives, tower_range, tower_speed,
  dot_potency, wave_bonus, obstacle_discount, shockwave, fortress_shield)
  applied only in solo campaign mode
- Co-op and Duel multiplayer sessions reset all meta buffs to zero,
  preserving lockstep determinism and competitive balance
- Multiplayer results set crystalsEarned: 0 to prevent duplicate rewards

Frontend (Vue 3 + TypeScript)
- AuthModal.vue: username/password login and registration form with
  validation, OIDC single sign-on button (shown when configured),
  guest-to-account upgrade on first login
- UserProfileBar.vue: top-bar indicator showing crystal count (💎),
  user display name, research and login/logout buttons, reactive
  auth state via auth controller
- ResearchTree.vue: interactive talent tree modal with 3 branches,
  per-upgrade cost/level display, purchase confirmation, disabled
  state for unaffordable/maxed upgrades, branch icons and descriptions
- auth.ts: reactive controller managing login, registration, OIDC
  redirect detection (?auth=ok/?auth=error), guest profile migration
  on first login, upgrade purchasing, and game result reporting
- meta.ts: frontend helpers for branch definitions, upgrade costs,
  and guest profile persistence in localStorage
- engine.ts: solo meta bonus application (start_gold, bonus_lives,
  tower_range, tower_speed, dot_potency, wave_bonus, obstacle_discount,
  shockwave, fortress_shield); crystal rewards in finish() path
- mpgame.ts: meta buff reset in multiplayer sessions; crystalsEarned: 0
- sound.ts: shield sound synthesis for fortress_shield absorption
- store.ts: auth state, research tree toggle, upgrade snapshot
- types.ts: SfxName extended with "shield" sound

Docker Configuration
- Multi-stage build: node:22-alpine build → node:22-alpine runtime
  (production deps only: ws)
- VOLUME /app/data for persistent SQLite database
- HEALTHCHECK on /health endpoint
- docker-compose.yml: port 3001, persistent ./data volume,
  commented OIDC environment variables (OIDC_ENABLED, OIDC_ISSUER,
  OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI, OIDC_BUTTON_LABEL)
- .gitignore: data/, *.db, *.db-journal, *.db-wal, *.db-shm

Automated Tests (npm test)
- scripts/test-db.mjs (17 unit tests): isolated SQLite persistence –
  scrypt hash/verify roundtrip, timing-safe constant-time comparison,
  user creation with lowercase enforcement, UNIQUE constraint, session
  create/get/delete lifecycle, expired session invalidation, crystal
  addition, 5-level upgrade cost progression with max-level guard,
  guest merge (crystal cap 100k, level cap, MAX() semantics, unknown
  upgrade rejection), game result stats accumulation, calcCrystalsEarned
  formula verification
- scripts/test-auth.mjs (31 integration tests): spawns real server with
  isolated DATA_DIR, exercises full REST flow – register validation
  (username too short, password too short, duplicate, case-insensitive),
  login (wrong password, correct), session cookie attributes (HttpOnly,
  SameSite=Lax, Path=/), /me endpoint, upgrade purchase (insufficient
  crystals, unknown ID, successful purchase), game finish rewards
  (victory, defeat, negative values clamped to 1 crystal minimum),
  guest merge (crystals, level caps, unknown upgrades), logout,
  OIDC-disabled endpoints (400), unauthenticated guards (401), 404
  routing, CSP header on static files, rate limiting (429 after 20+
  auth attempts per minute), and persistence across server restart
  (kill + respawn with same DATA_DIR preserves all state)

2026-08-16 16:22:38 +02:00

3 commits