add more econ stuff

apps/econ/src/econ.app.ts

@@ -4,14 +4,40 @@ import { useWorkersLogger } from 'workers-tagged-logger'
 import { withNotFound, withOnError } from '@repo/hono-helpers'
 
 import defaultAvatarItems from '../static/default-avatar-items.json'
+import { validateAndGetAccountId } from './jwt'
 
+import type { Context } from 'hono'
 import type { App } from './context'
 
 /**
  * Economy Worker. Hosts the avatar/economy endpoints the game client calls on
  * the `econ` service (these are separate from the main `api` worker). DB-backed
  * data is stubbed for now — no bindings yet.
+ *
+ * Auth-gated routes still validate the Bearer JWT issued by the `auth` worker.
  */
+
+/**
+ * Resolve the account id from a Bearer token. Returns `null` when the header is
+ * missing, the token is invalid, or the `sub` claim isn't an integer.
+ */
+async function authedId(c: Context<App>): Promise<number | null> {
+	const authHeader = c.req.header('Authorization') ?? ''
+	if (!authHeader.toLowerCase().startsWith('bearer ')) return null
+
+	const token = authHeader.slice('Bearer '.length)
+	const accountId = await validateAndGetAccountId(token)
+	if (!accountId) return null
+
+	const id = Number.parseInt(accountId, 10)
+	return Number.isNaN(id) ? null : id
+}
+
+/** Results.Unauthorized() equivalent — 401 with empty body. */
+function unauthorized(c: Context<App>) {
+	return c.body(null, 401)
+}
+
 const app = new Hono<App>()
 	.use(
 		'*',
@@ -29,4 +55,22 @@ const app = new Hono<App>()
 	// Default-unlocked avatar items, served from the bundled static JSON.
 	.get('/api/avatar/v1/defaultunlocked', (c) => c.json(defaultAvatarItems))
 
+	// The player's avatar items — owned items concatenated with the default
+	// catalog. No DB binding yet, so owned is empty and this is just the catalog.
+	.get('/api/avatar/v4/items', async (c) => {
+		const id = await authedId(c)
+		if (id === null) return unauthorized(c)
+		// TODO: prepend the player's owned AvatarItems once a DB binding exists.
+		return c.json(defaultAvatarItems)
+	})
+
+	// The player's avatar. No DB binding yet, so it always returns the default
+	// the C# seeds for a player with no PlayerAvatar row.
+	.get('/api/avatar/v2', async (c) => {
+		const id = await authedId(c)
+		if (id === null) return unauthorized(c)
+		// TODO: load/create the PlayerAvatar for `id` once a DB binding exists.
+		return c.json({ OutfitSelections: '', FaceFeatures: '{}', SkinColor: '', HairColor: '' })
+	})
+
 export default app