Files
recflare/apps/api
Devin Zuczek 551585179a [auth][api] accept the 20250424.01 client
Version check now answers "current" for a set of builds rather than one:
SUPPORTED_GAME_VERSIONS carries 20230414 and 20250424.01. GAME_VERSION is
unchanged and still what the server reports for itself (presence, rn.ver).

Adds GET /api/versioncheck/islandedversions, always [] — we never island a
build off into its own matchmaking pool.

The 2025 build POSTs /cachedlogin/forplatformid/:platform/:id with a
deviceId/platformAuth/time form body where the 2023 build GETs it, so that
route now takes both methods. The body is accepted and ignored for now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 13:14:59 -04:00
..
2026-06-09 00:49:11 -04:00
2026-07-21 21:42:14 -04:00
2026-06-29 23:16:42 -04:00
2026-06-09 00:49:11 -04:00
2026-06-30 23:57:29 -04:00

api

Game API Worker served on the api subdomain. A Hono app serving the game's API surface. Database-backed queries and on-disk JSON files are stubbed for now — no real bindings yet.

Behavior

  • Auth-gated routes validate the Bearer JWT issued by the auth worker (same dev secret, see src/jwt.ts) and 401 when it's missing/invalid.
  • Static data is served verbatim:
    • src/default-avatar-items.tsGET /api/avatar/v4/items
    • src/default-settings.tsGET /api/settings/v2
  • DB-backed reads return empty collections / not-found.
  • File-backed reads return empty placeholders, each marked TODO: hydrate in src/api.app.ts (Workers have no filesystem — these will move to a binding or inline JSON later).

TODO before production

  • Wire a DB binding (D1/DO) for rooms, avatars, settings, gifts, balances, etc.
  • Hydrate the TODO: hydrate endpoints with real config/JSON.
  • Move the JWT secret to a shared secret binding (shared with auth).
  • Persist uploads from POST /api/images/v4/uploadsaved (e.g. R2).