mirror of https://github.com/djdevin/recflare.git synced 2026-09-08 22:51:30 -07:00

Files

T

Nexi 222547ee13 [api] audit fixes: account tests, dependencies and security hardening (#54 )

* test(accounts): cover three username changes

* chore(deps): update vulnerable runtime dependencies

* fix(security): bound uploads and validate token subjects strictly

---------

Co-authored-by: Nexi (CWN) <communityshieldofficial@gmail.com>

2026-09-08 23:47:58 -04:00

migrations

[api] add CAI reporting, CircuitChipList path

2026-08-27 22:42:35 -04:00

src

[api] fix saved outfits not appearing

2026-09-08 23:07:27 -04:00

static

[api] disable statsig in 2025

2026-09-02 10:41:59 -04:00

env.d.ts

almost into a room

2026-06-09 00:49:11 -04:00

package.json

[api] audit fixes: account tests, dependencies and security hardening (#54 )

2026-09-08 23:47:58 -04:00

README.md

testing generic deploy

2026-06-29 23:16:42 -04:00

tsconfig.json

almost into a room

2026-06-09 00:49:11 -04:00

vitest.config.ts

[api] add non-working v3/votekick

2026-09-02 14:54:14 -04:00

worker-configuration.d.ts

updating types

2026-06-30 23:57:29 -04:00

wrangler.jsonc

support for 202507 endpoints (#37 )

2026-08-21 15:15:55 -04:00

README.md

api

Game API Worker served on the api subdomain. A Hono app serving the game's API surface. Database-backed queries and on-disk JSON files are stubbed for now — no real bindings yet.

Behavior

Auth-gated routes validate the Bearer JWT issued by the auth worker (same dev secret, see src/jwt.ts) and 401 when it's missing/invalid.
Static data is served verbatim:
- src/default-avatar-items.ts → GET /api/avatar/v4/items
- src/default-settings.ts → GET /api/settings/v2
DB-backed reads return empty collections / not-found.
File-backed reads return empty placeholders, each marked TODO: hydrate in src/api.app.ts (Workers have no filesystem — these will move to a binding or inline JSON later).

TODO before production

Wire a DB binding (D1/DO) for rooms, avatars, settings, gifts, balances, etc.
Hydrate the TODO: hydrate endpoints with real config/JSON.
Move the JWT secret to a shared secret binding (shared with auth).
Persist uploads from POST /api/images/v4/uploadsaved (e.g. R2).