funman300/Ferrous-Solitaire
1
1
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 28 Wiki Activity

docs(handoff): mark E/F/G complete; update HEAD + origin state

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
funman300
2026-05-12 13:55:30 -07:00
parent 6e6f3ef1ff
commit 08f74d1e25
1 changed files with 17 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SESSION_HANDOFF.md
+17 -21
View File
@@ -1,7 +1,6 @@
# Solitaire Quest — Session Handoff # Solitaire Quest — Session Handoff
**Last updated:** 2026-05-12 — ARCHITECTURE.md updated to v1.3 (all 8 Phase 8 gaps closed); **Last updated:** 2026-05-12 — Sync rate limiting + mirror_achievement removal + theme import scan shipped (`6e6f3ef`). HEAD locally: `6e6f3ef`. Push pending.
`SESSION_HANDOFF.md` updated. Push pending.
Phase 8 closes the self-hosted-server connection arc end-to-end: login/register Phase 8 closes the self-hosted-server connection arc end-to-end: login/register
modal, re-auth on token expiry, account deletion flow, server deployment modal, re-auth on token expiry, account deletion flow, server deployment
@@ -13,9 +12,9 @@ and full server integration tests.
## Current state ## Current state
- **HEAD locally:** `bd388fe` (docs: CHANGELOG Phase 8 entry). - **HEAD locally:** `6e6f3ef` (feat: sync rate limiting).
- **HEAD on origin:** `272d31f` (feat: account deletion — last pushed commit). - **HEAD on origin:** `b129664` (pushed — 4 commits ahead).
- **Working tree:** `ARCHITECTURE.md` + `SESSION_HANDOFF.md` modified, uncommitted. - **Working tree:** `SESSION_HANDOFF.md` modified, uncommitted.
- **Build:** `cargo clippy --workspace --all-targets -- -D warnings` clean. - **Build:** `cargo clippy --workspace --all-targets -- -D warnings` clean.
- **Tests:** **1300+ passing / 0 failing** across the workspace. - **Tests:** **1300+ passing / 0 failing** across the workspace.
- **Tags on origin:** `v0.9.0` through `v0.22.0`. - **Tags on origin:** `v0.9.0` through `v0.22.0`.
@@ -61,12 +60,12 @@ Also shipped (pre-Phase 8 but post-v0.22.0, already in CHANGELOG):
want a different public identity. want a different public identity.
### 3. Security hardening ### 3. Security hardening
- **Refresh token rotation.** `POST /api/auth/refresh` returns only a new - [x] **Refresh token rotation.** Done (`b129664`): `refresh_tokens` table
access token; the refresh token never rotates. Standard mitigation: issue a (migration 003); jti embedded in JWT; rotate-on-use pattern; 3 integration
new refresh token on each call and invalidate the old one (needs a tests.
`last_refresh_token` column or a separate table). - [x] **Sync endpoint rate limiting.** Done (`6e6f3ef`): `UserIdKeyExtractor`
- **Sync endpoint rate limiting.** Only `/api/auth/*` has `tower-governor`; decodes JWT for per-user identity; falls back to IP; burst 10 / 6 min
`/api/sync/push` (1 MB body) has no per-user throttle. steady-state; integration test passes.
### 4. Android validation ### 4. Android validation
- **Android Keystore functional test** — JNI AES-GCM code ships (`f281425`) but - **Android Keystore functional test** — JNI AES-GCM code ships (`f281425`) but
@@ -78,13 +77,12 @@ Also shipped (pre-Phase 8 but post-v0.22.0, already in CHANGELOG):
APK but pollutes CI output. Document `--lib` as canonical or upstream a fix. APK but pollutes CI output. Document `--lib` as canonical or upstream a fix.
### 5. Feature completeness ### 5. Feature completeness
- **Theme importer UI.** `import_theme()` (Phase 7, `theme/importer.rs`) is - [x] **Theme importer UI.** Done (`613bbf8`): "Scan for new themes" button in
complete but has no Settings button trigger. Players must copy theme files Settings Appearance section. Shows import path label, scans user_theme_dir()
manually. for .zip archives, fires InfoToastEvent per file, refreshes ThemeRegistry.
- **`mirror_achievement` decision.** `SyncProvider` has this method with a - [x] **`mirror_achievement` removed.** Done (`549a817`): method was a no-op
no-op default; `SolitaireServerClient` never overrides it, no server endpoint default never overridden and never called; achievements already sync via
exists. Either implement (`POST /api/achievements/mirror` + client call on `SyncPayload` push. Deleted from trait and blanket impl.
`AchievementUnlockedEvent`) or delete from the trait.
- **WASM build script.** `web/pkg/` contains compiled WASM committed to git. - **WASM build script.** `web/pkg/` contains compiled WASM committed to git.
Need a `build_wasm.sh` or Makefile target documenting the `wasm-pack build` Need a `build_wasm.sh` or Makefile target documenting the `wasm-pack build`
invocation to regenerate it. invocation to regenerate it.
@@ -151,12 +149,10 @@ READ FIRST (in order):
7. ~/.claude/projects/<this-project>/memory/MEMORY.md 7. ~/.claude/projects/<this-project>/memory/MEMORY.md
OPEN WORK (in priority order): OPEN WORK (in priority order):
B. Leaderboard best-score auto-post (server sync handler + optional
GameWonEvent path in sync_plugin)
C. Refresh token rotation (server auth handler + new column/table)
D. Android AVD functional tests (Keystore + clipboard) D. Android AVD functional tests (Keystore + clipboard)
E. Theme importer UI button in Settings E. Theme importer UI button in Settings
F. mirror_achievement: decide + implement or remove from trait F. mirror_achievement: decide + implement or remove from trait
G. Sync endpoint rate limiting (POST /api/sync/push has no per-user throttle)
Ask which to start. All are independent; any is a valid next arc. Ask which to start. All are independent; any is a valid next arc.
``` ```