funman300 a218999243 fix(server): login timing pad, 409 on register race, avatar magic-byte check ...

Closes the three actionable server Low findings from the 2026-07-06
review:

- #139: unknown-username logins now verify against a static bcrypt
  dummy hash so both failure paths pay the same cost — response timing
  no longer reveals which usernames exist.
- #140: register maps a unique-constraint violation to UsernameTaken
  (409) — the SELECT pre-check stays as the friendly fast path, the
  constraint is the arbiter for the concurrent case.
- #141: avatar uploads must start with the magic bytes of the declared
  image type; the stored extension (which decides how the file is
  re-served) is now backed by content, not the Content-Type header.

Unit tests: real/spoofed/truncated signatures for all four formats,
and the dummy hash's validity at BCRYPT_COST.

Closes #139
Closes #140
Closes #141

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-06 20:15:01 -07:00

..

e2e

fix(e2e): reset cycle-gate games in place instead of 240 page reloads

2026-06-24 10:07:31 -07:00

migrations

feat(auth): add /api/me endpoint, avatar upload, and profile picture support

2026-05-14 17:14:42 -07:00

src

fix(server): login timing pad, 409 on register race, avatar magic-byte check

2026-07-06 20:15:01 -07:00

tests

chore: add pedantic workspace lints (#90)

2026-06-12 13:05:28 -07:00

web

chore(web): regenerate wasm artifacts

2026-07-06 23:05:53 +00:00

.env.example

feat(sync): re-auth prompt on expired session + server deployment artifacts

2026-05-12 12:45:08 -07:00

Cargo.toml

chore: add pedantic workspace lints (#90)

2026-06-12 13:05:28 -07:00

docker-compose.yml

chore: rename app from Solitaire Quest to Ferrous Solitaire

2026-05-14 19:23:49 -07:00

Dockerfile

fix(ci): remove Quaternions registry auth; add canvas WASM drift guard

2026-06-02 12:20:56 -07:00