Ferrous-Solitaire

Files

T

funman300 ccfeb055e5 fix(server): load JWT_SECRET at startup, add auth logging, fix challenge race

- Introduce AppState { pool, jwt_secret } so JWT_SECRET is loaded once in
  main() and any missing value is a fatal startup error rather than a 500
  on the first request.  All four env::var("JWT_SECRET") call sites in
  auth.rs and middleware.rs are replaced with state.jwt_secret.
- build_test_router embeds the fixed test secret so integration tests do
  not need to set JWT_SECRET in the environment.
- Add tracing::warn! in login (invalid password) and register (username
  taken) to surface brute-force attempts in production logs.
- Fix daily-challenge race condition: after INSERT OR IGNORE, re-SELECT
  the persisted row so concurrent requests both return the winner's data.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-28 22:35:46 +00:00

auth.rs

fix(engine,gpgs,core,server): export CardFaceRevealedEvent, explicit gpgs stub, enum/constant docs

2026-04-28 22:30:22 +00:00

challenge.rs

fix(server): load JWT_SECRET at startup, add auth logging, fix challenge race

2026-04-28 22:35:46 +00:00

error.rs

feat(workspace): full server + sync implementation, all tests green

2026-04-26 23:32:56 +00:00

leaderboard.rs

fix(engine,gpgs,core,server): export CardFaceRevealedEvent, explicit gpgs stub, enum/constant docs