fix: harden economy recovery, shutdown concurrency, world validation, and inventory-loss paths

1 files changed, 28 insertions, 8 deletions

diff --git a/internal/admin/api_rooms.go b/internal/admin/api_rooms.go
index f9508f6..d84449b 100644
--- a/internal/admin/api_rooms.go
+++ b/internal/admin/api_rooms.go
@@ -298,9 +298,17 @@ func (s *AdminServer) handleRoomByID(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		newContent, writeErr := writeMapAsYAML(path, m)
-		if writeErr != nil {
-			failJSON(w, fmt.Sprintf("write room: %v", writeErr))
+		newContent, marshalErr := marshalMapYAML(m)
+		if marshalErr != nil {
+			failJSON(w, fmt.Sprintf("marshal room: %v", marshalErr))
+			return
+		}
+		if err := validateRoomSchema(newContent); err != nil {
+			writeJSONError(w, "room failed schema validation: "+err.Error(), http.StatusBadRequest)
+			return
+		}
+		if err := writeFilePreservingMode(path, newContent); err != nil {
+			failJSON(w, fmt.Sprintf("write room: %v", err))
 			return
 		}
 
@@ -455,14 +463,19 @@ func (s *AdminServer) handleRenameRoomDir(w http.ResponseWriter, r *http.Request
 		failJSON(w, "cannot rename root")
 		return
 	}
+	dir, err := s.resolveRoomSubdir(body.Dir)
+	if err != nil || dir == "" {
+		failJSON(w, "invalid directory")
+		return
+	}
 	newName := strings.TrimSpace(body.NewName)
 	if newName == "" || strings.ContainsAny(newName, "/\\") || newName == "." || newName == ".." {
 		failJSON(w, "invalid directory name")
 		return
 	}
 	base := filepath.Join(s.dataDir, "rooms")
-	parent := filepath.Dir(body.Dir)
-	oldPath := filepath.Join(base, body.Dir)
+	parent := filepath.Dir(dir)
+	oldPath := filepath.Join(base, dir)
 	newRel := filepath.Join(parent, newName)
 	newPath := filepath.Join(base, newRel)
 	if _, err := os.Stat(oldPath); os.IsNotExist(err) {
@@ -825,7 +838,11 @@ func (s *AdminServer) handleRoomMove(w http.ResponseWriter, r *http.Request) {
 		failJSON(w, "room not found")
 		return
 	}
-	dir := strings.TrimSpace(body.Dir)
+	dir, err := s.resolveRoomSubdir(body.Dir)
+	if err != nil {
+		failJSON(w, err.Error())
+		return
+	}
 	destDir := filepath.Join(s.dataDir, "rooms", dir)
 	if _, err := os.Stat(destDir); os.IsNotExist(err) {
 		failJSON(w, "directory does not exist: "+dir)
@@ -1279,8 +1296,11 @@ func (s *AdminServer) handleCreateEmptyRoom(w http.ResponseWriter, r *http.Reque
 	}
 	base := filepath.Join(s.dataDir, "rooms")
 	targetDir := base
-	if body.Dir != "" {
-		targetDir = filepath.Join(base, body.Dir)
+	if dir, err := s.resolveRoomSubdir(body.Dir); err != nil {
+		failJSON(w, err.Error())
+		return
+	} else if dir != "" {
+		targetDir = filepath.Join(base, dir)
 		if _, err := os.Stat(targetDir); os.IsNotExist(err) {
 			failJSON(w, "directory not found")
 			return