fix: harden engine across casino, economy, concurrency, security, and content

1 files changed, 66 insertions, 0 deletions

diff --git a/internal/config/hardening_config_known_fields_test.go b/internal/config/hardening_config_known_fields_test.go
new file mode 100644
index 0000000..be00aa9
--- /dev/null
+++ b/internal/config/hardening_config_known_fields_test.go
@@ -0,0 +1,66 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Regression: config.Load used plain yaml.Unmarshal, so an unknown/misspelled
+// key (e.g. telnet_listen) was silently discarded and the default applied.
+// It now uses KnownFields(true), matching the data loaders, while
+// SaveDefault's output must still round-trip through Load.
+
+func writeConfig(t *testing.T, body string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.yaml")
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestLoadRejectsUnknownKey(t *testing.T) {
+	path := writeConfig(t, "tick_length: 700\ntelnet_listen: 4000\n")
+	if _, err := Load(path); err == nil {
+		t.Fatal("expected an error for unknown key telnet_listen, got nil")
+	} else if !strings.Contains(err.Error(), "telnet_listen") {
+		t.Fatalf("error should name the offending key, got: %v", err)
+	}
+}
+
+func TestLoadKnownKeysOverrideDefaults(t *testing.T) {
+	path := writeConfig(t, "tick_length: 700\nstarting_room: 2002\nstartup_validation:\n  root_rooms: [2002]\n")
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.TickLength != 700 {
+		t.Errorf("TickLength = %d, want 700", cfg.TickLength)
+	}
+	if cfg.StartingRoom != 2002 {
+		t.Errorf("StartingRoom = %d, want 2002", cfg.StartingRoom)
+	}
+	if len(cfg.StartupValidation.RootRooms) != 1 || cfg.StartupValidation.RootRooms[0] != 2002 {
+		t.Errorf("RootRooms = %v, want [2002]", cfg.StartupValidation.RootRooms)
+	}
+	// Unset values keep their defaults.
+	if cfg.Telnet.Port != Default().Telnet.Port {
+		t.Errorf("unset Telnet.Port = %d, want default %d", cfg.Telnet.Port, Default().Telnet.Port)
+	}
+}
+
+func TestSaveDefaultRoundTrips(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.yaml")
+	if err := SaveDefault(path); err != nil {
+		t.Fatalf("SaveDefault: %v", err)
+	}
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load(SaveDefault output): %v", err)
+	}
+	if cfg.TickLength != Default().TickLength {
+		t.Errorf("TickLength = %d, want %d", cfg.TickLength, Default().TickLength)
+	}
+}