refactor: split casino.go, dedup helpers, remove audit docs

1 files changed, 6 insertions, 4 deletions

diff --git a/internal/net/web_test.go b/internal/net/web_test.go
index d16b31a..20bf7c8 100644
--- a/internal/net/web_test.go
+++ b/internal/net/web_test.go
@@ -10,8 +10,9 @@ import (
 )
 
 // The browser transport previously had no tests. CheckOrigin is the security
-// boundary for the /ws upgrade; test it directly with a non-loopback peer so
-// the loopback bypass does not mask a hostile Origin.
+// boundary for the /ws upgrade; test it directly, including a loopback peer:
+// being on the server host must not re-open the cross-site WebSocket hole for
+// a hostile browser.
 func TestWebSocketCheckOrigin(t *testing.T) {
 	cases := []struct {
 		name       string
@@ -25,7 +26,7 @@ func TestWebSocketCheckOrigin(t *testing.T) {
 		{"same host https", "https://mud.example:4000", "mud.example:4000", "203.0.113.5:1234", true},
 		{"same hostname no port", "http://mud.example", "mud.example:4000", "203.0.113.5:1234", true},
 		{"hostile origin", "http://evil.example", "mud.example:4000", "203.0.113.5:1234", false},
-		{"loopback bypass", "http://evil.example", "mud.example:4000", "127.0.0.1:1234", true},
+		{"loopback hostile origin", "http://evil.example", "mud.example:4000", "127.0.0.1:1234", false},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -41,7 +42,8 @@ func TestWebSocketCheckOrigin(t *testing.T) {
 }
 
 // The /ws upgrade wires a live session and writer. Drive it end-to-end over a
-// real HTTP test server (loopback, so the origin check passes).
+// real HTTP test server (the dialer sends no Origin header, which CheckOrigin
+// accepts).
 func TestWebSocketUpgradeAccepted(t *testing.T) {
 	s := &Server{hub: NewHub()}
 	done := make(chan struct{})