fix: more casino, economy, gameplay, security, and world data hardening gaps

1 files changed, 33 insertions, 0 deletions

diff --git a/internal/world/p2_hardening_test.go b/internal/world/p2_hardening_test.go
new file mode 100644
index 0000000..01f8a04
--- /dev/null
+++ b/internal/world/p2_hardening_test.go
@@ -0,0 +1,33 @@
+package world
+
+import (
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+// TestRoomObjectRejectsUnknownField: RoomObject.UnmarshalYAML uses
+// Node.Decode, which does not inherit KnownFields(true), so without an
+// explicit check a misspelled field inside a room's objects: entry is
+// silently discarded even though the top-level room file is strict.
+func TestRoomObjectRejectsUnknownField(t *testing.T) {
+	var ro RoomObject
+	if err := yaml.Unmarshal([]byte("name: anvil\nin_room_description: typo\n"), &ro); err == nil {
+		t.Fatal("accepted an unknown room object field")
+	}
+	// A legitimate local object still parses.
+	if err := yaml.Unmarshal([]byte("name: anvil\ninroom_description: A heavy anvil.\n"), &ro); err != nil {
+		t.Fatalf("rejected a valid local object: %v", err)
+	}
+}
+
+// TestSeedGroundItemsDoesNotMarkUnloadedRoom: a room that fails to load must
+// not be marked seeded, or its item_spawns stay disabled for the rest of the
+// process even after the room file is fixed/created.
+func TestSeedGroundItemsDoesNotMarkUnloadedRoom(t *testing.T) {
+	w := New(t.TempDir())
+	w.SeedGroundItems(999)
+	if w.seeded[999] {
+		t.Fatal("a room that failed to load was marked seeded; its spawns would never appear")
+	}
+}