diff options
Diffstat (limited to 'FIXES.md')
| -rw-r--r-- | FIXES.md | 38 |
1 files changed, 23 insertions, 15 deletions
@@ -57,22 +57,30 @@ Nothing was staged or committed. The audit artifacts (`AUDIT.md`, `reports/`) ar ### Tooling 31. **`make lint` gate restored** — fixed the 15 reported issues (error-string casing, doc-comment form, unused params, ineffassign) without weakening `.golangci.yml`. -## Deliberately deferred (still open) - -These are documented in `AUDIT.md`; the next tranche should cover them. - -- **Undo failure reporting** (`Undo()`/`Redo()` still return nil on failure → "Nothing to undo"). Needs a signature change. -- **Explicit snapshot-existence flag** to allow undoing an intentionally empty file (current fix is a safe refusal). -- **`quit` queue/busy interaction**; **bank withdraw duplicate ambiguity list**; **`get <n> credits` ignores `<n>`**. -- **Production `FirstCraft()` vs multi-recipe availability**; **"how many" batches vs units**. -- **Room object reference entries silently drop behavior fields**; **`.yml` files invisible to validation**; **craft `type`/`subtype` validator rule**; **talk `start` node check**; **safespot validation**; **drop weight validation**. -- **Persistence `Recover` mid-game misuse**, journal versioning, `.save-*` temp sweep. -- **Casino**: craps Fire/ATS deferral, shooter-change reset, video-poker raw error text, slots free-spin off-by-one, plinko RTP wording, machine leave silently dropping a banked feature, cabinet ID collisions. -- **Admin**: `restoreAccountSecret` fail-open, `entityCreate` persisting `_path`/`_raw`, trigger POST/PUT divergence, `validEntityID`, `resolve-duplicate`, course detach, symlink handling. -- **Net**: telnet echo CRLF deadline, shutdown flush starvation, `armReadDeadline` concrete-type switch, hub bucket pruning. -- **Structural refactors** from `AUDIT.md` §3–4 (Table shrink consolidation, `countExtraInbound`, cert gen, YAML encoders, `tableCore` for pai gow, typed `GridConflict.Kind`, etc.). +## Tranche 2 (this pass) + +- **Security**: `restoreAccountSecret` no longer fails open on a non-mapping body (the admin raw editor can no longer blank `password_hash`); `validEntityID` rejects control characters and leading dots. +- **Info disclosure**: video-poker bank/wager errors are mapped instead of printing raw `os`/YAML errors and server paths. +- **Casino**: slots free-spin counter no longer prints "0 free spins remain" before the last spin; `leave` settles banked free-spin winnings instead of silently dropping them; craps repeated-odds returns the correct error; a craps shooter change resets the hand (point/made/seen) so the next shooter gets a fresh come-out. +- **Economy**: `get <n> credits` honors the requested quantity; bank withdraw ambiguity list no longer duplicates entries. +- **Admin**: `entityCreate` drops editor-only `_path`/`_raw`; `detachRoomFromCourse` checks `os.Remove` and detaches from every matching course. +- **Validation**: `.yml` files are discovered/validated (matching the runtime trigger loader); talk configs with nodes but no `start` node are an error. +- **Persistence**: `Recover` sweeps crash-created `.save-*` temp files. +- **Net**: `Conn` now requires `SetReadDeadline`, so every transport gets an idle read deadline (removed the concrete-type switch); hub room buckets are pruned and `RekeyRooms` merges instead of clobbering. +- Tests added: `TestRestoreAccountSecretRefusesNonMappingBody`, `TestWalkYAMLDirIncludesYml`, `TestValidateTalkConfigRequiresStartNode`, `TestPickupCreditsHonorsRequestedQuantity`, `TestMachineLeavePaysBankedFeature`, `TestCrapsShooterChangeResetsHand`. + +## Still open + +- **Undo failure reporting** (`Undo()`/`Redo()` still return nil on failure → "Nothing to undo") and an explicit snapshot-existence flag. +- **`quit` queue/busy interaction**; **"how many" batches vs units**; **production `FirstCraft()` vs multi-recipe availability**. +- **Room object reference entries silently drop behavior fields**; **craft `type`/`subtype` validator rule**; **safespot validation**; **drop weight validation**. +- **Persistence** `Recover` mid-game misuse; journal versioning. +- **Casino**: craps Fire/ATS deferral, plinko RTP wording, video-poker cabinet ID collisions. +- **Admin**: trigger POST/PUT divergence, `resolve-duplicate` precondition, symlink handling. +- **Net**: telnet echo CRLF deadline, shutdown flush starvation. +- **Structural refactors** from `AUDIT.md` §3–4. - **Test infrastructure**: `make test-race`/CI, harness owner-goroutine leak, master-tick harness option, and coverage for steal/gather/burn/talk and the WebSocket transport. ## Suggested next step -Continue with a second tranche focused on the remaining P1/P2 correctness items and the admin/persistence/validation gaps, then a structural-refactor tranche. Each change should keep `make lint`, `go test ./...`, and `go test -race` green. +Tranche 3: the remaining admin/persistence/casino P2s above, then the structural refactors. Keep `make lint`, `go test ./...`, and `go test -race` green. |