From 194164a77eb4f2479b94c19e6f0e1278ab608781 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 16:13:49 -0400
Subject: fix: more casino, economy, gameplay, security, and world data
 hardening gaps

---
 internal/net/p2_hardening_test.go | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 internal/net/p2_hardening_test.go

(limited to 'internal/net/p2_hardening_test.go')

diff --git a/internal/net/p2_hardening_test.go b/internal/net/p2_hardening_test.go
new file mode 100644
index 0000000..089dcb2
--- /dev/null
+++ b/internal/net/p2_hardening_test.go
@@ -0,0 +1,31 @@
+package net
+
+import (
+	"testing"
+
+	"thehouseoficarus/internal/config"
+)
+
+// TestPartialTLSConfigIsFatal: an operator who sets only one of
+// tls.cert_file / tls.key_file must get a startup error instead of a silent
+// self-signed fallback that makes clients fail verification confusingly.
+func TestPartialTLSConfigIsFatal(t *testing.T) {
+	cfg := config.Default()
+	cfg.TLS.CertFile = "/tmp/only-cert.pem"
+	cfg.TLS.KeyFile = ""
+	if _, err := loadOrGenerateCert(cfg, "test"); err == nil {
+		t.Fatal("accepted a half-configured TLS cert pair")
+	}
+}
+
+// TestPreAuthStatesUseShortTimeout: the new-account prompts are pre-auth
+// states and must use the short login window, not the 30-minute idle window.
+func TestPreAuthStatesUseShortTimeout(t *testing.T) {
+	for _, st := range []SessionState{StateAccountName, StatePassword, StateNewAccountPass, StateNewAccount} {
+		sess := &Session{}
+		sess.SetState(st)
+		if got := sessionIdleTimeout(sess); got != loginReadTimeout {
+			t.Fatalf("state %v timeout = %v, want %v", st, got, loginReadTimeout)
+		}
+	}
+}
-- 
cgit v1.2.3