1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
package admin
import (
"encoding/json"
"net/http/httptest"
"os"
"path/filepath"
"strings"
"testing"
"thehouseoficarus/internal/item"
"thehouseoficarus/internal/player"
"thehouseoficarus/internal/world"
)
func newTestWorld(dir string) *world.World {
return world.New(dir)
}
// Regression: _raw must not leak the password hash even when it is a
// multiline YAML block scalar, which line-based masking misses.
func TestAccountAPIRedactsMultilinePasswordHash(t *testing.T) {
dir := t.TempDir()
if err := os.MkdirAll(filepath.Join(dir, "players", "accounts"), 0o755); err != nil {
t.Fatal(err)
}
body := "name: alice\npassword_hash: |-\n sensitive-hash-sentinel\n"
if err := os.WriteFile(filepath.Join(dir, "players", "accounts", "alice.yaml"), []byte(body), 0o644); err != nil {
t.Fatal(err)
}
s := &AdminServer{accountStore: player.NewAccountStore(dir)}
rr := httptest.NewRecorder()
s.getAccount(rr, httptest.NewRequest("GET", "/api/players/account/alice", nil), "alice")
if strings.Contains(rr.Body.String(), "sensitive-hash-sentinel") {
t.Fatalf("password hash leaked in response: %s", rr.Body.String())
}
var resp map[string]any
if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
t.Fatalf("response is not valid json: %v", err)
}
}
// Regression: undo/redo of an item edit must invalidate the runtime item
// cache (and rebuild dependent indexes), not leave gameplay on the stale
// definition.
func TestUndoRefreshesRuntimeItemCache(t *testing.T) {
dir := t.TempDir()
if err := os.MkdirAll(filepath.Join(dir, "items"), 0o755); err != nil {
t.Fatal(err)
}
if err := os.MkdirAll(filepath.Join(dir, "rooms"), 0o755); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(dir, "items", "coin.yaml"), []byte("name: Coin\nvalue: 1\n"), 0o644); err != nil {
t.Fatal(err)
}
s := &AdminServer{
dataDir: dir,
itemStore: item.NewItemStore(dir),
world: newTestWorld(dir),
undoStack: NewUndoStack(dir),
}
// Warm the cache with the original definition.
if _, err := s.itemStore.Load("coin"); err != nil {
t.Fatal(err)
}
s.updateItem(httptest.NewRecorder(), httptest.NewRequest("PUT", "/api/items/coin",
strings.NewReader(`{"name":"Coin","value":9}`)), "coin")
if updated, err := s.itemStore.Load("coin"); err != nil || updated.Value != 9 {
t.Fatalf("item edit did not reach the runtime cache: %v %+v", err, updated)
}
s.doUndo(httptest.NewRecorder(), httptest.NewRequest("POST", "/api/undo/undo", nil))
restored, err := s.itemStore.Load("coin")
if err != nil || restored.Value != 1 {
t.Fatalf("undo left stale runtime state: %v value=%+v", err, restored)
}
}
|
