Security, stability & performance quick wins

[Sparksx]

Summary

Comprehensive analysis of the game across 4 axes (security, stability, performance, functionality) followed by implementation of the highest-priority quick wins.

• Security: Enable CSP in production, harden JWT verification with explicit algorithm, add socket rate limiting
• Stability: Fix race conditions in clan leave and mission progress, fix event listener leak
• Performance: Cache PvP leaderboard, fix dependency classification

Changes

Security

• Enable Content-Security-Policy in production (server/index.js) — was fully disabled (contentSecurityPolicy: false), now enforces default-src 'self' with targeted exceptions for Stripe checkout and Google OAuth
• Explicit JWT algorithm (server/middleware/auth.js, server/routes/auth.js) — all jwt.verify() calls now specify algorithms: ['HS256'] to prevent algorithm substitution attacks
• Socket rate limiting (server/socket/chat.js) — added per-socket rate limits on chat:player-profile (10/10s) and chat:request-history (5/5s) to prevent abuse and information enumeration

Stability

• Clan leave transaction (server/routes/clans.js) — member deletion + ownership transfer + clan disband now wrapped in a single interactive transaction (was sequential, risked leaderless clans on crash)
• Mission progress race condition (server/routes/clans.js) — mission progress reporting now uses an interactive transaction with a fresh read of mission state, preventing concurrent requests from double-completing a mission and duplicating clan XP
• Event listener leak (src/screens/home.js) — CHAT_UPDATED listener was added on every render() call without cleanup; now properly removes the previous listener before adding a new one

Performance

• PvP leaderboard cache (server/routes/pvp.js) — 30-second in-memory cache, invalidated on rated fights. Eliminates redundant DB queries for mostly-static data
• socket.io-client dependency (package.json) — moved from devDependencies to dependencies (correct classification for a runtime dependency)

Test plan

• All 308 existing tests pass (npm test)
• Zero lint errors (npm run lint)
• Production build succeeds (npm run build)
• Verify CSP doesn't block Stripe checkout or Google OAuth flows in production
• Verify clan leave still works correctly (owner transfer, disband)
• Verify mission progress reports correctly with concurrent clan members

🤖 Generated with Claude Code

https://claude.ai/code/session_018UFcpKe77wqjaqWHNPnaZz

---

Generated by Claude Code