Security, performance, and stability quick wins

[Sparksx]

Summary

Comprehensive audit of the Gear Master codebase across security, performance, stability, and functionality — followed by implementation of all high-priority quick wins (low effort, high impact).

Security fixes

• Ban enforcement on HTTP API routes (critical) — banned users were only blocked from Socket.io connections, not REST endpoints. They could still save game state, buy gold, operate in clans, and fight PvP. Added a banGuard middleware to all gameplay routes.
• Content Security Policy enabled — helmet was configured with contentSecurityPolicy: false, removing all browser-level XSS protection. Now sets a functional CSP allowing self, Stripe, Google, Discord, and necessary inline styles.
• Stripe redirect URL hardened — success_url/cancel_url were built from client-supplied Origin/Referer headers (phishing risk). Now uses server-configured CORS_ORIGIN.
• Rate limiting on /refresh — was missing the authLimiter applied to all other auth endpoints.
• Settings key whitelist — PUT /api/auth/settings accepted arbitrary JSON keys. Now only allows known keys (theme, language, sfx, music, notifications).
• Distinct JWT dev secrets — JWT_SECRET and JWT_REFRESH_SECRET shared the same fallback value in development, enabling token confusion.

Performance fixes

• Lightweight clan listing query — GET /api/clans was loading full member equipment JSON (hundreds of KB) for all 25 clans when only memberCount is needed for the list view.
• Cache-Control headers on monster templates, sprites, and payment packs (static data, 1h TTL).
• Static asset caching — express.static now sets maxAge: '1d' + etag: true in production.
• Parallelized socket middleware — ban check + role fetch now use Promise.all instead of sequential queries.

Stability fixes

• Interval cleanup on shutdown — setInterval handles for token cleanup (24h) and combat log cleanup (1h) are now stored and cleared during graceful shutdown.
• Removed duplicate Prisma shutdown handlers that could race with the main shutdown() function and bypass io.close()/server.close().

Test plan

• All 524 tests pass (npm test)
• Linter passes with zero errors (npm run lint)
• Production build succeeds (npm run build)
• Verify banned user receives 403 on game/clan/pvp/payment API calls
• Verify CSP headers present in production response
• Verify Stripe checkout redirects to configured origin, not spoofed header
• Verify clan listing response size is significantly smaller

🤖 Generated with Claude Code

https://claude.ai/code/session_019E8KUzJGkSxnfmeDY8KPG8

---

Generated by Claude Code