Security, performance and stability quick wins

[Sparksx]

Summary

Full codebase audit across security, performance, stability, and functionality — followed by implementation of the 16 highest-priority quick wins (high impact, low difficulty).

Security (7 fixes)

• Ban enforcement on HTTP routes — banned users could still save state, fight PvP, join clans, and buy gold via API. Added requireNotBanned middleware on game/clans/pvp/payment routes
• JWT algorithm restriction — jwt.verify() now explicitly requires HS256 on all 3 verification points (access, refresh, socket) to prevent algorithm confusion attacks
• Distinct dev JWT secrets — access and refresh secrets shared the same dev fallback, letting a 30-day refresh token work as an access token
• Content Security Policy — CSP was explicitly disabled in Helmet; enabled with directives for Google OAuth, Stripe, and WebSocket
• PvP rate limiting — added 20 fights/min per IP to prevent rating farming
• Username character validation — restricted to [A-Za-z0-9_\- ] to prevent impersonation ([ADMIN] System) and control characters
• Settings key whitelist — PUT /api/auth/settings now only accepts known keys (theme, language, sfx, music)

Performance (4 fixes)

• HTTP compression — added compression middleware (gzip/brotli)
• Cache-Control headers — Vite hashed assets get max-age=1y, immutable; shell files get 10 min
• Missing DB indexes — User.updatedAt (PvP opponent pool), Mission(clanId, type, status), Purchase.stripePaymentId (refund lookup)
• Parallel DB queries — loadActorAndTarget now uses Promise.all instead of sequential queries

Stability (3 fixes)

• Race conditions in registration & username change — replaced check-then-act pattern with direct create/update + P2002 catch
• Competing shutdown handlers — removed duplicate SIGINT/SIGTERM handler in prisma.js that raced with index.js shutdown
• Token cleanup interval — stored interval ref and cleared on shutdown to prevent post-disconnect DB queries

Functionality (2 fixes)

• PvP defender ELO — both attacker and defender ratings now update (was attacker-only, breaking the ranking system)
• Monster Hunt mission — COMBAT_MONSTER_DEFEATED event was never emitted, making the defeat_enemies mission (target: 1500) impossible to complete

Test plan

• All 524 existing tests pass (npm test)
• Lint clean — no new warnings (npm run lint)
• Production build succeeds (npm run build)
• Verify banned user gets 403 on gameplay API routes
• Verify PvP fight rate limit triggers after 20 fights/min
• Verify username with special characters is rejected at registration
• Verify defender ELO changes after a PvP fight
• Verify defeat_enemies mission progresses after arena wins

---

Generated by Claude Code