Security, stability & performance quick wins

[Sparksx]

Summary

Comprehensive audit of the game across 4 axes (security, performance, stability, functionality) followed by implementation of the highest-priority quick wins — changes that are high-impact but low-risk.

Security

• Enable CSP — contentSecurityPolicy: false replaced with a game-appropriate directive set (scripts, styles, connect-src for OAuth/Stripe/WS)
• Hash refresh tokens — SHA-256 hash stored in DB instead of raw JWT; protects all sessions if the database is ever compromised
• PvP rate limit — dedicated 20 req/min limiter on POST /api/pvp/fight to prevent Elo farming (was only covered by the global 100/min)
• Username format — restrict to [A-Za-z0-9_.-] on register and change-username to prevent homoglyph spoofing
• Settings whitelist — PUT /api/auth/settings now rejects unknown keys instead of merging arbitrary JSON

Stability

• Expedition join race condition — slot count is now checked with count() inside the interactive transaction instead of using a pre-loaded _count that could be stale under concurrent joins
• Clan leave atomicity — member deletion + ownership transfer now wrapped in a single transaction (previously the clan was in an inconsistent state between the two operations)
• Home screen listener leak — CHAT_UPDATED handler accumulated on every tab switch; now properly cleaned up in onHide()
• Dead code removal — unused shopState extraction removed from game state save endpoint

Performance & DB

• Missing index: User.updatedAt — used by PvP opponent search (ORDER BY updatedAt DESC LIMIT 100); was a sequential scan
• Missing index: RefreshToken.expiresAt — used by the daily cleanup job

Functionality

• PvP leaderboard pagination — supports ?page=&limit=, returns total count and the caller's own rank
• Chat message cleanup — periodic job (startup + every 24h) prunes messages older than 30 days to prevent unbounded DB growth

Test plan

• All 308 existing tests pass (npm test)
• ESLint clean (0 errors, only pre-existing warnings)
• Vite production build succeeds
• Verify refresh token rotation still works (existing tokens will need re-login after deploy since stored hashes change format)
• Verify CSP doesn't block OAuth popups or Stripe checkout in production
• Verify PvP leaderboard pagination renders correctly on the client (client may need a follow-up to use the new paginated response shape)

🤖 Generated with Claude Code

https://claude.ai/code/session_01F16HznhBWwnw2J8unBvXr3

---

Generated by Claude Code