Claude
f8bcc7f6a3
- Widen users.role enum to include 'player'; make password_hash nullable; add email/email_verified/status/last_login_ip; pin username _ci collation. - POST /auth/register (honeypot + registerLimiter + botScore, reserved-name blocklist, duplicate->409, auto-login). player_registration setting gates it. - SSO auto-provision in finishLogin (setting-gated); return/portal-aware SSO redirects for the player portal; status refusal on login + requireAuth. - New /player self-service group (account, change username/password, TOTP, identities), reusing account.controller; accountChangeLimiter. - Admin: 'player' role + status/email on user create/update, role/status audit, player_registration enum validation, derived public registration flags. - usernamePolicy module (reserved, sanitize, derive, dedup) + unit tests; extend SSO callback tests. 133 server tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV
20 lines
746 B
JavaScript
20 lines
746 B
JavaScript
const express = require('express')
|
|
|
|
const v1Router = express.Router()
|
|
|
|
const authRouter = require('./auth/auth.routes')
|
|
const publicRouter = require('./public/public.routes')
|
|
const adminRouter = require('./admin/admin.routes')
|
|
const playerRouter = require('./player/player.routes')
|
|
|
|
v1Router.use('/auth', authRouter)
|
|
v1Router.use('/public', publicRouter)
|
|
v1Router.use('/admin', adminRouter)
|
|
v1Router.use('/player', playerRouter)
|
|
// NOTE: /internal is intentionally NOT mounted here. Those routes return the
|
|
// decrypted Discord bot token and must never share the public listener that
|
|
// Pangolin proxies. They live on a separate, unpublished port via
|
|
// server/src/internalApp.js (started in server.js). See issue #33.
|
|
|
|
module.exports = v1Router
|