Harden gameplay timing and map loading

tests/request-origin.test.ts

@@ -58,6 +58,26 @@ test("the testing switch retains JSON checks for requests without an origin", ()
   );
 });
 
+test("production never enables the environment origin bypass", () => {
+  const env = process.env as Record<string, string | undefined>;
+  const previousNode = env.NODE_ENV,
+    previousBypass = env.MINEGEO_ALLOW_ANY_ORIGIN;
+  try {
+    env.NODE_ENV = "production";
+    env.MINEGEO_ALLOW_ANY_ORIGIN = "true";
+    assert.throws(
+      () =>
+        verifyOrigin(makeRequest("localhost:3000", "https://foreign.example")),
+      /Invalid request origin/,
+    );
+  } finally {
+    if (previousNode === undefined) delete env.NODE_ENV;
+    else env.NODE_ENV = previousNode;
+    if (previousBypass === undefined) delete env.MINEGEO_ALLOW_ANY_ORIGIN;
+    else env.MINEGEO_ALLOW_ANY_ORIGIN = previousBypass;
+  }
+});
+
 test("accepts a Mac LAN origin when Next uses localhost internally", () => {
   const request = makeRequest("192.168.1.50:3000", "http://192.168.1.50:3000");
   assert.equal(requestOrigin(request), "http://192.168.1.50:3000");