58 lines
3.6 KiB
Markdown
58 lines
3.6 KiB
Markdown
# Map and production audit — October 5, 2026
|
|
|
|
Tracked in [Linear DUN-30](https://linear.app/dungeons-and-projects/issue/DUN-30/fix-map-and-gameplay-bugs-and-prepare-minegeo-for-production).
|
|
|
|
## Fixes
|
|
|
|
- Panorama viewers own and release their textures on unmount. Failed and stalled
|
|
loads release completed and late-arriving faces. There is no unbounded global
|
|
cache of every panorama and rotating signed URL.
|
|
- Map-image failures and stalled loads show a retry control, including results.
|
|
Map cleanup is installed before image initialization. Resizing keeps the map
|
|
fitted or preserves the player's view. Keyboard users can pan with arrow keys
|
|
and press Enter to place a pin at the center.
|
|
- Countdown synchronization accounts for request latency and uses a monotonic
|
|
clock. Submission has an immediate lock, failed timeout requests stop retrying
|
|
behind an error dialog, current-round points update immediately, and timeout
|
|
results do not retain an unsubmitted pin.
|
|
- Session media signing uses a single batch for the map and 30 faces. Catalog
|
|
signing deduplicates images. Existing revision/media authorization is retained.
|
|
- Missing/invalid map IDs get a 404; backend failures reach the retryable error
|
|
boundary. The error page now uses Next.js 16.3's `retry()` to fetch fresh data.
|
|
Database transport/schema errors return 503 without exposing their internals.
|
|
- All API responses prevent caching, guest HTTPS cookies respect the configured
|
|
proxy origin, production disables the origin bypass, and baseline browser
|
|
security headers are configured. Startup validates environment, heap and
|
|
panorama size before launching either process.
|
|
- Client requests explain offline, timeout and non-JSON gateway errors. Catalog
|
|
searches trim whitespace, source/result selection exposes pressed state,
|
|
successful dashboard refreshes clear stale errors, and sign-out failures stay
|
|
visible. Results now label the dashboard link accurately as My maps.
|
|
|
|
## Validation
|
|
|
|
- 63 Node regression tests passed, including new client-error, texture-disposal,
|
|
clock, startup-config, backend-error and production-origin tests.
|
|
- TypeScript checking and the optimized Next.js 16.3.8 production build passed.
|
|
- The HTTP/API/Storage smoke passed against both development and compiled
|
|
production servers with the configured backend. It exercised pages/JARs,
|
|
headers, privacy, signed map/cubemap downloads, five rounds, duplicate requests,
|
|
out-of-bounds rejection and foreign-origin denial, then deleted its test games.
|
|
- Codex's built-in browser verified the live homepage/catalog, trimmed search,
|
|
hard-mode panorama and timeout, game reload/results and result-round selection.
|
|
A separate local fixture verified failed map images, successful retry, keyboard
|
|
guessing and rectangular-map resizing. Browser checks found no uncaught errors.
|
|
- The production npm dependency audit reported zero known vulnerabilities.
|
|
- The Supabase security advisor and a permissions query confirmed public workflow
|
|
RPCs use invoker security and deny anon/authenticated execution. Informational
|
|
no-policy notices concern deliberately server-only RLS tables.
|
|
|
|
## Launch requirements and limits
|
|
|
|
Leaked-password protection remains disabled in the configured Supabase project;
|
|
it must be enabled in provider settings where the plan supports it. Production
|
|
SMTP, emailed login/recovery delivery, public HTTPS/proxy configuration and
|
|
restoration from backups were not exercised in this local audit. No deployment,
|
|
new Minecraft client capture, or cross-platform worker benchmark was performed.
|
|
Follow [the production guide](production.md) before public launch.
|