John SmithandClaude 7f592fe7a8 fix(gateway): audit remediation — session-state auth, ledger redaction, IDOR (iteration 44) ...

Second independent audit findings, fixed red-first:
- HIGH: /engine/session-state required no token and returned FULL
  engine state verbatim via a service-principal fallback. The route
  now requires valid auth (401 otherwise) and no code path returns
  anonymous full state.
- MED-HIGH: ledger events bypassed role projection, leaking HP/damage
  numbers for hidden entities while replay export redacted them. Both
  now share one projection policy (fail-closed summaries for
  spectators/unknown roles).
- MED: GET /characters/{id} had an IDOR — any authenticated user could
  read any character; now owner-scoped with 404 for foreign/garbage ids
  (no existence oracle).
Six remediation tests verified failing before each fix.

Co-Authored-By: Claude <[email protected]>

2026-08-24 05:32:46 -04:00

..

tests

fix(gateway): audit remediation — session-state auth, ledger redaction, IDOR (iteration 44)

2026-08-24 05:32:46 -04:00

vtt_orchestrator

fix(gateway): audit remediation — session-state auth, ledger redaction, IDOR (iteration 44)

2026-08-24 05:32:46 -04:00

pyproject.toml

feat(wave13): UI/UX hardening — code splitting, dice history, a11y & honest ambience

2026-08-23 15:16:15 -04:00