John SmithandClaude beef779d51 fix(gateway): strict CORS allowlist, forward caller identity to engine proxies ...

- CORS: replace wildcard origins + credentials with an env-driven
  allowlist (CORS_ALLOW_ORIGINS), mirroring the engine's strict_cors.
- identity: engine proxies (spawn/cast-spell/move/turn-next/damage/
  reactions-arm, plus attack and death-save) now verify the caller's
  token and mint a forwarded-identity HMAC token carrying the real
  user_id and role, so the engine's RBAC authorizes the actual actor.
  Previously every proxied action spoke as 'orchestrator-service' with
  no role and was rejected ENTITY_NOT_OWNED on player-owned entities —
  deployed characters could not be driven end-to-end. Omitting the
  token keeps legacy service-mediated behavior.
- tests: proxy identity forwarding, 401 on invalid tokens, contract
  route updated to act as GM.

Co-Authored-By: Claude <[email protected]>

2026-08-24 00:42:52 -04:00

..

fixtures/srd52_sample

feat(wave8): expand compendium with SRD 5.2 magic items, feats, origins, animals & full stat blocks

2026-08-23 00:27:49 -04:00

test_auth.py

feat(wave15): zero-trust hardening, real WFC, write-through Postgres, RBAC, Yjs default

2026-08-23 22:41:53 -04:00

test_bundle_packager.py

feat(campaign-bundles-homebrew): implement COMPASS .vttbundle packaging, Homebrewery markdown parser, and bundle manager studio

2026-08-22 19:31:12 -04:00

test_campaign_persistence.py

feat(wave12): Postgres persistence & campaign save/load

2026-08-23 10:53:40 -04:00

test_durability_bridge.py

feat(wave15): zero-trust hardening, real WFC, write-through Postgres, RBAC, Yjs default

2026-08-23 22:41:53 -04:00

test_dynasty.py

feat(dynasty-empirical-playtest): implement opendnd dynasty lineages, feud matrix, and dnddata empirical party benchmarks

2026-08-22 19:27:54 -04:00

test_engine_proxy.py

fix(gateway): strict CORS allowlist, forward caller identity to engine proxies

2026-08-24 00:42:52 -04:00

test_lobbies_characters.py

fix(gateway): strict CORS allowlist, forward caller identity to engine proxies

2026-08-24 00:42:52 -04:00

test_narrative_grounding.py

feat(wave11): SRD-grounded narration, end-to-end X-card rewind & honest voice activity

2026-08-23 01:35:50 -04:00

test_orchestrator.py

feat(wave15): zero-trust hardening, real WFC, write-through Postgres, RBAC, Yjs default

2026-08-23 22:41:53 -04:00

test_pdf_export.py

feat(character-builder-pdf): implement 5e character studio, strict modifier graph, and vector PDF exporter

2026-08-22 19:12:08 -04:00

test_quest_engine.py

feat: complete Horizons 1, 2, and 3 (Docker Compose, Procedural Quest Engine & Concordia Pacts, and 3D Elevation)

2026-08-22 19:49:55 -04:00

test_srd52_importer.py

feat(wave8): expand compendium with SRD 5.2 magic items, feats, origins, animals & full stat blocks

2026-08-23 00:27:49 -04:00

test_srd_importer.py

feat(srd): parse D&D 5e SRD markdown into hardcoded VTT core logic, schemas, and relational tables

2026-08-22 19:40:57 -04:00