v1.1.0: session guard on all game routes + register + sign-in screen (ISS-107)

app/api/events/route.ts

@@ -1,3 +1,4 @@
+import { requireAuthSse } from '@/lib/auth';
 import { getStateSnapshot, sseFrame } from '@/lib/game/state';
 import { subscribe } from '@/lib/sse';
 
@@ -5,12 +6,19 @@ import { subscribe } from '@/lib/sse';
 // then one after every sim tick (broadcast from lib/sim/engine.ts). One-way push; player actions
 // stay REST POSTs. Heartbeats keep idle proxies from dropping the connection. ISS-133 (v0.59.0):
 // frames carry the sseFrame projection (terminal package history dropped) — same shape as the
-// pushed frames, so a connect never costs one full-history frame.
+// pushed frames, so a connect never costs one full-history frame. v1.1.0 (ISS-107): guarded —
+// EventSource cannot set headers, so the session comes from X-Flight-Session OR ?session=
+// (requireAuthSse). ponytail: validated at CONNECT only — a session deleted/expired mid-stream keeps
+// receiving pushes until it reconnects (private infra, 7-day sessions; per-push re-validation would
+// be one indexed lookup per tick if that ever matters).
 
 const encoder = new TextEncoder();
 const HEARTBEAT_MS = 15_000;
 
-export async function GET() {
+export async function GET(req: Request) {
+  const auth = await requireAuthSse(req);
+  if (!auth.ok) return auth.response;
+
   let heartbeat: ReturnType<typeof setInterval> | null = null;
   let unsubscribe: (() => void) | null = null;
   const cleanup = () => {