v1.1.0: session guard on all game routes + register + sign-in screen (ISS-107)

app/api/packages/[id]/abandon/route.test.ts

@@ -6,15 +6,19 @@ import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import * as schema from '@/lib/db/schema';
 import { getLocalPlayer } from '@/lib/db/localPlayer';
 import { getGameDb } from '@/lib/db/client';
+import { createSession } from '@/lib/auth';
 import { POST } from './route';
 
 let dir: string;
+let sessionId: string;
 
 beforeAll(async () => {
   // Same pattern as app/api/state/route.test.ts: point the DB singleton at a
   // throwaway file (fresh module registry per test file → fresh singleton).
   dir = await fs.mkdtemp(path.join(os.tmpdir(), 'flight-abandon-api-'));
   process.env.FLIGHT_DB_PATH = path.join(dir, 'abandon.db');
+  // v1.1.0 (ISS-107): action routes are session-guarded — mint a session for the seeded admin user.
+  sessionId = await createSession(await getGameDb(), 'admin-kamilkrzywda');
 });
 
 afterAll(async () => {
@@ -22,9 +26,11 @@ afterAll(async () => {
   await fs.rm(dir, { recursive: true, force: true });
 });
 
-const post = (id: string) => POST(new Request(`http://localhost/api/packages/${id}/abandon`, { method: 'POST' }), {
-  params: Promise.resolve({ id }),
-});
+const post = (id: string) =>
+  POST(
+    new Request(`http://localhost/api/packages/${id}/abandon`, { method: 'POST', headers: { 'X-Flight-Session': sessionId } }),
+    { params: Promise.resolve({ id }) },
+  );
 
 // Insert a LOADED package bound to the starter plane with a long deadline. Returns
 // the exact created/deadline times so tests can compute the penalty from the

app/api/packages/[id]/abandon/route.ts

@@ -7,7 +7,7 @@ import { abandonPackage, performAction } from '@/lib/game/actions';
 // id; 409 wrong status or the plane is in flight. On success returns the full
 // state snapshot.
 
-export async function POST(_req: Request, ctx: { params: Promise<{ id: string }> }) {
+export async function POST(req: Request, ctx: { params: Promise<{ id: string }> }) {
   const { id } = await ctx.params;
-  return performAction((inst) => abandonPackage(inst, id));
+  return performAction(req, (inst) => abandonPackage(inst, id));
 }

app/api/packages/[id]/load/route.test.ts

@@ -5,15 +5,19 @@ import { eq } from 'drizzle-orm';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import * as schema from '@/lib/db/schema';
 import { getGameDb } from '@/lib/db/client';
+import { createSession } from '@/lib/auth';
 import { POST } from './route';
 
 let dir: string;
+let sessionId: string;
 
 beforeAll(async () => {
   // Same pattern as app/api/state/route.test.ts: point the DB singleton at a
   // throwaway file (fresh module registry per test file → fresh singleton).
   dir = await fs.mkdtemp(path.join(os.tmpdir(), 'flight-load-api-'));
   process.env.FLIGHT_DB_PATH = path.join(dir, 'load.db');
+  // v1.1.0 (ISS-107): action routes are session-guarded — mint a session for the seeded admin user.
+  sessionId = await createSession(await getGameDb(), 'admin-kamilkrzywda');
 });
 
 afterAll(async () => {
@@ -22,9 +26,14 @@ afterAll(async () => {
 });
 
 const post = (id: string, body: unknown) =>
-  POST(new Request(`http://localhost/api/packages/${id}/load`, { method: 'POST', body: JSON.stringify(body) }), {
-    params: Promise.resolve({ id }),
-  });
+  POST(
+    new Request(`http://localhost/api/packages/${id}/load`, {
+      method: 'POST',
+      headers: { 'X-Flight-Session': sessionId },
+      body: JSON.stringify(body),
+    }),
+    { params: Promise.resolve({ id }) },
+  );
 
 describe('POST /api/packages/:id/load', () => {
   it('rejects a missing/non-string planeId and unknown fields with 400', async () => {

app/api/packages/[id]/load/route.ts

@@ -31,5 +31,5 @@ export async function POST(req: Request, ctx: { params: Promise<{ id: string }>
   }
 
   const planeId = input.planeId;
-  return performAction((inst) => loadPackage(inst, id, planeId));
+  return performAction(req, (inst) => loadPackage(inst, id, planeId));
 }