v1.1.0: session guard on all game routes + register + sign-in screen (ISS-107)

lib/game/actions.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { and, eq, inArray } from 'drizzle-orm';
+import { requireAuth } from '@/lib/auth';
 import * as schema from '@/lib/db/schema';
 import { getLocalPlayer, updateLocalPlayerEconomy } from '@/lib/db/localPlayer';
 import { persist, type GameDb } from '@/lib/db/client';
@@ -381,7 +382,11 @@ export async function repairPlane(inst: GameDb, planeId: string): Promise<{ cost
 // game time — then respond with the FULL current state snapshot (same shape as
 // GET /api/state), so clients never need a follow-up poll. GameActionError maps to
 // its own status + {error}; anything unexpected is a 500.
-export async function performAction(fn: (inst: GameDb) => Promise<unknown>): Promise<Response> {
+// v1.1.0 (ISS-107): every action route funnels through here, so the requireAuth guard lives in ONE
+// place — 401 before any game mutation when the X-Flight-Session header is missing/unknown/expired.
+export async function performAction(req: Request, fn: (inst: GameDb) => Promise<unknown>): Promise<Response> {
+  const auth = await requireAuth(req);
+  if (!auth.ok) return auth.response;
   try {
     await runAction(fn);
     return Response.json(await getStateSnapshot());