Files
gupi-osint-board/server
gitprovandClaude Opus 4.8 5754fa1f55 Auth slice 3: dev-only fallback + playthrough owner checks
resolveUserId now returns null for an anonymous request in production (no
shared identity); the fixed dev user only applies locally. Player-scoped
routes (create/advance/goto, achievements, reach, notebook, phone, dial)
require a user and verify ownership via ownsPlaythrough — a player can no
longer read or act on another's playthrough. Verified: dev anon still plays;
cross-user access returns 403/404.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-22 22:39:52 +02:00
..
2026-08-17 09:24:53 +02:00