Merge pull request #6 from darkraise/feature/code-review

Feature/code review

Author: darkraise

.env.example

@@ -47,6 +47,14 @@ OTEL_SERVICE_NAME=flashpoint-web
 OTEL_TRACES_ENABLED=true
 OTEL_METRICS_ENABLED=true
 
+# ---------------------------------------------------------------------------
+# Container User Permissions
+# ---------------------------------------------------------------------------
+# Match your host user to avoid bind-mount permission issues
+# Run 'id -u' and 'id -g' on your host to find your values
+# PUID=1000
+# PGID=1000
+
 # ---------------------------------------------------------------------------
 # Application settings
 # ---------------------------------------------------------------------------

.gitignore

@@ -139,4 +139,6 @@ vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
 .claude/**/*.*
 
-user.db
+user.db
+*.db-shm
+*.db-wal

DOCUMENTATION_UPDATES.md

@@ -76,9 +76,7 @@ WORKDIR /app/backend
 # Expose port
 EXPOSE 3100
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
-  CMD curl --fail http://localhost:3100/health || exit 1
+# Health check is configured in docker-compose.yml for flexibility
 
 # Environment variables
 ENV NODE_ENV=production

backend/Dockerfile

@@ -107,7 +107,7 @@ export const config = {
   // Auto-detected from version.txt; affects metadata sync and image path availability
   flashpointEdition: flashpointVersion.edition,
   flashpointVersionString: flashpointVersion.versionString,
-};
+} as const;
 
 /** Resolves external image CDN URLs from Flashpoint preferences, with hardcoded fallbacks. */
 export async function getExternalImageUrls(): Promise<string[]> {

backend/src/config.ts

@@ -10,6 +10,7 @@ import { setCorsHeaders } from './utils/cors';
 import { sanitizeUrlPath, sanitizeErrorMessage } from './utils/pathSecurity';
 import { validateGameId, validateHostname } from './validation/schemas';
 import { gameDataDownloader } from './services';
+import { DownloadRegistry } from '../services/DownloadRegistry';
 
 /** Escape HTML special characters to prevent XSS */
 function escapeHtml(str: string): string {
@@ -104,18 +105,40 @@ export class GameZipServer {
     }
 
     if (!zipExists && gameId && dateAdded) {
+      // Check shared registry first (prevents duplicate if DownloadManager already downloading)
+      if (DownloadRegistry.isActive(gameId)) {
+        logger.info(
+          `[GameZipServer] Download already in progress for game ${gameId} (via DownloadManager)`
+        );
+        return { success: true, downloading: true, statusCode: 202 };
+      }
+
       if (downloadsInProgress.has(gameId)) {
         logger.info(`[GameZipServer] Download already in progress for game ${gameId}`);
         return { success: true, downloading: true, statusCode: 202 };
       }
 
-      if (downloadsInProgress.size >= MAX_CONCURRENT_DOWNLOADS) {
+      const totalActive = downloadsInProgress.size + DownloadRegistry.getActiveCount();
+      if (totalActive >= MAX_CONCURRENT_DOWNLOADS) {
         logger.warn(
-          `[GameZipServer] Too many concurrent downloads (${downloadsInProgress.size}), rejecting ${gameId}`
+          `[GameZipServer] Too many concurrent downloads (${totalActive}), rejecting ${gameId}`
         );
         return { success: false, statusCode: 503 };
       }
 
+      // Register with shared download registry
+      const registered = DownloadRegistry.register(gameId, {
+        gameId,
+        source: 'game-zip-server',
+      });
+
+      if (!registered) {
+        logger.info(
+          `[GameZipServer] Download already in progress for game ${gameId} (detected by registry)`
+        );
+        return { success: true, downloading: true, statusCode: 202 };
+      }
+
       logger.info(
         `[GameZipServer] ZIP not found locally, starting background download for game ${gameId}`
       );
@@ -280,15 +303,17 @@ export class GameZipServer {
     let fileData = result.data;
     if (ext === 'html' || ext === 'htm') {
       fileData = injectPolyfills(result.data);
-      logger.info(`[GameZipServer] Injected polyfills into HTML file: ${relPath}`);
+      logger.debug(`[GameZipServer] Injected polyfills into HTML file: ${relPath}`);
     }
 
-    logger.info(
+    logger.debug(
       `[GameZipServer] ✓ Serving from ZIP ${result.mountId}: ${relPath} (${fileData.length} bytes)`
     );
 
     const settings = ConfigManager.getSettings();
     setCorsHeaders(res, settings);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
 
     res.setHeader('Content-Type', contentType);
     res.setHeader('Content-Length', fileData.length);
@@ -351,22 +376,27 @@ export class GameZipServer {
           logger.error(
             `[GameZipServer] Downloaded file path outside allowed directory: ${result.filePath}`
           );
+          DownloadRegistry.fail(gameId);
           return;
         }
 
         try {
           await zipManager.mount(mountId, result.filePath);
           logger.info(`[GameZipServer] ✓ ZIP downloaded and mounted for game ${gameId}`);
+          DownloadRegistry.complete(gameId);
         } catch (mountError) {
           const errorMessage = mountError instanceof Error ? mountError.message : 'Mount failed';
           logger.error(`[GameZipServer] Failed to mount downloaded ZIP: ${errorMessage}`);
+          DownloadRegistry.fail(gameId);
         }
       } else {
         logger.error(`[GameZipServer] Download failed for ${gameId}: ${result.error}`);
+        DownloadRegistry.fail(gameId);
       }
     } catch (error) {
       const errorMsg = error instanceof Error ? error.message : 'Unknown error';
       logger.error(`[GameZipServer] Background download error for ${gameId}: ${errorMsg}`);
+      DownloadRegistry.fail(gameId);
     } finally {
       downloadsInProgress.delete(gameId);
     }
@@ -377,6 +407,7 @@ export class GameZipServer {
     for (const [gameId, progress] of downloadsInProgress.entries()) {
       if (now - progress.startTime > DOWNLOAD_STALE_MS) {
         logger.warn(`[GameZipServer] Removing stale download for ${gameId}`);
+        DownloadRegistry.fail(gameId);
         downloadsInProgress.delete(gameId);
       }
     }
@@ -529,6 +560,7 @@ export class GameZipServer {
 
     const settings = ConfigManager.getSettings();
     setCorsHeaders(res, settings);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
 
     res.setHeader('Content-Type', 'text/plain');
     res.writeHead(statusCode);

backend/src/game/gamezipserver.ts

@@ -162,8 +162,7 @@ export class LegacyServer {
     const host = hostname.split(':')[0];
     const relPath = path.posix.join(host, urlPath);
 
-    logger.debug(`[LegacyServer] Serving: ${host}${urlPath}`);
-    logger.debug(`[LegacyServer] Relative path: ${relPath}`);
+    logger.debug(`[LegacyServer] Serving: ${host}${urlPath} (relPath: ${relPath})`);
 
     const pathCandidates = this.buildPathCandidates(relPath, urlPath, settings);
 

backend/src/game/legacy-server.ts

@@ -36,7 +36,7 @@ export class ProxyRequestHandler {
   /** Replicates the request processing flow from Go's goproxy */
   async handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> {
     try {
-      logger.info(`[ProxyHandler] ${req.method} ${req.url}`);
+      logger.debug(`[ProxyHandler] ${req.method} ${req.url}`);
 
       if (!req.url) {
         this.sendError(res, 400, 'Bad Request: No URL');
@@ -139,6 +139,7 @@ export class ProxyRequestHandler {
     const statusCode = result.statusCode || 200;
 
     setCorsHeaders(res, settings);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
 
     res.setHeader('Cache-Control', `public, max-age=${CACHE_MAX_AGE_SECONDS}`);
     if (process.env.NODE_ENV !== 'production') {
@@ -233,6 +234,7 @@ export class ProxyRequestHandler {
 
     const settings = ConfigManager.getSettings();
     setCorsHeaders(res, settings);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
 
     res.setHeader('Content-Type', 'text/plain');
     res.writeHead(statusCode);

backend/src/game/proxy-request-handler.ts

@@ -8,7 +8,7 @@ import net from 'net';
 import dns from 'dns';
 import { promisify } from 'util';
 import { logger } from '../../utils/logger';
-import { PreferencesService, GameDataSource } from './PreferencesService';
+import { PreferencesService, GameDataSource } from '../../services/PreferencesService';
 
 const dnsLookup = promisify(dns.lookup);
 
@@ -103,8 +103,7 @@ export class GameDataDownloader {
 
     logger.info(`[GameDataDownloader] Starting download for ${filename}`);
 
-    const prefsService = PreferencesService.getInstance();
-    const sources = await prefsService.getGameDataSources();
+    const sources = await PreferencesService.getGameDataSources();
 
     if (sources.length === 0) {
       logger.error('[GameDataDownloader] No game data sources configured in preferences.json');
@@ -114,7 +113,7 @@ export class GameDataDownloader {
       };
     }
 
-    const targetDir = params.targetPath || (await prefsService.getDataPacksFolderPath());
+    const targetDir = params.targetPath || (await PreferencesService.getDataPacksFolderPath());
     const targetPath = path.join(targetDir, filename);
     const tempPath = `${targetPath}.temp`;
 
@@ -544,8 +543,7 @@ export class GameDataDownloader {
   async exists(gameId: string, dateAdded: string, targetDir?: string): Promise<boolean> {
     try {
       const filename = GameDataDownloader.getFilename(gameId, dateAdded);
-      const prefsService = PreferencesService.getInstance();
-      const dir = targetDir || (await prefsService.getDataPacksFolderPath());
+      const dir = targetDir || (await PreferencesService.getDataPacksFolderPath());
       const filePath = path.join(dir, filename);
 
       try {
@@ -563,8 +561,7 @@ export class GameDataDownloader {
   async getFilePath(gameId: string, dateAdded: string, targetDir?: string): Promise<string> {
     try {
       const filename = GameDataDownloader.getFilename(gameId, dateAdded);
-      const prefsService = PreferencesService.getInstance();
-      const dir = targetDir || (await prefsService.getDataPacksFolderPath());
+      const dir = targetDir || (await PreferencesService.getDataPacksFolderPath());
       return path.join(dir, filename);
     } catch (error) {
       // getFilename() can throw on invalid dateAdded