desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

app/api/game/[id]/route.test.ts

@@ -0,0 +1,53 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { GET } from "@/app/api/game/[id]/route";
+
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+});
+
+function contextWith(id: string) {
+    return { params: Promise.resolve({ id }) };
+}
+
+function requestWith(url: string) {
+    return new Request(url);
+}
+
+describe("GET /api/game/[id]", () => {
+    it("returns 400 for non-numeric ids", async () => {
+        const response = await GET(
+            requestWith("https://fristy.net/api/game/abc"),
+            contextWith("abc"),
+        );
+        expect(response.status).toBe(400);
+        expect(response.headers.get("Access-Control-Allow-Origin")).toBe("https://fristy.net");
+    });
+
+    it("returns 404 when no profile resolves", async () => {
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => ({ ok: false, status: 404 })),
+        );
+        const response = await GET(
+            requestWith("https://fristy.net/api/game/123"),
+            contextWith("123"),
+        );
+        expect(response.status).toBe(404);
+    });
+
+    it("returns 502 when upstream networking fails", async () => {
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => {
+                throw new Error("down");
+            }),
+        );
+        const response = await GET(
+            requestWith("https://fristy.net/api/game/123"),
+            contextWith("123"),
+        );
+        expect(response.status).toBe(502);
+        expect(response.headers.get("Access-Control-Allow-Origin")).toBe("https://fristy.net");
+    });
+});

app/api/game/[id]/route.ts

@@ -1,44 +1,37 @@
-import { NextResponse } from "next/server";
-import { corsHeaders, forbidden, isAllowedOrigin } from "@/lib/api-cors";
-import { getGameProfile } from "@/lib/game-profile";
+import {
+    invalidIdResponse,
+    jsonErrorWithCors,
+    jsonWithCors,
+    parseAppId,
+    requestOrigin,
+} from "@/lib/api-route";
+import { resolveGameLocale } from "@/lib/game/game-format";
+import { getGameProfile } from "@/lib/game/game-profile";
+import { warnDev } from "@/lib/log";
+import type { NextResponse } from "next/server";
 
-export async function OPTIONS(request: Request) {
-    if (!isAllowedOrigin(request)) {
-        return forbidden();
-    }
-    return new NextResponse(null, {
-        status: 204,
-        headers: {
-            ...corsHeaders(),
-            "Access-Control-Allow-Methods": "GET, OPTIONS",
-            "Access-Control-Max-Age": "86400",
-        },
-    });
-}
-
-export async function GET(request: Request, context: { params: Promise<{ id: string }> }) {
-    if (!isAllowedOrigin(request)) {
-        return forbidden();
-    }
-    const { id } = await context.params;
-    if (!/^\d+$/.test(id)) {
-        return NextResponse.json({ error: "Invalid application id" }, { status: 400 });
+export async function GET(
+    request: Request,
+    context: { params: Promise<{ id: string }> },
+): Promise<NextResponse> {
+    const origin = requestOrigin(request);
+    const id = await parseAppId(context);
+    if (!id) {
+        return invalidIdResponse(origin);
     }
     const { searchParams } = new URL(request.url);
-    const country = /^[A-Z]{2}$/.test(searchParams.get("country") ?? "")
-        ? (searchParams.get("country") as string)
-        : "TR";
-    const lang = ["tr", "en", "de"].includes(searchParams.get("lang") ?? "")
-        ? (searchParams.get("lang") as string)
-        : "en";
-    const profile = await getGameProfile(id, country, lang);
-    if (!profile) {
-        return NextResponse.json({ error: "Game not found" }, { status: 404 });
+    const countryRaw = searchParams.get("country") ?? "";
+    const country = /^[A-Z]{2}$/.test(countryRaw) ? countryRaw : "TR";
+    const { lang } = resolveGameLocale(searchParams.get("lang") ?? "");
+    let profile;
+    try {
+        profile = await getGameProfile(id, lang, country);
+    } catch (error) {
+        warnDev(`game upstream failed: ${id} -> ${error instanceof Error ? error.message : error}`);
+        return jsonErrorWithCors({ error: "Upstream unavailable" }, 502, 60, origin);
     }
-    return NextResponse.json(profile, {
-        headers: {
-            "Cache-Control": "public, s-maxage=3600, stale-while-revalidate=86400",
-            ...corsHeaders(),
-        },
-    });
+    if (!profile) {
+        return jsonErrorWithCors({ error: "Game not found" }, 404, 60, origin);
+    }
+    return jsonWithCors(profile, 3600, origin);
 }