desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/api-route.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+import { invalidIdResponse, jsonErrorWithCors, jsonWithCors, parseAppId } from "@/lib/api-route";
+
+function contextWith(id: string) {
+    return { params: Promise.resolve({ id }) };
+}
+
+describe("parseAppId", () => {
+    it("accepts numeric ids", async () => {
+        await expect(parseAppId(contextWith("12345"))).resolves.toBe("12345");
+    });
+
+    it("rejects non-numeric ids", async () => {
+        await expect(parseAppId(contextWith("abc"))).resolves.toBeNull();
+        await expect(parseAppId(contextWith(""))).resolves.toBeNull();
+    });
+});
+
+describe("invalidIdResponse", () => {
+    it("returns a 400 JSON response", async () => {
+        const response = invalidIdResponse();
+        expect(response.status).toBe(400);
+        await expect(response.json()).resolves.toEqual({ error: "Invalid application id" });
+    });
+});
+
+describe("jsonErrorWithCors", () => {
+    it("sets status, cache, and CORS headers", async () => {
+        const response = jsonErrorWithCors({ error: "Nope" }, 404);
+        expect(response.status).toBe(404);
+        expect(response.headers.get("Cache-Control")).toContain("s-maxage=60");
+        expect(response.headers.get("Access-Control-Allow-Origin")).toBe("https://fristy.net");
+        await expect(response.json()).resolves.toEqual({ error: "Nope" });
+    });
+});
+describe("jsonWithCors", () => {
+    it("sets cache and CORS headers", async () => {
+        const response = jsonWithCors({ ok: true }, 3600);
+        expect(response.headers.get("Cache-Control")).toContain("s-maxage=3600");
+        expect(response.headers.get("Access-Control-Allow-Origin")).toBe("https://fristy.net");
+        await expect(response.json()).resolves.toEqual({ ok: true });
+    });
+
+    it("echoes a validated dev origin instead of the production URL", async () => {
+        const response = jsonWithCors({ ok: true }, 3600, "http://localhost:3000");
+        expect(response.headers.get("Access-Control-Allow-Origin")).toBe("http://localhost:3000");
+    });
+
+    it("falls back to production for untrusted origins", async () => {
+        const response = jsonWithCors({ ok: true }, 3600, "https://evil.example");
+        expect(response.headers.get("Access-Control-Allow-Origin")).toBe("https://fristy.net");
+    });
+});