Completed Tasks

Recent Completions

All detailed task entries have been archived to their respective epic files above. See individual epics for full functional changelogs.

2026-01-27

• CF-WORKER-SECURITY: Vulnerability Remediation - Fixed Critical Shop API race conditions (Atomic D1), secured account-api pricing (Server-side validation), and hardened ticket-api (Auth + Rate Limits).
• CF-WORKER-AUDIT: Deep Dive Security Audit & Remediation (Completed 2026-01-27)
  • Scope: ticket-api, account-api, shop-api (Cloudflare Workers).
  • Vulnerabilities Fixed:
    • AI Prompt Injection: Sanitized XML inputs in ticket-api to prevent LLM manipulation.
    • PII Leakage: Implemented AES-256-GCM encryption for emails/names in support_tickets (D1).
    • Commerce Exploits: Enforced strict positive integer validation for quantities and server-side price verification for all items.
    • Public Access: Secured GET /tickets with X-API-Key (Admin only).
    • Weak Webhooks: Enforced HMAC-SHA256 signature verification for Cashfree webhooks.
    • Internal Trust: Injected X-Service-Secret for service-to-service calls (ticket-api -> loh-apis).
  • Outcome: 0 Critical, 0 High, 0 Medium issues remaining. All workers redeployed.
• WEB-TEST-COVERAGE: E2E & Unit Test Expansion - Migrated wiki tests to loh-wiki, added component unit tests, expanded E2E coverage. (Archived to epic_website.md)
• SIM-FIDELITY: Inventory Reality - Implemented detailed inventory tracking (using Vec<InventoryItem>), consumption checks, and full inventory logic.
• SIM-FIDELITY: Real Banking - Implemented real banking packet flow (OpenBank -> DepositItem loop) and removed legacy cheats.
• SIM-FIDELITY: Combat Depth - Implemented ActivatePrayer / DeactivatePrayer actions.
• SIM-FIDELITY: Social Systems - Implemented AcceptPartyInvite and InviteToParty actions.
• WEB-TEST-COVERAGE: Critical E2E Gaps - Implemented full E2E suites for Auth (Login/Register), Checkout (Payment Flow), Dashboard (Profile/Stats), and Admin, with >80% coverage on core flows. verified against Production Build.
• WEB-PRICING-IMPLEMENTATION: Store Pricing & Currency - Implemented region-aware pricing (INR/USD), verified lib/currency.ts, added unit tests, and fixed E2E tests for the Store page (switched to regex route matching).
• GEM-ECOSYSTEM: The Ultimate Chase - Implemented legendary gems (Syamantaka, Kaustubha, Trimurti).
  • World: Placed Vishnu Statue at GE (0,0,0) with InteractWorldObject handler opening GemSocketing UI.
  • Items: Added charges and GemState to Amulet struct. Implemented Op2 ("Check") to display charges.
  • PvP: Implemented Trimurti shatter mechanic (item destroyed on death).
  • Fix: Resolved PvP equipment persistence bug by implementing EquipmentManager::unequip_all and risk pool inclusion in PlayerActor::apply_damage.

2026-01-28

• SIM-FIDELITY: Realism & Social - Replaced "god mode" bot logic with real packet flows.
  • Inventory: Implemented authoritative Vec<InventoryItem> tracking via InventoryUpdate packets.
  • Banking: Added is_bank_open state, slot-based withdrawals, and "Restock" behavior sequence (Walk -> Open -> Deposit -> Withdraw).
  • Combat: Verified potion consumption checks inventory; implemented Combat Style switching.
  • Social: Implemented AddFriend and TradeRequest actions using shared protocol messages.
• SECURITY-AUDIT-2: Vulnerability Fixes - Fixed Critical open redirect (login), High timing attacks (kb/reservation/ticket APIs), and Medium XSS risk (markdown sanitization). Verified with tests.
• PERF-AUDIT: Performance Audit & Wiki Cleanup
  • Performance: Fixed Critical N+1 queries in account-api checkout (O(N) -> O(1) batching).
  • Optimization: Enabled Cloudflare Image Resizing (loh-website & loh-wiki), compressed heavy assets.
  • Cleanup: Removed ~60 legacy wiki files from loh-website to enforce separation of concerns.
  • Deploy: Deployed loh-wiki (updated config), loh-website (optimized), and loh-ops-tools to Cloudflare.
• ENV-SETUP: Founders Pack Fix & Stage/Prod Setup
  • Config: Configured distinct Stage and Production environments in wrangler.toml for loh-website, loh-wiki, loh-ops-tools, and all loh-cf-workers (shop, kb, ticket, account, reservation).
  • Fix: Resolved missing Founders Packs by pointing loh-website to shop-api correctly via NEXT_PUBLIC_SHOP_API_URL.
  • Lint: Fixed critical lint errors in loh-website (admin/ops hoisting, fixtures.ts hooks, coverage.ts types).

2026-01-26

• (Archived to Epics)

2026-01-25

• (Archived to Epics)

2026-01-23

• (Archived to Epics)

2026-01-22

• (Archived to Epics)

2026-01-21

• (Archived to Epics)