Masoi Perf Security

Ma Sói Performance & Security Auditor

Workflow

1. Read server/index.js for socket handlers, timer patterns, and room lifecycle.
2. Read server/db/redis.js and server/db/postgres.js for data access patterns.
3. Read server/gameEngine.js for input validation in role assignment.
4. Check the change against references/security-checklist.md.
5. After edits, verify:
   • node --check server/index.js
   • node --check server/gameEngine.js
   • cd client && npm run build if client changed.

Security Rules

• Never trust client-sent userId without server-side validation against socket session.
• All socket event handlers must validate room existence, player membership, and phase before acting.
• Rate limit socket events to prevent spam and DDoS (especially send_message, night_action, cast_vote).
• Production must NOT use cors: { origin: '*' } — restrict to known domains.
• Bcrypt salt rounds should be at least 10 (currently OK).
• Never expose full room state including all player roles to non-admin clients.

Performance Rules

• Every setTimeout must be cancellable and tracked — stale timers from old rounds must not fire.
• Room zombie detection: rooms with all players disconnected should be cleaned up within a bounded time.
• Redis saveRoom calls should be batched or debounced where possible to reduce write pressure.
• roomLocks Map must not grow unbounded — ensure cleanup after lock release.
• Client setInterval for timer countdown must be cleared on component unmount and phase change.
• Wolf chat and public chat arrays are capped at 200 — verify no unbounded growth paths.

Common Vulnerability Patterns

• Forged userId in socket events bypassing auth.
• Concurrent resolveNight / resolveVote causing double kills or double state transitions.
• Timer stacking: multiple scheduleNight or scheduleVote calls for the same round.
• Room state corruption from race conditions in withRoomLock edge cases.
• Stale user:{id}:room mappings blocking room creation/joining.

References

Load references/security-checklist.md when auditing security or performance.