4 Commits

Include renames

Author	SHA1	Message	Date
Keith Solomon	44199ec0a8	chore: address Plan 4 deferred-minors (stale-cookie cleanup pass) ... - Rename $secret to $csrfSecret in public/index.php to make intent clear at every call site; the value is the CSRF/turn-token HMAC key, not just 'the secret'. - Drop the stale 'Configure the router with the eight routes' comment in public/index.php; the router now has sixteen routes. - Drop the duplicate .bf-toast rule in public/assets/styles.css; the second declaration (the new yellow box) is the active one, the first (legacy green pill) is dead code from the editor era. - Add a trailing newline to src/Views/home.php. - Tighten the matchId regex in two tests from {16,} to {16} since bin2hex(random_bytes(8)) always produces exactly 16 hex chars; the spec's {16,} stays in production TurnToken. No behavior changes; addresses the deferred-minors parked during per-task review.	2026-07-26 16:38:05 -05:00
Keith Solomon	2ea8cfd83d	fix: CSRF flow ships the raw token, not the HMAC cookie	2026-07-26 11:01:36 -05:00
Keith Solomon	9314fc5870	feat: mint matchId and turnToken in PostStartMatch	2026-07-25 22:52:34 -05:00
Keith Solomon	2dc7bc1130	feat: add image upload and start-match handlers	2026-07-06 22:24:07 -05:00