Remove MongoDB; add PM2 scripts, CI, tests; fix PlayerTab hooks; add pm2 smoke-test

tests/rules.test.js

@@ -0,0 +1,43 @@
+jest.setTimeout(20000);
+const { execSync } = require('child_process');
+const path = require('path');
+
+describe('Rules endpoints', () => {
+  const baseURL = process.env.API_BASE || 'http://localhost:5000';
+  const gmHeaders = `-H "x-gm-secret: ${process.env.GM_PASSWORD || 'bongo'}"`;
+
+  const curl = (method, url, data = null, headers = '') => {
+    const command = `curl -s -X ${method} ${headers} -H "Content-Type: application/json" ${data ? `-d '${JSON.stringify(data)}'` : ''} ${url}`;
+    try {
+      const result = execSync(command, { encoding: 'utf-8' });
+      return JSON.parse(result || '{}');
+    } catch (error) {
+      if (error.stdout) {
+        try { return JSON.parse(error.stdout); } catch (e) { /* ignore */ }
+      }
+      throw error;
+    }
+  };
+
+  test('categories, search, random and stats endpoints respond', () => {
+    const cats = curl('GET', `${baseURL}/api/rules/categories`);
+    expect(Array.isArray(cats)).toBe(true);
+
+    const search = curl('GET', `${baseURL}/api/rules/search?q=test`);
+    expect(Array.isArray(search)).toBe(true);
+
+    const randomRes = curl('GET', `${baseURL}/api/rules/random`);
+    expect(Array.isArray(randomRes)).toBe(true);
+
+    const stats = curl('GET', `${baseURL}/api/rules/stats`);
+    expect(stats && typeof stats.totalRules === 'number').toBe(true);
+
+    // Try reload without proper GM secret should fail
+    const reloadFail = curl('POST', `${baseURL}/api/rules/reload`);
+    expect(reloadFail && reloadFail.error).toBeTruthy();
+
+    // Reload with GM secret
+    const reloadOk = curl('POST', `${baseURL}/api/rules/reload`, null, gmHeaders);
+    expect(reloadOk && typeof reloadOk.success === 'boolean').toBe(true);
+  });
+});

tests/shop.test.js

@@ -0,0 +1,42 @@
+jest.setTimeout(20000);
+const { execSync } = require('child_process');
+
+describe('Shop endpoints (public and protected)', () => {
+  const baseURL = process.env.API_BASE || 'http://localhost:5000';
+  const gmHeaders = `-H "x-gm-secret: ${process.env.GM_PASSWORD || 'bongo'}"`;
+  const mockPlayer = 'shoptestplayer';
+
+  const curl = (method, url, data = null, headers = '') => {
+    const command = `curl -s -X ${method} ${headers} -H "Content-Type: application/json" ${data ? `-d '${JSON.stringify(data)}'` : ''} ${url}`;
+    try {
+      const result = execSync(command, { encoding: 'utf-8' });
+      return JSON.parse(result || '{}');
+    } catch (error) {
+      if (error.stdout) {
+        try { return JSON.parse(error.stdout); } catch (e) { /* ignore */ }
+      }
+      throw error;
+    }
+  };
+
+  test('public items endpoints work and protected inventory requires auth', () => {
+    const items = curl('GET', `${baseURL}/api/shop/items`);
+    expect(Array.isArray(items)).toBe(true);
+
+    const category = curl('GET', `${baseURL}/api/shop/items/category/Gear`);
+    expect(Array.isArray(category)).toBe(true);
+
+    // create player to ensure inventory exists
+    try { curl('DELETE', `${baseURL}/api/players/${mockPlayer}`, null, gmHeaders); } catch (e) {}
+    const created = curl('POST', `${baseURL}/api/players`, { name: mockPlayer, rp: 20, pw: 'pw' }, gmHeaders);
+    expect(created.name).toBe(mockPlayer);
+
+    // Inventory without session should be protected (requireSession returns 403 or similar)
+    const invNoAuth = curl('GET', `${baseURL}/api/shop/inventory/${mockPlayer}`);
+    // invNoAuth should be an error object or not an array
+    expect(Array.isArray(invNoAuth)).toBe(false);
+
+    // cleanup
+    curl('DELETE', `${baseURL}/api/players/${mockPlayer}`, null, gmHeaders);
+  });
+});