- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD
- Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET
- Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD
- Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD
- Update .env.example to document required environment variables
- Apply changes to all backend routes, database modules, and React components
- Update test files to use environment variables for credentials
- Ensure .env remains in .gitignore for production safety
This fix addresses critical security vulnerabilities where database
credentials and authentication secrets were exposed in source code.
- Updated `requireSession.js` to ensure `req.body` and `req.query` are always objects before access, improving robustness against malformed requests.
- Changed API endpoint for login from `/api/sessions/login` to `/api/players/login` in `App.js`, updating related logging and state management to reflect the new structure.
- Enhanced player fetching logic in `PlayerTab.jsx` to handle cases where GM is logged in, ensuring all players are fetched from the API. Added debug logging for better traceability.
- Implemented fallback to stored player data if API fetch fails, ensuring a smoother user experience for regular players.
- Updated local storage handling to accommodate changes in player data structure.
