alex ad7ce9dc22 Security fix: GM authorized from server-side session via x-session-id header ...

- New database/auth.js: shared server-side GM check using session store
- database/server.js: crypto-random session generation, server-side session
  storage, GM auth from session instead of x-gm-secret header
- database/routes/playerRoutes.js: GM-only endpoints use server-side auth
- database/routes/sessionRoutes.js: session creation/lookup endpoints
- database/routes/bestiaryRoutes.js: GM auth from server-side session
- database/routes/rulesRoutes.js: GM auth from server-side session
- src/App.js: send x-session-id header with API requests
- src/components/BestiaryTab.jsx: use session-based GM auth

2026-07-16 23:03:52 +02:00

..

bestiaryRoutes.js

Security fix: GM authorized from server-side session via x-session-id header

2026-07-16 23:03:52 +02:00

errorRoutes.js

feat: Error reports create GitHub Issues (alexpolo1/dwroller)

2026-06-25 18:56:30 +02:00

missionRoutes.js

feat: major Deathwatch Roller overhaul with bestiary, mission, and player management

2026-07-15 19:37:07 +02:00

playerRoutes.js

Security fix: GM authorized from server-side session via x-session-id header

2026-07-16 23:03:52 +02:00

rulesRoutes-simple.js

feat: Add validation and normalization utilities for player records

2025-08-16 12:15:32 +02:00

rulesRoutes.js

Security fix: GM authorized from server-side session via x-session-id header

2026-07-16 23:03:52 +02:00

rulesStagingRoutes.js

refactor: Migrate database from SQLite to MariaDB

2025-12-11 19:20:44 +01:00

sessionRoutes.js

feat: Mission Tab — 11 playthrough fixes + 4 follow-up findings

2026-06-24 00:25:51 +02:00

shopRoutes.js

refactor: Migrate database from SQLite to MariaDB

2025-12-11 19:20:44 +01:00

simulationRoutes.js

feat: expand Simulation tab with combat simulation and replay

2026-07-15 19:36:38 +02:00

weaponsRoutes.js

Prepare Deathwatch session tools

2026-06-29 13:37:02 +02:00